diff --git a/.env b/.env
index c6085538a0..35417637da 100644
--- a/.env
+++ b/.env
@@ -6,14 +6,20 @@
 PROWLER_UI_VERSION="stable"
 AUTH_URL=http://localhost:3000
 API_BASE_URL=http://prowler-api:8080/api/v1
+# deprecated, use UI_API_BASE_URL
 NEXT_PUBLIC_API_BASE_URL=${API_BASE_URL}
+UI_API_BASE_URL=${API_BASE_URL}
+# deprecated, use UI_API_DOCS_URL
 NEXT_PUBLIC_API_DOCS_URL=http://prowler-api:8080/api/v1/docs
+UI_API_DOCS_URL=http://prowler-api:8080/api/v1/docs
 AUTH_TRUST_HOST=true
 UI_PORT=3000
 # openssl rand -base64 32
 AUTH_SECRET="N/c6mnaS5+SWq81+819OrzQZlmx1Vxtp/orjttJSmw8="
-# Google Tag Manager ID
+# Google Tag Manager ID (empty/unset ⇒ GTM not loaded, zero egress)
+# deprecated, use UI_GOOGLE_TAG_MANAGER_ID
 NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID=""
+UI_GOOGLE_TAG_MANAGER_ID=""
 
 #### MCP Server ####
 PROWLER_MCP_VERSION=stable
@@ -139,13 +145,19 @@ DJANGO_BROKER_VISIBILITY_TIMEOUT=86400
 DJANGO_SENTRY_DSN=
 DJANGO_THROTTLE_TOKEN_OBTAIN=50/minute
 
-# Sentry settings
-SENTRY_ENVIRONMENT=local
+# Sentry for the web app (server + browser). Empty/unset UI_SENTRY_DSN ⇒
+# Sentry disabled, zero egress. SENTRY_RELEASE (unprefixed) feeds the web app's
+# server/edge SDKs.
+UI_SENTRY_DSN=
+UI_SENTRY_ENVIRONMENT=local
 SENTRY_RELEASE=local
-NEXT_PUBLIC_SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
+# Reserved runtime public config (registered now; no UI consumer yet)
+# POSTHOG_KEY=
+# POSTHOG_HOST=
+# REO_DEV_CLIENT_ID=
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.30.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.31.0
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 3300394d83..ed97ff5a1a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,7 +1,6 @@
 # SDK
 /* @prowler-cloud/detection-remediation
 /prowler/ @prowler-cloud/detection-remediation
-/prowler/compliance/ @prowler-cloud/compliance
 /tests/ @prowler-cloud/detection-remediation
 /dashboard/ @prowler-cloud/detection-remediation
 /docs/ @prowler-cloud/detection-remediation
diff --git a/.github/actions/osv-scanner/action.yml b/.github/actions/osv-scanner/action.yml
index 4bfb5993cb..de5116fdcf 100644
--- a/.github/actions/osv-scanner/action.yml
+++ b/.github/actions/osv-scanner/action.yml
@@ -1,5 +1,5 @@
 name: 'OSV-Scanner'
-description: 'Install osv-scanner and scan a lockfile, failing on HIGH/CRITICAL/UNKNOWN severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
+description: 'Install osv-scanner and scan a lockfile, failing on CRITICAL severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
 author: 'Prowler'
 
 inputs:
@@ -7,9 +7,9 @@ inputs:
     description: 'Path to the lockfile to scan, relative to the repository root (e.g. uv.lock, api/uv.lock, ui/pnpm-lock.yaml).'
     required: true
   severity-levels:
-    description: 'Comma-separated severity levels that fail the scan. Default: HIGH,CRITICAL,UNKNOWN.'
+    description: 'Comma-separated severity levels that fail the scan. Default: CRITICAL.'
     required: false
-    default: 'HIGH,CRITICAL,UNKNOWN'
+    default: 'CRITICAL'
   version:
     description: 'osv-scanner release tag to install. When overriding, you MUST also override binary-sha256.'
     required: false
diff --git a/.github/actions/setup-python-uv/action.yml b/.github/actions/setup-python-uv/action.yml
index e23388d86e..14b9b81d15 100644
--- a/.github/actions/setup-python-uv/action.yml
+++ b/.github/actions/setup-python-uv/action.yml
@@ -43,8 +43,17 @@ runs:
       if: github.repository_owner == 'prowler-cloud' && github.repository != 'prowler-cloud/prowler'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha')
+        LATEST_COMMIT=$(curl -sf \
+          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+          -H "Accept: application/vnd.github+json" \
+          "https://api.github.com/repos/prowler-cloud/prowler/commits/master" \
+          | jq -er '.sha') || {
+          echo "::error::Failed to fetch latest prowler/master commit from the GitHub API (HTTP error or missing .sha). Check the GITHUB_TOKEN and API rate limits."
+          exit 1
+        }
         echo "Latest commit hash: $LATEST_COMMIT"
         sed -i "s|\(git = \"https://github\.com/prowler-cloud/prowler\.git?rev=master\)#[a-f0-9]\{40\}\"|\1#${LATEST_COMMIT}\"|g" uv.lock
         echo "Updated uv.lock entry:"
@@ -54,8 +63,17 @@ runs:
       if: github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'prowler-cloud/prowler'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha')
+        LATEST_COMMIT=$(curl -sf \
+          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+          -H "Accept: application/vnd.github+json" \
+          "https://api.github.com/repos/prowler-cloud/prowler/commits/master" \
+          | jq -er '.sha') || {
+          echo "::error::Failed to fetch latest prowler/master commit from the GitHub API (HTTP error or missing .sha). Check the GITHUB_TOKEN and API rate limits."
+          exit 1
+        }
         echo "Latest commit hash: $LATEST_COMMIT"
         sed -i "s|\(git = \"https://github\.com/prowler-cloud/prowler\.git?rev=master\)#[a-f0-9]\{40\}\"|\1#${LATEST_COMMIT}\"|g" uv.lock
         echo "Updated uv.lock entry:"
diff --git a/.github/actions/trivy-scan/action.yml b/.github/actions/trivy-scan/action.yml
index 9073e2fbcb..45034ddd6a 100644
--- a/.github/actions/trivy-scan/action.yml
+++ b/.github/actions/trivy-scan/action.yml
@@ -63,7 +63,7 @@ runs:
         exit-code: '0'
         scanners: 'vuln'
         timeout: '5m'
-        version: 'v0.69.2'
+        version: 'v0.71.0'
 
     - name: Run Trivy vulnerability scan (SARIF)
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
@@ -76,7 +76,7 @@ runs:
         exit-code: '0'
         scanners: 'vuln'
         timeout: '5m'
-        version: 'v0.69.2'
+        version: 'v0.71.0'
 
     - name: Upload Trivy results to GitHub Security tab
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
diff --git a/.github/scripts/osv-scan.sh b/.github/scripts/osv-scan.sh
index d9c2e1a901..16afc6668c 100755
--- a/.github/scripts/osv-scan.sh
+++ b/.github/scripts/osv-scan.sh
@@ -6,8 +6,7 @@
 #   - .github/workflows/api-security.yml, sdk-security.yml, ui-security.yml
 #
 # Severity levels (comma-separated) are read from OSV_SEVERITY_LEVELS.
-# Default: HIGH,CRITICAL,UNKNOWN — preserves prior .safety-policy.yml policy
-#   (ignore-cvss-severity-below: 7 + ignore-cvss-unknown-severity: False).
+# Default: CRITICAL — only CVSS >= 9.0 findings fail the scan.
 # osv-scanner has no native CVSS threshold (google/osv-scanner#1400, closed
 # not-planned). Severity is derived from $group.max_severity (numeric CVSS
 # score string) which osv-scanner emits per group.
@@ -33,7 +32,7 @@ set -euo pipefail
 
 ROOT="$(git rev-parse --show-toplevel)"
 CONFIG="${ROOT}/osv-scanner.toml"
-SEVERITY_LEVELS="${OSV_SEVERITY_LEVELS:-HIGH,CRITICAL,UNKNOWN}"
+SEVERITY_LEVELS="${OSV_SEVERITY_LEVELS:-CRITICAL}"
 
 for bin in osv-scanner jq; do
   if ! command -v "${bin}" >/dev/null 2>&1; then
diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml
index 44482e2428..d12bf5d2d4 100644
--- a/.github/workflows/api-container-checks.yml
+++ b/.github/workflows/api-container-checks.yml
@@ -12,9 +12,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'api/**'
-      - '.github/workflows/api-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -134,5 +131,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'false'
+          fail-on-critical: 'true'
           severity: 'CRITICAL'
diff --git a/.github/workflows/api-security.yml b/.github/workflows/api-security.yml
index ba7f5fe58a..ed4e5476d2 100644
--- a/.github/workflows/api-security.yml
+++ b/.github/workflows/api-security.yml
@@ -16,13 +16,6 @@ on:
     branches:
       - "master"
       - "v5.*"
-    paths:
-      - 'api/**'
-      - '.github/workflows/api-tests.yml'
-      - '.github/workflows/api-security.yml'
-      - '.github/actions/setup-python-uv/**'
-      - '.github/actions/osv-scanner/**'
-      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/mcp-container-checks.yml b/.github/workflows/mcp-container-checks.yml
index 7493e1b763..23e6ba2984 100644
--- a/.github/workflows/mcp-container-checks.yml
+++ b/.github/workflows/mcp-container-checks.yml
@@ -12,9 +12,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'mcp_server/**'
-      - '.github/workflows/mcp-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -127,5 +124,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'false'
+          fail-on-critical: 'true'
           severity: 'CRITICAL'
diff --git a/.github/workflows/mcp-security.yml b/.github/workflows/mcp-security.yml
index 66a5cd8c0d..4deb6a478d 100644
--- a/.github/workflows/mcp-security.yml
+++ b/.github/workflows/mcp-security.yml
@@ -15,12 +15,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'mcp_server/pyproject.toml'
-      - 'mcp_server/uv.lock'
-      - '.github/workflows/mcp-security.yml'
-      - '.github/actions/osv-scanner/**'
-      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,7 +24,6 @@ permissions: {}
 
 jobs:
   mcp-security-scans:
-    if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
diff --git a/.github/workflows/sdk-code-quality.yml b/.github/workflows/sdk-code-quality.yml
index 5c76547989..2b1efc69a9 100644
--- a/.github/workflows/sdk-code-quality.yml
+++ b/.github/workflows/sdk-code-quality.yml
@@ -29,6 +29,7 @@ jobs:
           - '3.10'
           - '3.11'
           - '3.12'
+          - '3.13'
 
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/sdk-container-checks.yml b/.github/workflows/sdk-container-checks.yml
index 42709ac6f7..2b436db468 100644
--- a/.github/workflows/sdk-container-checks.yml
+++ b/.github/workflows/sdk-container-checks.yml
@@ -15,12 +15,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'prowler/**'
-      - 'Dockerfile*'
-      - 'pyproject.toml'
-      - 'uv.lock'
-      - '.github/workflows/sdk-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -111,25 +105,14 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: ./**
+          files: |
+            prowler/**
+            Dockerfile*
+            pyproject.toml
+            uv.lock
+            .github/workflows/sdk-container-checks.yml
           files_ignore: |
-            .github/**
             prowler/CHANGELOG.md
-            docs/**
-            permissions/**
-            api/**
-            ui/**
-            dashboard/**
-            mcp_server/**
-            skills/**
-            README.md
-            mkdocs.yml
-            .backportrc.json
-            .env
-            docker-compose*
-            examples/**
-            .gitignore
-            contrib/**
             **/AGENTS.md
 
       - name: Set up Docker Buildx
@@ -153,5 +136,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'false'
+          fail-on-critical: 'true'
           severity: 'CRITICAL'
diff --git a/.github/workflows/sdk-security.yml b/.github/workflows/sdk-security.yml
index c18f56ea8f..11a7894ce8 100644
--- a/.github/workflows/sdk-security.yml
+++ b/.github/workflows/sdk-security.yml
@@ -19,16 +19,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'prowler/**'
-      - 'tests/**'
-      - 'pyproject.toml'
-      - 'uv.lock'
-      - '.github/workflows/sdk-tests.yml'
-      - '.github/workflows/sdk-security.yml'
-      - '.github/actions/setup-python-uv/**'
-      - '.github/actions/osv-scanner/**'
-      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -71,27 +61,18 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files:
-            ./**
+          files: |
+            prowler/**
+            tests/**
+            pyproject.toml
+            uv.lock
+            .github/workflows/sdk-tests.yml
             .github/workflows/sdk-security.yml
+            .github/actions/setup-python-uv/**
+            .github/actions/osv-scanner/**
+            .github/scripts/osv-scan.sh
           files_ignore: |
-            .github/**
             prowler/CHANGELOG.md
-            docs/**
-            permissions/**
-            api/**
-            ui/**
-            dashboard/**
-            mcp_server/**
-            skills/**
-            README.md
-            mkdocs.yml
-            .backportrc.json
-            .env
-            docker-compose*
-            examples/**
-            .gitignore
-            contrib/**
             **/AGENTS.md
 
       - name: Setup Python with uv
diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml
index d0ef83c772..2952ebc2d5 100644
--- a/.github/workflows/sdk-tests.yml
+++ b/.github/workflows/sdk-tests.yml
@@ -29,6 +29,7 @@ jobs:
           - '3.10'
           - '3.11'
           - '3.12'
+          - '3.13'
 
     steps:
       - name: Harden Runner
@@ -589,6 +590,33 @@ jobs:
           flags: prowler-py${{ matrix.python-version }}-stackit
           files: ./stackit_coverage.xml
 
+      # External Provider (dynamic loading)
+      - name: Check if External Provider files changed
+        if: steps.check-changes.outputs.any_changed == 'true'
+        id: changed-external
+        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        with:
+          files: |
+            ./prowler/providers/common/**
+            ./prowler/config/**
+            ./prowler/lib/**
+            ./tests/providers/external/**
+            ./uv.lock
+
+      - name: Run External Provider tests
+        if: steps.changed-external.outputs.any_changed == 'true'
+        run: uv run pytest -n auto --cov=./prowler/providers/common --cov=./prowler/config --cov=./prowler/lib --cov-report=xml:external_coverage.xml tests/providers/external
+
+      - name: Upload External Provider coverage to Codecov
+        if: steps.changed-external.outputs.any_changed == 'true'
+
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        with:
+          flags: prowler-py${{ matrix.python-version }}-external
+          files: ./external_coverage.xml
+
       # Lib
       - name: Check if Lib files changed
         if: steps.check-changes.outputs.any_changed == 'true'
diff --git a/.github/workflows/ui-container-build-push.yml b/.github/workflows/ui-container-build-push.yml
index 984256af7f..3210f6e998 100644
--- a/.github/workflows/ui-container-build-push.yml
+++ b/.github/workflows/ui-container-build-push.yml
@@ -32,9 +32,6 @@ env:
   PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud
   PROWLERCLOUD_DOCKERHUB_IMAGE: prowler-ui
 
-  # Build args
-  NEXT_PUBLIC_API_BASE_URL: http://prowler-api:8080/api/v1
-
 permissions: {}
 
 jobs:
@@ -146,7 +143,6 @@ jobs:
           context: ${{ env.WORKING_DIRECTORY }}
           build-args: |
             NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('v{0}', env.RELEASE_TAG) || needs.setup.outputs.short-sha }}
-            NEXT_PUBLIC_API_BASE_URL=${{ env.NEXT_PUBLIC_API_BASE_URL }}
           push: true
           platforms: ${{ matrix.platform }}
           tags: |
diff --git a/.github/workflows/ui-container-checks.yml b/.github/workflows/ui-container-checks.yml
index 0eae703fce..a931e50f22 100644
--- a/.github/workflows/ui-container-checks.yml
+++ b/.github/workflows/ui-container-checks.yml
@@ -12,9 +12,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'ui/**'
-      - '.github/workflows/ui-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -132,5 +129,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'false'
+          fail-on-critical: 'true'
           severity: 'CRITICAL'
diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml
index 5e50adb19c..7165882d62 100644
--- a/.github/workflows/ui-e2e-tests-v2.yml
+++ b/.github/workflows/ui-e2e-tests-v2.yml
@@ -40,7 +40,8 @@ jobs:
       AUTH_SECRET: 'fallback-ci-secret-for-testing'
       AUTH_TRUST_HOST: true
       NEXTAUTH_URL: 'http://localhost:3000'
-      NEXT_PUBLIC_API_BASE_URL: 'http://localhost:8080/api/v1'
+      AUTH_URL: 'http://localhost:3000'
+      UI_API_BASE_URL: 'http://localhost:8080/api/v1'
       E2E_ADMIN_USER: ${{ secrets.E2E_ADMIN_USER }}
       E2E_ADMIN_PASSWORD: ${{ secrets.E2E_ADMIN_PASSWORD }}
       E2E_AWS_PROVIDER_ACCOUNT_ID: ${{ secrets.E2E_AWS_PROVIDER_ACCOUNT_ID }}
@@ -77,6 +78,14 @@ jobs:
       E2E_ALIBABACLOUD_ACCESS_KEY_ID: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_ID }}
       E2E_ALIBABACLOUD_ACCESS_KEY_SECRET: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_SECRET }}
       E2E_ALIBABACLOUD_ROLE_ARN: ${{ secrets.E2E_ALIBABACLOUD_ROLE_ARN }}
+      E2E_OKTA_DOMAIN: ${{ secrets.E2E_OKTA_DOMAIN }}
+      E2E_OKTA_CLIENT_ID: ${{ secrets.E2E_OKTA_CLIENT_ID }}
+      E2E_OKTA_BASE64_PRIVATE_KEY: ${{ secrets.E2E_OKTA_BASE64_PRIVATE_KEY }}
+      E2E_GOOGLEWORKSPACE_CUSTOMER_ID: ${{ secrets.E2E_GOOGLEWORKSPACE_CUSTOMER_ID }}
+      E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON: ${{ secrets.E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON }}
+      E2E_GOOGLEWORKSPACE_DELEGATED_USER: ${{ secrets.E2E_GOOGLEWORKSPACE_DELEGATED_USER }}
+      E2E_VERCEL_TEAM_ID: ${{ secrets.E2E_VERCEL_TEAM_ID }}
+      E2E_VERCEL_API_TOKEN: ${{ secrets.E2E_VERCEL_API_TOKEN }}
       # Pass E2E paths from impact analysis
       E2E_TEST_PATHS: ${{ needs.impact-analysis.outputs.ui-e2e }}
       RUN_ALL_TESTS: ${{ needs.impact-analysis.outputs.run-all }}
@@ -134,7 +143,17 @@ jobs:
         # docker-compose.yml references prowlercloud/prowler-api:latest from the registry,
         # which lags behind PR changes; build locally so E2E exercises the API image
         # produced by this PR.
-        run: docker build -t prowlercloud/prowler-api:latest ./api
+        #
+        # The image installs the SDK from git@master (api/uv.lock), so a PR changing BOTH the SDK
+        # and the API would run against the OLD SDK and crash on startup. Overlay the checkout's
+        # SDK source so both run together. New SDK dependencies still need an api/uv.lock bump.
+        run: |
+          docker build -t prowlercloud/prowler-api:pr-base ./api
+          docker build -t prowlercloud/prowler-api:latest -f - prowler <<'DOCKERFILE'
+          FROM prowlercloud/prowler-api:pr-base
+          RUN rm -rf /home/prowler/.venv/lib/python3.12/site-packages/prowler
+          COPY --chown=prowler:prowler . /home/prowler/.venv/lib/python3.12/site-packages/prowler
+          DOCKERFILE
 
       - name: Start API services
         run: |
@@ -147,7 +166,7 @@ jobs:
           timeout=150
           elapsed=0
           while [ $elapsed -lt $timeout ]; do
-            if curl -s ${NEXT_PUBLIC_API_BASE_URL}/docs >/dev/null 2>&1; then
+            if curl -s ${UI_API_BASE_URL}/docs >/dev/null 2>&1; then
               echo "Prowler API is ready!"
               exit 0
             fi
diff --git a/.github/workflows/ui-security.yml b/.github/workflows/ui-security.yml
index 470fae1f9c..2dc444654f 100644
--- a/.github/workflows/ui-security.yml
+++ b/.github/workflows/ui-security.yml
@@ -15,12 +15,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'ui/package.json'
-      - 'ui/pnpm-lock.yaml'
-      - '.github/workflows/ui-security.yml'
-      - '.github/actions/osv-scanner/**'
-      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,7 +24,6 @@ permissions: {}
 
 jobs:
   ui-security-scans:
-    if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml
index 918755a629..2dc50a26bb 100644
--- a/.github/workflows/ui-tests.yml
+++ b/.github/workflows/ui-tests.yml
@@ -131,6 +131,10 @@ jobs:
         if: steps.check-changes.outputs.any_changed == 'true'
         run: pnpm run healthcheck
 
+      - name: Check product-tour alignment
+        if: steps.check-changes.outputs.any_changed == 'true'
+        run: pnpm run tour:check
+
       - name: Run pnpm audit
         if: steps.check-changes.outputs.any_changed == 'true'
         run: pnpm run audit
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4e79141bb7..1e9d74c973 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -7,6 +7,10 @@
 #   P50 — dependency validation
 
 default_install_hook_types: [pre-commit]
+# Hooks run on commit only by default;
+# NOTE: default_stages does NOT override a hook's manifest stages, so fixers shipping pre-push in their
+# manifest need an explicit stages: ["pre-commit"] below to stay off push.
+default_stages: [pre-commit]
 
 repos:
   ## GENERAL (prek built-in — no external repo needed)
@@ -21,13 +25,16 @@ repos:
       - id: check-json
         priority: 10
       - id: end-of-file-fixer
+        stages: ["pre-commit"]
         priority: 0
       - id: trailing-whitespace
+        stages: ["pre-commit"]
         priority: 0
       - id: no-commit-to-branch
         priority: 10
       - id: pretty-format-json
         args: ["--autofix", --no-sort-keys, --no-ensure-ascii]
+        stages: ["pre-commit"]
         priority: 10
 
   ## TOML
@@ -82,6 +89,7 @@ repos:
         name: "SDK - isort"
         files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         args: ["--profile", "black"]
+        stages: ["pre-commit"]
         priority: 20
 
   - repo: https://github.com/psf/black
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000000..117925354f
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,85 @@
+# Trivy ignore file for prowlercloud/prowler SDK container image.
+# Each entry below documents (a) the affected package and why it ships in the
+# image, (b) why the CVE is not exploitable in Prowler's runtime, and (c) the
+# upstream fix status. Entries carry an expiry so they auto-force re-review.
+# Entries are scoped per-package so suppressions cannot drift onto unrelated
+# packages that may be assigned the same CVE in the future.
+#
+# Scanned by: .github/actions/trivy-scan via .github/workflows/sdk-container-checks.yml
+
+# CVE-2026-42496 — perl-archive-tar path traversal via crafted symlinks.
+# CVE-2026-8376  — perl heap buffer overflow when compiling regex.
+# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
+# Why ignored: perl-base is part of Debian's "Essential: yes" set; it cannot be
+# removed without breaking dpkg. The Prowler SDK does not invoke perl at runtime;
+# neither vulnerable code path (Archive::Tar parsing or regex compilation of
+# attacker-controlled input) is reachable from Prowler. No Debian bookworm fix
+# is available yet.
+CVE-2026-42496 pkg:perl exp:2026-07-15
+CVE-2026-42496 pkg:perl-base exp:2026-07-15
+CVE-2026-42496 pkg:perl-modules-5.36 exp:2026-07-15
+CVE-2026-42496 pkg:libperl5.36 exp:2026-07-15
+CVE-2026-8376 pkg:perl exp:2026-07-15
+CVE-2026-8376 pkg:perl-base exp:2026-07-15
+CVE-2026-8376 pkg:perl-modules-5.36 exp:2026-07-15
+CVE-2026-8376 pkg:libperl5.36 exp:2026-07-15
+
+# CVE-2025-7458 — SQLite integer overflow.
+# Package: libsqlite3-0.
+# Why ignored: transitive dependency of CPython's stdlib sqlite3 module. The
+# Prowler SDK does not open user-supplied SQLite databases; SQLite usage is
+# internal and bounded. No Debian bookworm fix is available.
+CVE-2025-7458 pkg:libsqlite3-0 exp:2026-07-15
+
+# CVE-2026-43185 — Linux kernel ksmbd signedness bug.
+# Package: linux-libc-dev.
+# Why ignored: linux-libc-dev ships kernel headers for build-time compilation,
+# not a running kernel. Containers execute against the host kernel, so these
+# headers are inert at runtime. The upstream fix landed in kernel 7.0-rc2 and
+# has not been backported to Debian's 6.1 LTS line.
+CVE-2026-43185 pkg:linux-libc-dev exp:2026-07-15
+
+# CVE-2023-45853 — zlib MiniZip integer overflow / heap overflow in
+# zipOpenNewFileInZip4_64.
+# Packages: zlib1g, zlib1g-dev.
+# Why ignored: Debian Security Tracker status for bookworm is <ignored>, with
+# the published rationale "contrib/minizip not built and src:zlib not producing
+# binary packages" — i.e. the vulnerable symbol is not present in the libz.so
+# shipped by Debian. Real-not-affected, not unpatched. Upstream fix is in
+# zlib 1.3.1, available in Debian trixie (13); migrating the base image would
+# clear it fully.
+# Ref: https://security-tracker.debian.org/tracker/CVE-2023-45853
+CVE-2023-45853 pkg:zlib1g exp:2026-07-15
+CVE-2023-45853 pkg:zlib1g-dev exp:2026-07-15
+
+# --- API container image (api/Dockerfile) ---
+# The entries below are specific to the Prowler API image, which ships
+# PowerShell and additional build tooling on top of the same bookworm base.
+
+# CVE-2026-7210 — CPython/Expat hash-flooding denial of service in
+# `xml.parsers.expat` and `xml.etree.ElementTree`.
+# Packages: the Debian system Python 3.11 (python3.11*, libpython3.11*).
+# Why ignored: the API runs under the Python 3.12 interpreter shipped in its
+# `.venv`; the system `python3.11` is only present because `python3-dev` is
+# pulled in to compile native extensions (xmlsec, lxml) and is never executed
+# at runtime. The vulnerable path requires parsing attacker-controlled XML with
+# the affected interpreter, which Prowler does not do with the system Python.
+# Full mitigation also needs libexpat >= 2.8.0; no Debian bookworm fix yet.
+CVE-2026-7210 pkg:python3.11 exp:2026-07-15
+CVE-2026-7210 pkg:python3.11-dev exp:2026-07-15
+CVE-2026-7210 pkg:python3.11-minimal exp:2026-07-15
+CVE-2026-7210 pkg:libpython3.11 exp:2026-07-15
+CVE-2026-7210 pkg:libpython3.11-dev exp:2026-07-15
+CVE-2026-7210 pkg:libpython3.11-minimal exp:2026-07-15
+CVE-2026-7210 pkg:libpython3.11-stdlib exp:2026-07-15
+
+# CVE-2026-33278 — Unbound DNSSEC validator use-after-free (DoS, possible RCE).
+# CVE-2026-42960 — Unbound DNS cache poisoning via promiscuous additional records.
+# Package: libunbound8.
+# Why ignored: libunbound8 is a transitive apt dependency of the TLS/networking
+# stack (GnuTLS DANE support); only the shared library ships in the image. Both
+# vulnerabilities require operating a live Unbound recursive DNSSEC validator
+# that processes attacker-influenced DNS responses. Prowler never starts an
+# Unbound resolver, so neither code path is reachable. No Debian bookworm fix yet.
+CVE-2026-33278 pkg:libunbound8 exp:2026-07-15
+CVE-2026-42960 pkg:libunbound8 exp:2026-07-15
diff --git a/AGENTS.md b/AGENTS.md
index 1cf023889c..c9d63a8c27 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -51,6 +51,7 @@ Use these skills for detailed patterns on-demand:
 | `django-migration-psql` | Django migration best practices for PostgreSQL | [SKILL.md](skills/django-migration-psql/SKILL.md) |
 | `postgresql-indexing` | PostgreSQL indexing, EXPLAIN, monitoring, maintenance | [SKILL.md](skills/postgresql-indexing/SKILL.md) |
 | `prowler-attack-paths-query` | Create Attack Paths openCypher queries | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |
+| `prowler-tour` | Keep product-tour definitions aligned with the UI | [SKILL.md](skills/prowler-tour/SKILL.md) |
 | `gh-aw` | GitHub Agentic Workflows (gh-aw) | [SKILL.md](skills/gh-aw/SKILL.md) |
 | `skill-creator` | Create new AI agent skills | [SKILL.md](skills/skill-creator/SKILL.md) |
 
@@ -67,10 +68,12 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Adding new providers | `prowler-provider` |
 | Adding privilege escalation detection queries | `prowler-attack-paths-query` |
 | Adding services to existing providers | `prowler-provider` |
+| Adding, updating, or removing a tour definition (*.tour.ts) | `prowler-tour` |
 | After creating/modifying a skill | `skill-sync` |
 | App Router / Server Actions | `nextjs-16` |
 | Auditing check-to-requirement mappings as a cloud auditor | `prowler-compliance` |
 | Building AI chat features | `ai-sdk-5` |
+| Changing button labels or section headings on a tour-covered page | `prowler-tour` |
 | Committing changes | `prowler-commit` |
 | Configuring MCP servers in agentic workflows | `gh-aw` |
 | Create PR that requires changelog entry | `prowler-changelog` |
@@ -89,6 +92,7 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Creating/updating compliance frameworks | `prowler-compliance` |
 | Debug why a GitHub Actions job is failing | `prowler-ci` |
 | Debugging gh-aw compilation errors | `gh-aw` |
+| Editing a UI file containing data-tour-id attributes | `prowler-tour` |
 | Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist) | `prowler-pr` |
 | Fixing bug | `tdd` |
 | Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs) | `prowler-compliance` |
@@ -105,6 +109,8 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Modifying gh-aw workflow frontmatter or safe-outputs | `gh-aw` |
 | Refactoring code | `tdd` |
 | Regenerate AGENTS.md Auto-invoke tables (sync.sh) | `skill-sync` |
+| Renaming or removing a data-tour-id attribute value | `prowler-tour` |
+| Restructuring routes or layouts covered by a tour | `prowler-tour` |
 | Review PR requirements: template, title conventions, changelog gate | `prowler-pr` |
 | Review changelog format and conventions | `prowler-changelog` |
 | Reviewing JSON:API compliance | `jsonapi` |
diff --git a/Dockerfile b/Dockerfile
index 0ab4458fad..678cb2b36f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7 AS build
+FROM python:3.12.13-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
@@ -6,7 +6,7 @@ LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
 ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 
-ARG TRIVY_VERSION=0.70.0
+ARG TRIVY_VERSION=0.71.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
diff --git a/Makefile b/Makefile
index 8bdb9bf156..e2623a4bf3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,34 @@
 .DEFAULT_GOAL:=help
 
+DEV_LOCAL := ./scripts/development/dev-local.sh
+
+.PHONY: dev dev-setup dev-attach dev-launch dev-stop dev-clean dev-wipe dev-status
+
+##@ Local Development
+dev: ## Start local API, worker, and database logs
+	$(DEV_LOCAL) all
+
+dev-setup: ## Bootstrap local dependencies, migrations, and fixtures
+	$(DEV_LOCAL) setup
+
+dev-attach: ## Attach to the local tmux development session
+	$(DEV_LOCAL) attach
+
+dev-launch: ## Start the local stack on fixed ports and attach
+	$(DEV_LOCAL) launch
+
+dev-stop: ## Stop the local tmux session and containers
+	$(DEV_LOCAL) kill
+
+dev-clean: ## Remove stopped local development containers
+	$(DEV_LOCAL) clean
+
+dev-wipe: ## Stop everything and delete local development data
+	$(DEV_LOCAL) wipe
+
+dev-status: ## Show local development container status
+	$(DEV_LOCAL) status
+
 ##@ Testing
 test:   ## Test with pytest
 	rm -rf .coverage && \
diff --git a/README.md b/README.md
index eff78169b0..74e91021ca 100644
--- a/README.md
+++ b/README.md
@@ -122,7 +122,7 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 | Vercel | 26 | 6 | 0 | 8 | Official | UI, API, CLI |
 | Okta | 1 | 1 | 0 | 1 | Official | CLI |
 | Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 0 | 1 | Unofficial | CLI |
-| StackIT [Contact us](https://prowler.com/contact) | 4 | 1 | 0 | 1 | Unofficial | CLI |
+| StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 0 | 3 | Unofficial | CLI |
 | NHN | 6 | 2 | 1 | 0 | Unofficial | CLI |
 
 > [!Note]
@@ -153,6 +153,8 @@ Prowler App offers flexible installation methods tailored to various environment
 
 #### Commands
 
+_macOS/Linux:_
+
 ``` console
 VERSION=$(curl -s https://api.github.com/repos/prowler-cloud/prowler/releases/latest | jq -r .tag_name)
 curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${VERSION}/docker-compose.yml"
@@ -161,6 +163,16 @@ curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${V
 docker compose up -d
 ```
 
+_Windows PowerShell:_
+
+``` powershell
+$VERSION = (Invoke-RestMethod -Uri "https://api.github.com/repos/prowler-cloud/prowler/releases/latest").tag_name
+Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/docker-compose.yml" -OutFile "docker-compose.yml"
+# Environment variables can be customized in the .env file. Using default values in production environments is not recommended.
+Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/.env" -OutFile ".env"
+docker compose up -d
+```
+
 > [!WARNING]
 > 🔒 For a secure setup, the API auto-generates a unique key pair, `DJANGO_TOKEN_SIGNING_KEY` and `DJANGO_TOKEN_VERIFYING_KEY`, and stores it in `~/.config/prowler-api` (non-container) or the bound Docker volume in `_data/api` (container). Never commit or reuse static/default keys. To rotate keys, delete the stored key files and restart the API.
 
diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index bbc675c8d2..8e2130fb88 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -2,6 +2,92 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
+## [1.32.0] (Prowler UNRELEASED)
+
+### 🚀 Added
+
+- Provider group filters for API endpoints that support cloud provider filtering, including exact and `__in` variants [(#11573)](https://github.com/prowler-cloud/prowler/pull/11573)
+- Provider filters for `GET /api/v1/compliance-overviews`, `/metadata`, and `/requirements`, using latest completed scans per matching provider [(#11587)](https://github.com/prowler-cloud/prowler/pull/11587)
+- Server-Sent Events (SSE) infrastructure for the API: a base viewset, a tenant-aware channel manager, and channel-name helpers backed by `django-eventstream` over Valkey Pub/Sub and served through the Gunicorn ASGI worker, so feature endpoints can stream events to clients over a single long-lived connection [(#11556)](https://github.com/prowler-cloud/prowler/pull/11556)
+
+### 🔄 Changed
+
+- Gunicorn worker timeout raised from the 30s default to 120s, so long-running requests are no longer killed prematurely [(#11631)](https://github.com/prowler-cloud/prowler/pull/11631)
+- Sentry now drops ASGI's `RequestAborted` errors from health-check probe disconnects on `/health/live` [(#11632)](https://github.com/prowler-cloud/prowler/pull/11632)
+
+### 🐞 Fixed
+
+- Database connections no longer leak under the ASGI worker, which previously exhausted the read replica's connection slots and caused 500s on read endpoints [(#11640)](https://github.com/prowler-cloud/prowler/pull/11640)
+
+### 🔐 Security
+
+- `aiohttp` to 3.14.0 and `idna` to 3.15, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
+- Container base image to `python:3.12.13-slim-bookworm` and `trivy` to 0.71.0, patching OS and Go module CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
+- `trivy` binary bumped to 0.71.0 patching embedded `golang.org/x/crypto`, `golang.org/x/net`, and Go `stdlib` CVEs [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
+
+---
+
+## [1.31.2] (Prowler v5.30.2)
+
+### 🔄 Changed
+
+- `scan-compliance-overviews` task now streams the findings aggregation and the requirement-row writes so it runs faster and its peak memory no longer grows with the number of regions and frameworks [(#11591)](https://github.com/prowler-cloud/prowler/pull/11591)
+
+---
+
+## [1.31.1] (Prowler v5.30.1)
+
+### 🐞 Fixed
+
+- `compliance-overviews/attributes` now resolves the provider from the scan, so multi-provider universal frameworks (e.g. CSA CCM) return the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
+- Attack Paths: `drop_subgraph` now deletes relationships first and then nodes in batches, using less memory on Neo4j when clearing a dense provider graph [(#11557)](https://github.com/prowler-cloud/prowler/pull/11557)
+- OCI scans now use API key credentials with the configured region instead of falling back to `/home/prowler/.oci/config` [(#11558)](https://github.com/prowler-cloud/prowler/pull/11558)
+
+---
+
+## [1.31.0] (Prowler v5.30.0)
+
+### 🚀 Added
+
+- Opt-in automatic recovery of allowlisted idempotent background tasks whose worker died during a deploy or crash: when enabled via `DJANGO_TASK_RECOVERY_ENABLED` (off by default), stuck summary and deletion tasks are detected and re-run instead of staying pending forever (scan and Jira tasks are excluded), with a `reconcile_orphan_tasks` management command for on-demand recovery [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
+- DORA compliance framework support [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
+- Label Postgres connections with `application_name="<component>:<alias>"` (component injected per process via `DJANGO_APP_COMPONENT`) so connections are attributable by component in `pg_stat_activity` [(#11494)](https://github.com/prowler-cloud/prowler/pull/11494)
+- DISA Okta IDaaS STIG V1R2 compliance framework export support for the Okta provider [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
+
+### 🔄 Changed
+
+- Allowlisted idempotent background tasks are no longer lost when a worker is stopped or crashes mid-task; tasks with external side effects are marked terminal instead of blindly re-running [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
+- SAML logins no longer wipe a user's roles when the IdP does not send the `userType` attribute; existing roles are kept, and when `userType` names a role that does not exist it is now created with read-only access (visibility over all providers, no management permissions) instead of no permissions at all [(#11520)](https://github.com/prowler-cloud/prowler/pull/11520)
+
+### 🐞 Fixed
+
+- Workers now shut down gracefully on deploy or restart, finishing or re-queueing in-flight tasks instead of being force-killed and leaving them stuck [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
+- Resource `name` is now stored and refreshed on every scan, so resources no longer keep an empty name [(#11476)](https://github.com/prowler-cloud/prowler/pull/11476)
+- Compliance catalog now warms in background during startup. `compliance-overviews/attributes` returns `503` while warming, so the first request after a deploy no longer trips the API timeout [(#11530)](https://github.com/prowler-cloud/prowler/pull/11530)
+
+### 🔐 Security
+
+- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
+
+---
+
+## [1.30.3] (Prowler v5.29.3)
+
+### 🐞 Fixed
+
+- API startup no longer crashes when Neo4j is unreachable, as the Neo4j driver now connects lazily on first use rather than during app initialization [(#11491)](https://github.com/prowler-cloud/prowler/pull/11491)
+
+---
+
+## [1.30.1] (Prowler v5.29.1)
+
+### 🐞 Fixed
+
+- `GET /api/v1/findings` N+1 query loading `resources__tags` when listing findings [(#11420)](https://github.com/prowler-cloud/prowler/pull/11420)
+- Clean up the scan tmp output directory when `scan-report` fails so partial files do not accumulate and fill the worker disk (`No space left on device`) [(#11421)](https://github.com/prowler-cloud/prowler/pull/11421)
+
+---
+
 ## [1.30.0] (Prowler v5.29.0)
 
 ### 🔄 Changed
diff --git a/api/Dockerfile b/api/Dockerfile
index 259492cb08..bb9da0b280 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -1,11 +1,11 @@
-FROM python:3.12.10-slim-bookworm@sha256:fd95fa221297a88e1cf49c55ec1828edd7c5a428187e67b5d1805692d11588db AS build
+FROM python:3.12.13-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/api"
 
 ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 
-ARG TRIVY_VERSION=0.70.0
+ARG TRIVY_VERSION=0.71.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
diff --git a/api/README.md b/api/README.md
index ea9661366f..c510479ab2 100644
--- a/api/README.md
+++ b/api/README.md
@@ -196,6 +196,42 @@ python -m celery -A config.celery worker -l info -E
 
 The Celery worker does not detect and reload changes in the code, so you need to restart it manually when you make changes.
 
+### Makefile-Assisted Local Deployment
+
+This method is an additional local development workflow. It does not replace the manual local deployment or the Docker deployment described in this guide.
+
+PostgreSQL, Valkey, and Neo4j run with Docker Compose, while Django and the Celery worker run natively through `uv`. Additionally, this workflow creates a `tmux` session with panes for the API, worker, and PostgreSQL logs.
+
+Before using this method, ensure `docker compose`, `tmux`, and `uv` are installed.
+
+This workflow is designed for macOS and should also work on Linux when Docker, `tmux`, and `uv` are available. Windows requires script changes before it can be supported.
+
+From the repository root, run:
+
+```console
+make dev
+```
+
+The API will be available at:
+
+```console
+http://localhost:8080/api/v1
+```
+
+Use these commands to manage the local stack:
+
+```console
+make dev-setup   # Bootstrap dependencies, migrations, and fixtures
+make dev-attach  # Attach to the tmux session
+make dev-launch  # Start the stack on fixed ports and attach
+make dev-stop    # Stop the tmux session and containers
+make dev-clean   # Remove stopped development containers
+make dev-wipe    # Stop everything and delete local development data
+make dev-status  # Show development container status
+```
+
+This workflow does not start the UI. Start it separately from the `ui/` directory when needed.
+
 ### Docker deployment
 
 This method requires `docker` and `docker compose`.
diff --git a/api/docker-entrypoint.sh b/api/docker-entrypoint.sh
index 4535fb34e2..e077a3bfd6 100755
--- a/api/docker-entrypoint.sh
+++ b/api/docker-entrypoint.sh
@@ -21,13 +21,19 @@ apply_fixtures() {
 }
 
 start_dev_server() {
-  echo "Starting the development server..."
-  uv run python manage.py runserver 0.0.0.0:"${DJANGO_PORT:-8080}"
+  echo "Starting the development server (Gunicorn ASGI, debug + reload)..."
+  # Same server/worker as prod (config.asgi via the native `asgi` worker), so
+  # SSE streams run on the event loop exactly as they do in production. DEBUG is
+  # on so guniconf's `reload = DEBUG` hot-reloads edited code (and flips
+  # `preload_app` off so reload actually takes).
+  export DJANGO_DEBUG="${DJANGO_DEBUG:-True}"
+  export DJANGO_BIND_ADDRESS="${DJANGO_BIND_ADDRESS:-0.0.0.0}"
+  exec uv run gunicorn -c config/guniconf.py config.asgi:application
 }
 
 start_prod_server() {
   echo "Starting the Gunicorn server..."
-  uv run gunicorn -c config/guniconf.py config.wsgi:application
+  exec uv run gunicorn -c config/guniconf.py config.asgi:application
 }
 
 resolve_worker_hostname() {
@@ -47,7 +53,7 @@ resolve_worker_hostname() {
 
 start_worker() {
   echo "Starting the worker..."
-  uv run python -m celery -A config.celery worker \
+  exec uv run python -m celery -A config.celery worker \
     -n "$(resolve_worker_hostname)" \
     -l "${DJANGO_LOGGING_LEVEL:-info}" \
     -Q celery,scans,scan-reports,deletion,backfill,overview,integrations,compliance,attack-paths-scans \
@@ -56,7 +62,7 @@ start_worker() {
 
 start_worker_beat() {
   echo "Starting the worker-beat..."
-  uv run python -m celery -A config.celery beat -l "${DJANGO_LOGGING_LEVEL:-info}" --scheduler django_celery_beat.schedulers:DatabaseScheduler
+  exec uv run python -m celery -A config.celery beat -l "${DJANGO_LOGGING_LEVEL:-info}" --scheduler django_celery_beat.schedulers:DatabaseScheduler
 }
 
 manage_db_partitions() {
@@ -68,6 +74,15 @@ manage_db_partitions() {
   fi
 }
 
+# Identify this process to Postgres (application_name=<component>:<alias>) so
+# connections are attributable by component in pg_stat_activity. Web tiers
+# report "api"; everything else uses the launch subcommand.
+case "$1" in
+  prod|dev) DJANGO_APP_COMPONENT="api" ;;
+  *)        DJANGO_APP_COMPONENT="$1" ;;
+esac
+export DJANGO_APP_COMPONENT
+
 case "$1" in
   dev)
     apply_migrations
diff --git a/api/docs/orphan-task-recovery.md b/api/docs/orphan-task-recovery.md
new file mode 100644
index 0000000000..a47b4f36a9
--- /dev/null
+++ b/api/docs/orphan-task-recovery.md
@@ -0,0 +1,105 @@
+# Orphan Celery task recovery
+
+When a worker is terminated mid-task (a deploy, an OOM kill, a node eviction), the
+task it was running can be left non-terminal forever: the `TaskResult` stays
+`STARTED` and nothing re-runs it. This page describes the mechanisms that detect and
+recover allowlisted idempotent orphans so pending-task alerts do not fire. Scan tasks
+are not auto-recovered (re-running a scan is not safe to do automatically); the
+watchdog covers the summary/aggregation and deletion tasks.
+
+## How recovery works
+
+1. **Durable delivery.** The broker is configured so a task message is acknowledged
+   only after the task finishes (`task_acks_late`), one task is reserved at a time
+   (`worker_prefetch_multiplier = 1`), and an abruptly-lost worker re-queues its task
+   (`task_reject_on_worker_lost`). On `SIGTERM` the worker is given a soft-shutdown
+   window (`worker_soft_shutdown_timeout`) to finish or re-queue in-flight work
+   before it is force-killed. `scan-perform`, `scan-perform-scheduled` and
+   `integration-jira` opt out of redelivery with `acks_late=False`, so a crash drops
+   them rather than re-running and duplicating findings or Jira issues. Other
+   non-recovered side-effect tasks keep `acks_late=True`, so the broker can still
+   re-deliver them after a worker loss: the S3 upload rebuilds from worker-local files
+   that did not survive the crash and so no-ops, but Security Hub re-reads findings from
+   the DB and re-sends them to AWS.
+
+2. **Periodic watchdog.** A Beat task, `reconcile-orphan-tasks`, runs every couple of
+   minutes (a `django_celery_beat` periodic task created by migration). For each
+   in-flight task result with an allowlisted idempotent task name, it pings the
+   worker recorded on the task's `TaskResult`:
+   - worker responds -> the task is still running, leave it alone;
+   - worker is gone (and the task started before a short grace window) -> it is a
+     real orphan: the stale task is revoked and marked terminal (clearing the
+     pending/started alert), and the task is re-enqueued from its stored name and
+     kwargs.
+
+   The re-run is safe because only tasks with proven idempotency are allowlisted: the
+   summary/aggregation tasks clear and re-write their own rows, and deletions are
+   idempotent. Scan tasks and external side effects are excluded: re-running a scan is
+   not safe to do automatically, Jira sends would create duplicate issues, the S3
+   upload rebuilds from worker-local files that do not survive a crash, and
+   report/Security Hub recovery is out of scope.
+
+3. **Recovery cap.** A per-task Valkey counter limits how often the same task is
+   re-enqueued. After `--max-attempts` recoveries (default 3) the orphan is marked
+   terminal instead of re-enqueued, so a task that repeatedly kills its worker cannot
+   loop forever.
+
+A Postgres advisory lock ensures that, even with multiple API/worker replicas, only
+one reconciliation runs at a time; the others no-op.
+
+## On-demand command
+
+The same logic is available as a management command, useful right after a deploy or
+for manual intervention:
+
+```bash
+python manage.py reconcile_orphan_tasks            # recover now
+python manage.py reconcile_orphan_tasks --dry-run  # report orphans, change nothing
+python manage.py reconcile_orphan_tasks --grace-minutes 5 --max-attempts 3
+```
+
+## Configuration
+
+All settings have safe defaults; override via environment variables.
+
+| Env var | Default | Purpose |
+| --- | --- | --- |
+| `DJANGO_CELERY_WORKER_PREFETCH_MULTIPLIER` | `1` | Tasks reserved per worker process. |
+| `DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT` | `60` | Seconds the worker drains/re-queues on `SIGTERM` before force-kill. |
+| `DJANGO_CELERY_TASK_TIME_LIMIT` | `21600` (6h) | Hard limit for most tasks; connection checks are capped at 120s. |
+| `DJANGO_CELERY_TASK_SOFT_TIME_LIMIT` | hard - 600 | Soft limit; raises `SoftTimeLimitExceeded` for cleanup. |
+| `DJANGO_CELERY_LONG_TASK_TIME_LIMIT` | `172800` (48h) | Hard limit for scans and provider/tenant deletions, which can legitimately run for more than a day. |
+| `DJANGO_CELERY_LONG_TASK_SOFT_TIME_LIMIT` | long hard - 600 | Soft limit for the long-running tasks above. |
+| `DJANGO_TASK_RECOVERY_ENABLED` | `false` | Master switch for orphan-task recovery, disabled by default (opt-in); set to `true` to enable. When off, no orphan is detected, marked terminal, or re-enqueued (attack-paths stale cleanup still runs). |
+| `DJANGO_TASK_RECOVERY_SUMMARIES_ENABLED` | `true` | Auto re-enqueue orphaned scan summary/aggregation tasks. |
+| `DJANGO_TASK_RECOVERY_DELETIONS_ENABLED` | `true` | Auto re-enqueue orphaned provider/tenant deletion tasks. |
+
+Recovery is opt-in: with the master flag off (the default) the sweep does nothing.
+Once enabled, the per-group flags default to on, so every group recovers unless you
+turn one off; a task whose group flag is off is marked terminal instead of
+re-enqueued.
+
+Turning recovery off only disables this watchdog sweep; it does not change Celery's
+broker-level redelivery (`task_acks_late`/`task_reject_on_worker_lost`), which still
+re-delivers tasks that keep `acks_late=True` on worker loss, independently of this flag.
+
+`task_acks_late` and `task_reject_on_worker_lost` are enabled in `config/celery.py`.
+
+## Deployment requirement
+
+Two conditions must both hold for the soft shutdown to actually drain work:
+
+1. **The worker must receive `SIGTERM`.** The container entrypoint `exec`s the
+   Celery process so it runs as PID 1; otherwise `SIGTERM` from `docker stop`/ECS
+   hits the entrypoint shell, never reaches Celery, and the worker is hard-killed
+   (SIGKILL) at the grace deadline without draining. Custom entrypoints must
+   preserve the `exec`.
+2. **The orchestrator must give the worker enough time** before force-killing it.
+   Set the stop grace period to exceed `DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT`
+   plus a margin:
+   - **docker-compose:** `stop_grace_period` on the worker services (set to `120s`).
+   - **AWS ECS:** the worker container `stopTimeout` (configured in the deployment
+     repository).
+
+If either condition is missing, long tasks are still recovered by the watchdog,
+but they are cut mid-run on every deploy instead of draining.
diff --git a/api/pyproject.toml b/api/pyproject.toml
index 5d996878fa..41014d3382 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -41,7 +41,9 @@ dependencies = [
   "drf-spectacular==0.27.2",
   "drf-spectacular-jsonapi==0.5.1",
   "defusedxml==0.7.1",
-  "gunicorn==23.0.0",
+  "django-eventstream==5.3.3",
+  "gunicorn==26.0.0",
+  "uvloop==0.22.1",
   "lxml==6.1.0",
   "prowler @ git+https://github.com/prowler-cloud/prowler.git@master",
   "psycopg2-binary==2.9.9",
@@ -68,7 +70,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.31.0"
+version = "1.32.0"
 
 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
@@ -79,7 +81,7 @@ constraint-dependencies = [
   "aiobotocore==2.25.1",
   "aiofiles==24.1.0",
   "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.13.5",
+  "aiohttp==3.14.0",
   "aioitertools==0.13.0",
   "aiosignal==1.4.0",
   "alibabacloud-actiontrail20200706==2.4.1",
@@ -124,9 +126,8 @@ constraint-dependencies = [
   "astroid==3.2.4",
   "async-timeout==5.0.1",
   "attrs==25.4.0",
-  "authlib==1.6.9",
+  "authlib==1.6.12",
   "autopep8==2.3.2",
-  "awsipranges==0.3.3",
   "azure-cli-core==2.83.0",
   "azure-cli-telemetry==1.1.0",
   "azure-common==1.1.28",
@@ -209,6 +210,7 @@ constraint-dependencies = [
   "django-celery-results==2.6.0",
   "django-cors-headers==4.4.0",
   "django-environ==0.11.2",
+  "django-eventstream==5.3.3",
   "django-filter==24.3",
   "django-guid==3.5.0",
   "django-postgres-extra==2.0.9",
@@ -226,7 +228,7 @@ constraint-dependencies = [
   "drf-simple-apikey==2.2.1",
   "drf-spectacular==0.27.2",
   "drf-spectacular-jsonapi==0.5.1",
-  "dulwich==0.23.0",
+  "dulwich==1.2.5",
   "duo-client==5.5.0",
   "durationpy==0.10",
   "email-validator==2.2.0",
@@ -253,7 +255,7 @@ constraint-dependencies = [
   "grpc-google-iam-v1==0.14.3",
   "grpcio==1.76.0",
   "grpcio-status==1.76.0",
-  "gunicorn==23.0.0",
+  "gunicorn==26.0.0",
   "h11==0.16.0",
   "h2==4.3.0",
   "hpack==4.1.0",
@@ -262,8 +264,8 @@ constraint-dependencies = [
   "httpx==0.28.1",
   "humanfriendly==10.0",
   "hyperframe==6.1.0",
-  "iamdata==0.1.202602021",
-  "idna==3.11",
+  "iamdata==0.1.202605131",
+  "idna==3.15",
   "importlib-metadata==8.7.1",
   "inflection==0.5.1",
   "iniconfig==2.3.0",
@@ -315,7 +317,7 @@ constraint-dependencies = [
   "neo4j==6.1.0",
   "nest-asyncio==1.6.0",
   "nltk==3.9.4",
-  "numpy==2.0.2",
+  "numpy==2.2.6",
   "oauthlib==3.3.1",
   "oci==2.169.0",
   "openai==1.109.1",
@@ -344,7 +346,7 @@ constraint-dependencies = [
   "psutil==7.2.2",
   "psycopg2-binary==2.9.9",
   "py-deviceid==0.1.1",
-  "py-iam-expand==0.1.0",
+  "py-iam-expand==0.3.0",
   "py-ocsf-models==0.8.1",
   "pyasn1==0.6.3",
   "pyasn1-modules==0.4.2",
@@ -354,7 +356,7 @@ constraint-dependencies = [
   "pydantic-core==2.41.5",
   "pygithub==2.8.0",
   "pygments==2.20.0",
-  "pyjwt==2.12.1",
+  "pyjwt==2.13.0",
   "pylint==3.2.5",
   "pymsalruntime==0.18.1",
   "pynacl==1.6.2",
@@ -420,6 +422,7 @@ constraint-dependencies = [
   "uritemplate==4.2.0",
   "urllib3==2.7.0",
   "uuid6==2024.7.10",
+  "uvloop==0.22.1",
   "vine==5.1.0",
   "vulture==2.14",
   "wcwidth==0.5.3",
@@ -443,7 +446,17 @@ constraint-dependencies = [
 # The microsoft-kiota-http security bump to 1.9.9 (GHSA-7j59-v9qr-6fq9) requires
 # microsoft-kiota-abstractions>=1.9.9, which a constraint cannot satisfy against the
 # SDK's hard pin; override it to the patched, kiota-aligned version.
+#
+# prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
+# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
+# patches PYSEC-2026-179 (HMAC/JWK key-confusion); a constraint cannot satisfy these
+# against the SDK's hard pins, so override them to the patched versions until the SDK
+# bump propagates to the pinned master rev. pyjwt keeps the [crypto] extra because an
+# override replaces the whole requirement; bare pyjwt would drop it from the consumers
+# that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
 override-dependencies = [
   "okta==3.4.2",
-  "microsoft-kiota-abstractions==1.9.9"
+  "microsoft-kiota-abstractions==1.9.9",
+  "dulwich==1.2.5",
+  "pyjwt[crypto]==2.13.0"
 ]
diff --git a/api/src/backend/api/apps.py b/api/src/backend/api/apps.py
index 3209f75888..6c3a4ec2d9 100644
--- a/api/src/backend/api/apps.py
+++ b/api/src/backend/api/apps.py
@@ -1,12 +1,14 @@
 import logging
 import os
 import sys
+
 from pathlib import Path
 
+from django.apps import AppConfig
+from django.conf import settings
+
 from config.custom_logging import BackendLogger
 from config.env import env
-from django.apps import AppConfig
-from django.conf import settings
 
 logger = logging.getLogger(BackendLogger.API)
 
@@ -30,7 +32,6 @@ class ApiConfig(AppConfig):
     def ready(self):
         from api import schema_extensions  # noqa: F401
         from api import signals  # noqa: F401
-        from api.attack_paths import database as graph_database
 
         # Generate required cryptographic keys if not present, but only if:
         #   `"manage.py" not in sys.argv[0]`: If an external server (e.g., Gunicorn) is running the app
@@ -41,37 +42,8 @@ class ApiConfig(AppConfig):
         ):
             self._ensure_crypto_keys()
 
-        # Commands that don't need Neo4j
-        SKIP_NEO4J_DJANGO_COMMANDS = [
-            "makemigrations",
-            "migrate",
-            "pgpartition",
-            "check",
-            "help",
-            "showmigrations",
-            "check_and_fix_socialaccount_sites_migration",
-        ]
-
-        # Skip eager Neo4j init for tests, some Django commands, and Celery (prefork pool: driver must stay lazy, no post_fork hook)
-        if getattr(settings, "TESTING", False) or (
-            len(sys.argv) > 1
-            and (
-                (
-                    "manage.py" in sys.argv[0]
-                    and sys.argv[1] in SKIP_NEO4J_DJANGO_COMMANDS
-                )
-                or "celery" in sys.argv[0]
-            )
-        ):
-            logger.info(
-                "Skipping eager Neo4j init: tests, some Django commands, or Celery prefork pool (driver stays lazy)"
-            )
-
-        else:
-            graph_database.init_driver()
-
-        # Neo4j driver is initialized at API startup (see api.attack_paths.database)
-        # It remains lazy for Celery workers and selected Django commands
+        # Neo4j driver is created lazily on first use (see api.attack_paths.database).
+        # App init never contacts Neo4j, so a Neo4j outage cannot block API startup.
 
     def _ensure_crypto_keys(self):
         """
diff --git a/api/src/backend/api/attack_paths/database.py b/api/src/backend/api/attack_paths/database.py
index f5fddd0613..0e6cc083dc 100644
--- a/api/src/backend/api/attack_paths/database.py
+++ b/api/src/backend/api/attack_paths/database.py
@@ -1,22 +1,24 @@
 import atexit
 import logging
 import threading
+
 from contextlib import contextmanager
 from typing import Any, Iterator
 from uuid import UUID
 
 import neo4j
 import neo4j.exceptions
+
 from config.env import env
 from django.conf import settings
+
+from api.attack_paths.retryable_session import RetryableSession
 from tasks.jobs.attack_paths.config import (
     BATCH_SIZE,
     PROVIDER_RESOURCE_LABEL,
     get_provider_label,
 )
 
-from api.attack_paths.retryable_session import RetryableSession
-
 # Without this Celery goes crazy with Neo4j logging
 logging.getLogger("neo4j").setLevel(logging.ERROR)
 logging.getLogger("neo4j").propagate = False
@@ -28,6 +30,9 @@ READ_QUERY_TIMEOUT_SECONDS = env.int(
     "ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30
 )
 MAX_CUSTOM_QUERY_NODES = env.int("ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES", default=250)
+# Shorter than CONN_ACQUISITION_TIMEOUT — the driver requires acquisition to be
+# the longer of the two (it may include opening a new connection).
+CONNECTION_TIMEOUT = env.int("NEO4J_CONNECTION_TIMEOUT", default=5)
 CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
 READ_EXCEPTION_CODES = [
     "Neo.ClientError.Statement.AccessMode",
@@ -58,15 +63,24 @@ def init_driver() -> neo4j.Driver:
             uri = get_uri()
             config = settings.DATABASES["neo4j"]
 
-            _driver = neo4j.GraphDatabase.driver(
+            driver = neo4j.GraphDatabase.driver(
                 uri,
                 auth=(config["USER"], config["PASSWORD"]),
                 keep_alive=True,
                 max_connection_lifetime=7200,
+                connection_timeout=CONNECTION_TIMEOUT,
                 connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
                 max_connection_pool_size=50,
             )
-            _driver.verify_connectivity()
+            # Publish the singleton only after connectivity is verified so a
+            # failed probe does not leave an unverified driver behind. Close the
+            # driver on failure so a repeatedly-probed outage cannot leak pools.
+            try:
+                driver.verify_connectivity()
+            except Exception:
+                driver.close()
+                raise
+            _driver = driver
 
             # Register cleanup handler (only runs once since we're inside the _driver is None block)
             atexit.register(close_driver)
@@ -161,7 +175,8 @@ def drop_subgraph(database: str, provider_id: str) -> int:
     """
     Delete all nodes for a provider from the tenant database.
 
-    Uses batched deletion to avoid memory issues with large graphs.
+    Deletes relationships then nodes in batches (not `DETACH DELETE`) so a dense
+    provider's graph cannot exceed Neo4j's transaction memory limit.
     Silently returns 0 if the database doesn't exist.
     """
     provider_label = get_provider_label(provider_id)
@@ -169,13 +184,28 @@ def drop_subgraph(database: str, provider_id: str) -> int:
 
     try:
         with get_session(database) as session:
+            # Phase 1: delete relationships incident to provider nodes in batches.
+            deleted_count = 1
+            while deleted_count > 0:
+                result = session.run(
+                    f"""
+                    MATCH (:`{provider_label}`)-[r]-()
+                    WITH DISTINCT r LIMIT $batch_size
+                    DELETE r
+                    RETURN COUNT(r) AS deleted_rels_count
+                    """,
+                    {"batch_size": BATCH_SIZE},
+                )
+                deleted_count = result.single().get("deleted_rels_count", 0)
+
+            # Phase 2: delete the now relationship-free nodes in batches.
             deleted_count = 1
             while deleted_count > 0:
                 result = session.run(
                     f"""
                     MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`)
                     WITH n LIMIT $batch_size
-                    DETACH DELETE n
+                    DELETE n
                     RETURN COUNT(n) AS deleted_nodes_count
                     """,
                     {"batch_size": BATCH_SIZE},
diff --git a/api/src/backend/api/authentication.py b/api/src/backend/api/authentication.py
index 499e290bb7..04740ac219 100644
--- a/api/src/backend/api/authentication.py
+++ b/api/src/backend/api/authentication.py
@@ -93,3 +93,30 @@ class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):
 
         # Default fallback
         return self.jwt_auth.authenticate(request)
+
+
+class SSEAuthentication(CombinedJWTOrAPIKeyAuthentication):
+    """JWT/API-Key auth that also accepts `?access_token=<jwt>`.
+
+    Browser `EventSource` is the only widely available SSE client API
+    and it cannot set the `Authorization` header (its constructor takes
+    only a URL and `withCredentials`). To keep browser SSE clients on
+    the same auth stack as the rest of the API, SSE endpoints additionally
+    accept a JWT via the `?access_token=<jwt>` query parameter — the
+    standard parameter name defined in RFC 6750 Section 2.3 for bearer tokens.
+    """
+
+    def authenticate(self, request: Request):
+        auth_header = request.headers.get("Authorization", "")
+        if auth_header:
+            return super().authenticate(request)
+
+        raw_token = request.query_params.get("access_token")
+        if not raw_token:
+            # No header and no query token — let the default path raise
+            # the canonical AuthenticationFailed via the parent class.
+            return super().authenticate(request)
+
+        validated_token = self.jwt_auth.get_validated_token(raw_token)
+        user = self.jwt_auth.get_user(validated_token)
+        return user, validated_token
diff --git a/api/src/backend/api/compliance.py b/api/src/backend/api/compliance.py
index 25b8fb6735..77c45cbffd 100644
--- a/api/src/backend/api/compliance.py
+++ b/api/src/backend/api/compliance.py
@@ -1,11 +1,26 @@
+import logging
+import threading
 from collections.abc import Iterable, Mapping
 
 from api.models import Provider
-from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.check.compliance_models import (
+    get_bulk_compliance_frameworks_universal,
+)
 from prowler.lib.check.models import CheckMetadata
 
+logger = logging.getLogger(__name__)
+
 AVAILABLE_COMPLIANCE_FRAMEWORKS = {}
 
+# Per-process readiness flags for the background compliance warm-up.
+# `STARTED` is set as soon as warming begins (only happens under Gunicorn via
+# the post_fork hook); `WARMED` is set when it finishes. The attributes
+# endpoint checks both: it returns 503 only while warming is in progress.
+# Under `runserver` warming never runs, so `STARTED` stays clear and the
+# endpoint keeps lazy-loading as before.
+COMPLIANCE_WARMING_STARTED = threading.Event()
+COMPLIANCE_WARMED = threading.Event()
+
 
 class LazyComplianceTemplate(Mapping):
     """Lazy-load compliance templates per provider on first access."""
@@ -94,25 +109,22 @@ PROWLER_CHECKS = LazyChecksMapping()
 
 
 def get_compliance_frameworks(provider_type: Provider.ProviderChoices) -> list[str]:
-    """List compliance frameworks the API can load for `provider_type`.
+    """List compliance framework identifiers available for `provider_type`.
 
-    The list is sourced from `Compliance.get_bulk` so that the names
-    returned here are guaranteed to be loadable by the bulk loader. This
-    prevents downstream key mismatches (e.g. CSV report generation iterating
-    framework names and looking them up in the bulk dict).
+    Includes both per-provider frameworks and universal top-level frameworks
+    (e.g. ``dora_2022_2554``, ``csa_ccm_4.0``).
 
     Args:
-        provider_type (Provider.ProviderChoices): The cloud provider type for which to retrieve
-            available compliance frameworks (e.g., "aws", "azure", "gcp", "m365").
+        provider_type (Provider.ProviderChoices): The cloud provider type
+            (e.g., "aws", "azure", "gcp", "m365").
 
     Returns:
-        list[str]: A list of framework identifiers (e.g., "cis_1.4_aws", "mitre_attack_azure") available
-        for the given provider.
+        list[str]: Framework identifiers (e.g., "cis_1.4_aws", "dora_2022_2554").
     """
     global AVAILABLE_COMPLIANCE_FRAMEWORKS
     if provider_type not in AVAILABLE_COMPLIANCE_FRAMEWORKS:
         AVAILABLE_COMPLIANCE_FRAMEWORKS[provider_type] = list(
-            Compliance.get_bulk(provider_type).keys()
+            get_bulk_compliance_frameworks_universal(provider_type).keys()
         )
 
     return AVAILABLE_COMPLIANCE_FRAMEWORKS[provider_type]
@@ -139,18 +151,14 @@ def get_prowler_provider_compliance(provider_type: Provider.ProviderChoices) ->
     """
     Retrieve the Prowler compliance data for a specified provider type.
 
-    This function fetches the compliance frameworks and their associated
-    requirements for the given cloud provider.
-
     Args:
         provider_type (Provider.ProviderChoices): The provider type
             (e.g., 'aws', 'azure') for which to retrieve compliance data.
 
     Returns:
-        dict: A dictionary mapping compliance framework names to their respective
-            Compliance objects for the specified provider.
+        dict: Mapping of framework name to `ComplianceFramework` for the provider.
     """
-    return Compliance.get_bulk(provider_type)
+    return get_bulk_compliance_frameworks_universal(provider_type)
 
 
 def _load_provider_assets(provider_type: Provider.ProviderChoices) -> tuple[dict, dict]:
@@ -179,6 +187,56 @@ def _ensure_provider_loaded(provider_type: Provider.ProviderChoices) -> None:
         PROWLER_CHECKS._cache[provider_type] = checks
 
 
+def warm_compliance_caches(
+    provider_types: Iterable[str] | None = None,
+) -> list[str]:
+    """
+    Eagerly populate the per-process compliance caches at server startup.
+
+    Moves the cold-cache catalog load off the request thread so the first
+    request does not trip the Gunicorn worker timeout. Reads only on-disk
+    metadata (no database access). Each provider is warmed in isolation;
+    failures are logged and fall back to lazy loading.
+
+    Args:
+        provider_types (Iterable[str] | None): Subset to warm. Defaults to all.
+
+    Returns:
+        list[str]: Provider types that could not be warmed.
+    """
+    if provider_types is None:
+        provider_types = Provider.ProviderChoices.values
+    provider_types = list(provider_types)
+
+    COMPLIANCE_WARMING_STARTED.set()
+    logger.info("Compliance cache warm-up started for providers: %s", provider_types)
+
+    failed = []
+    for provider_type in provider_types:
+        try:
+            get_compliance_frameworks(provider_type)
+            _ensure_provider_loaded(provider_type)
+        # Prowler check loading may sys.exit (SystemExit, not Exception).
+        except (Exception, SystemExit):
+            logger.warning(
+                "Failed to warm compliance caches for provider '%s'; "
+                "loading lazily on first request",
+                provider_type,
+                exc_info=True,
+            )
+            failed.append(provider_type)
+
+    # Mark as warmed even when some providers failed: a failed provider falls
+    # back to a single-provider lazy load, which stays under the worker timeout.
+    COMPLIANCE_WARMED.set()
+    logger.info(
+        "Compliance cache warm-up finished (providers warmed: %d, failed: %s)",
+        len(provider_types) - len(failed),
+        failed,
+    )
+    return failed
+
+
 def load_prowler_checks(
     prowler_compliance, provider_types: Iterable[str] | None = None
 ):
@@ -209,8 +267,8 @@ def load_prowler_checks(
         for compliance_name, compliance_data in prowler_compliance.get(
             provider_type, {}
         ).items():
-            for requirement in compliance_data.Requirements:
-                for check in requirement.Checks:
+            for requirement in compliance_data.requirements:
+                for check in requirement.checks.get(provider_type, []):
                     try:
                         checks[provider_type][check].add(compliance_name)
                     except KeyError:
@@ -290,24 +348,40 @@ def generate_compliance_overview_template(
             requirements_status = {"passed": 0, "failed": 0, "manual": 0}
             total_requirements = 0
 
-            for requirement in compliance_data.Requirements:
+            for requirement in compliance_data.requirements:
                 total_requirements += 1
-                total_checks = len(requirement.Checks)
-                checks_dict = {check: None for check in requirement.Checks}
+                provider_check_list = list(requirement.checks.get(provider_type, []))
+                total_checks = len(provider_check_list)
+                checks_dict = {check: None for check in provider_check_list}
 
                 req_status_val = "MANUAL" if total_checks == 0 else "PASS"
 
+                # MITRE attrs are wrapped under `_raw_attributes` by the
+                # universal adapter — unwrap so consumers see the flat list.
+                requirement_attributes = requirement.attributes
+                if (
+                    isinstance(requirement_attributes, dict)
+                    and "_raw_attributes" in requirement_attributes
+                ):
+                    attributes_payload = list(requirement_attributes["_raw_attributes"])
+                elif isinstance(requirement_attributes, dict):
+                    attributes_payload = (
+                        [dict(requirement_attributes)] if requirement_attributes else []
+                    )
+                else:
+                    attributes_payload = [
+                        dict(attribute) for attribute in requirement_attributes
+                    ]
+
                 # Build requirement dictionary
                 requirement_dict = {
-                    "name": requirement.Name or requirement.Id,
-                    "description": requirement.Description,
-                    "tactics": getattr(requirement, "Tactics", []),
-                    "subtechniques": getattr(requirement, "SubTechniques", []),
-                    "platforms": getattr(requirement, "Platforms", []),
-                    "technique_url": getattr(requirement, "TechniqueURL", ""),
-                    "attributes": [
-                        dict(attribute) for attribute in requirement.Attributes
-                    ],
+                    "name": requirement.name or requirement.id,
+                    "description": requirement.description,
+                    "tactics": requirement.tactics or [],
+                    "subtechniques": requirement.sub_techniques or [],
+                    "platforms": requirement.platforms or [],
+                    "technique_url": requirement.technique_url or "",
+                    "attributes": attributes_payload,
                     "checks": checks_dict,
                     "checks_status": {
                         "pass": 0,
@@ -325,15 +399,15 @@ def generate_compliance_overview_template(
                     requirements_status["passed"] += 1
 
                 # Add requirement to compliance requirements
-                compliance_requirements[requirement.Id] = requirement_dict
+                compliance_requirements[requirement.id] = requirement_dict
 
             # Build compliance dictionary
             compliance_dict = {
-                "framework": compliance_data.Framework,
-                "name": compliance_data.Name,
-                "version": compliance_data.Version,
+                "framework": compliance_data.framework,
+                "name": compliance_data.name,
+                "version": compliance_data.version,
                 "provider": provider_type,
-                "description": compliance_data.Description,
+                "description": compliance_data.description,
                 "requirements": compliance_requirements,
                 "requirements_status": requirements_status,
                 "total_requirements": total_requirements,
diff --git a/api/src/backend/api/exceptions.py b/api/src/backend/api/exceptions.py
index 78f8c64c7d..4f6f26c2ea 100644
--- a/api/src/backend/api/exceptions.py
+++ b/api/src/backend/api/exceptions.py
@@ -187,6 +187,32 @@ class UpstreamServiceUnavailableError(APIException):
         )
 
 
+class ComplianceWarmingError(APIException):
+    """Compliance catalog is still warming (503 Service Unavailable).
+
+    Returned by the compliance attributes endpoint while the per-process
+    catalog warm-up is in progress, so the request thread never triggers the
+    slow cold load that would trip the Gunicorn worker timeout.
+    """
+
+    status_code = status.HTTP_503_SERVICE_UNAVAILABLE
+    default_detail = (
+        "Compliance data is still loading. Please try again in a few seconds."
+    )
+    default_code = "compliance_warming"
+
+    def __init__(self, detail=None):
+        super().__init__(
+            detail=[
+                {
+                    "detail": detail or self.default_detail,
+                    "status": str(self.status_code),
+                    "code": self.default_code,
+                }
+            ]
+        )
+
+
 class UpstreamInternalError(APIException):
     """Unexpected error communicating with provider (500 Internal Server Error).
 
diff --git a/api/src/backend/api/filters.py b/api/src/backend/api/filters.py
index c787d714b1..195982011d 100644
--- a/api/src/backend/api/filters.py
+++ b/api/src/backend/api/filters.py
@@ -102,7 +102,7 @@ class BaseProviderFilter(FilterSet):
     """
     Abstract base filter for models with direct FK to Provider.
 
-    Provides standard provider_id and provider_type filters.
+    Provides standard provider_id, provider_type, and provider_groups filters.
     Subclasses must define Meta.model.
     """
 
@@ -116,6 +116,16 @@ class BaseProviderFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
 
     class Meta:
         abstract = True
@@ -126,7 +136,7 @@ class BaseScanProviderFilter(FilterSet):
     """
     Abstract base filter for models with FK to Scan (and Scan has FK to Provider).
 
-    Provides standard provider_id and provider_type filters via scan relationship.
+    Provides standard provider_id, provider_type, and provider_groups filters via scan relationship.
     Subclasses must define Meta.model.
     """
 
@@ -140,6 +150,16 @@ class BaseScanProviderFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
 
     class Meta:
         abstract = True
@@ -160,6 +180,16 @@ class CommonFindingFilters(FilterSet):
     provider_type__in = ChoiceInFilter(
         choices=Provider.ProviderChoices.choices, field_name="scan__provider__provider"
     )
+    provider_groups = UUIDFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     provider_uid = CharFilter(field_name="scan__provider__uid", lookup_expr="exact")
     provider_uid__in = CharInFilter(field_name="scan__provider__uid", lookup_expr="in")
     provider_uid__icontains = CharFilter(
@@ -370,6 +400,12 @@ class ProviderFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="provider_groups__id", lookup_expr="exact", distinct=True
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider_groups__id", lookup_expr="in", distinct=True
+    )
 
     class Meta:
         model = Provider
@@ -395,6 +431,16 @@ class ProviderRelationshipFilterSet(FilterSet):
     provider_type__in = ChoiceInFilter(
         choices=Provider.ProviderChoices.choices, field_name="provider__provider"
     )
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     provider_uid = CharFilter(field_name="provider__uid", lookup_expr="exact")
     provider_uid__in = CharInFilter(field_name="provider__uid", lookup_expr="in")
     provider_uid__icontains = CharFilter(
@@ -1001,6 +1047,16 @@ class FindingGroupSummaryFilter(_CheckTitleToCheckIdMixin, FilterSet):
         field_name="provider__provider", choices=Provider.ProviderChoices.choices
     )
     provider_type__in = CharInFilter(field_name="provider__provider", lookup_expr="in")
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
 
     class Meta:
         model = FindingGroupDailySummary
@@ -1101,6 +1157,16 @@ class LatestFindingGroupSummaryFilter(_CheckTitleToCheckIdMixin, FilterSet):
         field_name="provider__provider", choices=Provider.ProviderChoices.choices
     )
     provider_type__in = CharInFilter(field_name="provider__provider", lookup_expr="in")
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
 
     class Meta:
         model = FindingGroupDailySummary
@@ -1280,12 +1346,19 @@ class RoleFilter(FilterSet):
         }
 
 
-class ComplianceOverviewFilter(FilterSet):
+class ComplianceOverviewFilter(BaseScanProviderFilter):
+    """
+    Keep provider filters in the schema while runtime filtering resolves scans first.
+
+    Compliance overview provider filters are applied to the latest completed scans
+    in the viewset, then this filterset handles the remaining compliance fields.
+    """
+
     inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date")
-    scan_id = UUIDFilter(field_name="scan_id", required=True)
+    scan_id = UUIDFilter(field_name="scan_id")
     region = CharFilter(field_name="region")
 
-    class Meta:
+    class Meta(BaseScanProviderFilter.Meta):
         model = ComplianceRequirementOverview
         fields = {
             "inserted_at": ["date", "gte", "lte"],
@@ -1306,6 +1379,16 @@ class ScanSummaryFilter(FilterSet):
     provider_type__in = ChoiceInFilter(
         field_name="scan__provider__provider", choices=Provider.ProviderChoices.choices
     )
+    provider_groups = UUIDFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     region = CharFilter(field_name="region")
 
     class Meta:
@@ -1329,6 +1412,16 @@ class DailySeveritySummaryFilter(FilterSet):
     provider_type__in = ChoiceInFilter(
         field_name="provider__provider", choices=Provider.ProviderChoices.choices
     )
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     date_from = DateFilter(method="filter_noop")
     date_to = DateFilter(method="filter_noop")
 
@@ -1585,6 +1678,16 @@ class ThreatScoreSnapshotFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     compliance_id = CharFilter(field_name="compliance_id", lookup_expr="exact")
     compliance_id__in = CharInFilter(field_name="compliance_id", lookup_expr="in")
 
@@ -1628,6 +1731,16 @@ class ResourceGroupOverviewFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     resource_group = CharFilter(field_name="resource_group", lookup_expr="exact")
     resource_group__in = CharInFilter(field_name="resource_group", lookup_expr="in")
 
diff --git a/api/src/backend/api/management/commands/reconcile_orphan_tasks.py b/api/src/backend/api/management/commands/reconcile_orphan_tasks.py
new file mode 100644
index 0000000000..8ba8f5b342
--- /dev/null
+++ b/api/src/backend/api/management/commands/reconcile_orphan_tasks.py
@@ -0,0 +1,59 @@
+from django.core.management.base import BaseCommand
+
+from tasks.jobs.orphan_recovery import reconcile_orphans
+
+
+class Command(BaseCommand):
+    help = (
+        "Recover orphaned allowlisted Celery tasks whose worker is gone and mark "
+        "other stale task results terminal. Single-flight via a Postgres advisory lock."
+    )
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--grace-minutes",
+            type=int,
+            default=2,
+            help="Skip tasks started within this window (worker may still register).",
+        )
+        parser.add_argument(
+            "--max-attempts",
+            type=int,
+            default=3,
+            help="Give up re-running a task after this many recovery attempts; it is then left terminal instead of re-enqueued.",
+        )
+        parser.add_argument(
+            "--dry-run",
+            action="store_true",
+            help="Detect and report orphans without revoking or re-enqueuing.",
+        )
+
+    def handle(self, *args, **options):
+        result = reconcile_orphans(
+            grace_minutes=options["grace_minutes"],
+            max_attempts=options["max_attempts"],
+            dry_run=options["dry_run"],
+        )
+
+        if not result.get("acquired"):
+            self.stdout.write("Reconcile skipped: another run holds the lock.")
+            return
+
+        if result.get("enabled") is False:
+            message = (
+                "Task recovery is disabled (DJANGO_TASK_RECOVERY_ENABLED is off); "
+                "no orphans were recovered."
+            )
+            if result.get("attack_paths") is not None:
+                message += " Attack-paths stale cleanup still ran."
+            self.stdout.write(message)
+            return
+
+        self.stdout.write(
+            self.style.SUCCESS(
+                "Orphan reconcile complete: "
+                f"recovered={len(result.get('recovered', []))} "
+                f"failed={len(result.get('failed', []))} "
+                f"skipped(in-flight)={len(result.get('skipped', []))}"
+            )
+        )
diff --git a/api/src/backend/api/middleware.py b/api/src/backend/api/middleware.py
index 63f2fc630b..2b0a2340c4 100644
--- a/api/src/backend/api/middleware.py
+++ b/api/src/backend/api/middleware.py
@@ -1,9 +1,35 @@
 import logging
 import time
 
+from django.core.handlers.asgi import ASGIRequest
+from django.db import connections
+
 from config.custom_logging import BackendLogger
 
 
+class CloseDBConnectionsMiddleware:
+    """
+    Close request-scoped DB connections at the end of each ASGI request.
+
+    Under the ASGI worker, connections opened by sync views are not released
+    by Django's normal request-boundary cleanup, so they accumulate idle until
+    Postgres runs out of slots. Only ASGI requests are handled; the sync WSGI
+    test client manages its own connections and must be left alone.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        try:
+            return self.get_response(request)
+        finally:
+            if isinstance(request, ASGIRequest):
+                for conn in connections.all(initialized_only=True):
+                    if not conn.in_atomic_block:
+                        conn.close_if_unusable_or_obsolete()
+
+
 def extract_auth_info(request) -> dict:
     if getattr(request, "auth", None) is not None:
         tenant_id = request.auth.get("tenant_id", "N/A")
diff --git a/api/src/backend/api/migrations/0095_reconcile_orphan_tasks_periodic_task.py b/api/src/backend/api/migrations/0095_reconcile_orphan_tasks_periodic_task.py
new file mode 100644
index 0000000000..9d67404258
--- /dev/null
+++ b/api/src/backend/api/migrations/0095_reconcile_orphan_tasks_periodic_task.py
@@ -0,0 +1,49 @@
+from django.db import migrations
+
+
+TASK_NAME = "reconcile-orphan-tasks"
+INTERVAL_MINUTES = 2
+
+
+def create_periodic_task(apps, schema_editor):
+    IntervalSchedule = apps.get_model("django_celery_beat", "IntervalSchedule")
+    PeriodicTask = apps.get_model("django_celery_beat", "PeriodicTask")
+
+    schedule, _ = IntervalSchedule.objects.get_or_create(
+        every=INTERVAL_MINUTES,
+        period="minutes",
+    )
+
+    PeriodicTask.objects.update_or_create(
+        name=TASK_NAME,
+        defaults={
+            "task": TASK_NAME,
+            "interval": schedule,
+            "enabled": True,
+        },
+    )
+
+
+def delete_periodic_task(apps, schema_editor):
+    IntervalSchedule = apps.get_model("django_celery_beat", "IntervalSchedule")
+    PeriodicTask = apps.get_model("django_celery_beat", "PeriodicTask")
+
+    PeriodicTask.objects.filter(name=TASK_NAME).delete()
+
+    # Clean up the schedule if no other task references it
+    IntervalSchedule.objects.filter(
+        every=INTERVAL_MINUTES,
+        period="minutes",
+        periodictask__isnull=True,
+    ).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("api", "0093_okta_provider"),
+        ("django_celery_beat", "0019_alter_periodictasks_options"),
+    ]
+
+    operations = [
+        migrations.RunPython(create_periodic_task, delete_periodic_task),
+    ]
diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml
index 5efefc0790..18566c5c71 100644
--- a/api/src/backend/api/specs/v1.yaml
+++ b/api/src/backend/api/specs/v1.yaml
@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.31.0
+  version: 1.32.0
   description: |-
     Prowler API specification.
 
@@ -13137,8 +13137,59 @@ paths:
       responses:
         '200':
           description: CSV file containing the compliance report
+        '202':
+          description: The task is in progress
+        '403':
+          description: There is a problem with credentials
         '404':
-          description: Compliance report not found
+          description: Compliance report not found, or the scan has no reports yet
+  /api/v1/scans/{id}/compliance/{name}/ocsf:
+    get:
+      operationId: scans_compliance_ocsf_retrieve
+      description: Download a specific compliance report as an OCSF JSON file. Only
+        universal frameworks that declare an output configuration produce this artifact
+        (currently 'dora' and 'csa_ccm_4.0'); any other framework returns 404.
+      summary: Retrieve compliance report as OCSF JSON
+      parameters:
+      - in: query
+        name: fields[scan-reports]
+        schema:
+          type: array
+          items:
+            type: string
+            enum:
+            - id
+            - name
+        description: endpoint return only specific fields in the response on a per-type
+          basis by including a fields[TYPE] query parameter.
+        explode: false
+      - in: path
+        name: id
+        schema:
+          type: string
+          format: uuid
+        description: A UUID string identifying this scan.
+        required: true
+      - in: path
+        name: name
+        schema:
+          type: string
+        description: The compliance report name, like 'dora'
+        required: true
+      tags:
+      - Scan
+      security:
+      - JWT or API Key: []
+      responses:
+        '200':
+          description: OCSF JSON file containing the compliance report
+        '202':
+          description: The task is in progress
+        '403':
+          description: There is a problem with credentials
+        '404':
+          description: Compliance report not found, the framework does not provide
+            an OCSF export, or the scan has no reports yet
   /api/v1/scans/{id}/csa:
     get:
       operationId: scans_csa_retrieve
diff --git a/api/src/backend/api/sse/__init__.py b/api/src/backend/api/sse/__init__.py
new file mode 100644
index 0000000000..244bd3c9ad
--- /dev/null
+++ b/api/src/backend/api/sse/__init__.py
@@ -0,0 +1,13 @@
+"""Platform Server-Sent Events (SSE) infrastructure.
+
+Wires `django-eventstream` into the API: a base viewset features
+subclass to expose an SSE endpoint
+(:class:`api.sse.base_views.BaseSSEViewSet`), the channel manager that
+enforces the tenant gate (:class:`api.sse.channelmanager.SSEChannelManager`),
+and the channel-name helpers (:func:`api.sse.utils.make_channel_name`).
+"""
+
+from api.sse.utils import make_channel_name
+from api.sse.base_views import BaseSSEViewSet
+
+__all__ = ["BaseSSEViewSet", "make_channel_name"]
diff --git a/api/src/backend/api/sse/base_views.py b/api/src/backend/api/sse/base_views.py
new file mode 100644
index 0000000000..c4a24540ee
--- /dev/null
+++ b/api/src/backend/api/sse/base_views.py
@@ -0,0 +1,46 @@
+"""Base view class for SSE endpoints."""
+
+from api.authentication import SSEAuthentication
+from api.base_views import BaseRLSViewSet
+from django_eventstream.renderers import SSEEventRenderer
+from django_eventstream.views import events
+
+
+class BaseSSEViewSet(BaseRLSViewSet):
+    """Base class for platform SSE endpoints.
+
+    Subclasses override method `get_channels` to declare the channel
+    names the connection should subscribe to — the same way a regular
+    DRF viewset overrides method `get_queryset`. The channel manager
+    reads the result from `request.sse_channels`; there is no other
+    coupling between platform and feature.
+    """
+
+    authentication_classes = [SSEAuthentication]
+    # Pin the SSE renderer so content negotiation accepts the browser's
+    # `Accept: text/event-stream`.
+    renderer_classes = [SSEEventRenderer]
+
+    def get_channels(self) -> set[str]:
+        """Return the channels this connection subscribes to.
+
+        Implementations MUST raise the relevant DRF exceptions
+        (`NotAuthenticated`, `PermissionDenied`, `NotFound`) when
+        authorization fails. Returning an empty set would surface as
+        django-eventstream's "No channels specified" which masks the
+        real cause.
+        """
+        raise NotImplementedError
+
+    def get_queryset(self):
+        # Most SSE viewsets only need `get_channels` and never call
+        # `get_queryset` (the SSE list path bypasses serialization
+        # entirely). Subclasses that perform their own queryset lookup
+        # inside `get_channels` should override; the default raises
+        # the same error a missing override on a ModelViewSet would.
+        raise NotImplementedError
+
+    def list(self, request, *_args, **kwargs):
+        """Resolve channels under the regular DRF stack and stream."""
+        request.sse_channels = self.get_channels()
+        return events(request, **kwargs)
diff --git a/api/src/backend/api/sse/channelmanager.py b/api/src/backend/api/sse/channelmanager.py
new file mode 100644
index 0000000000..72b2c18367
--- /dev/null
+++ b/api/src/backend/api/sse/channelmanager.py
@@ -0,0 +1,75 @@
+"""Channel manager that wires `django-eventstream` to platform SSE views."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+from uuid import UUID
+
+from django_eventstream.channelmanager import DefaultChannelManager
+from rest_framework.request import Request
+
+from api.sse.utils import tenant_id_from_channel
+
+if TYPE_CHECKING:
+    from api.models import User
+
+
+class SSEChannelManager(DefaultChannelManager):
+    """Connect `django-eventstream` to the platform's SSE viewsets."""
+
+    def get_channels_for_request(self, request: Request, view_kwargs: dict) -> set[str]:  # noqa: vulture
+        """Return the request's channels scoped to the active JWT tenant.
+
+        Args:
+            request: The authenticated DRF request, carrying `tenant_id`
+                (set by `BaseRLSViewSet`) and `sse_channels` (set by
+                `BaseSSEViewSet.list`).
+            view_kwargs: URL keyword arguments from django-eventstream;
+                unused because channels are resolved on the request.
+
+        Returns:
+            The subset of `request.sse_channels` whose embedded tenant
+            matches the active request tenant.
+        """
+        try:
+            request_tenant_id = UUID(str(getattr(request, "tenant_id", None)))
+        except (TypeError, ValueError):
+            return set()
+        return {
+            channel
+            for channel in getattr(request, "sse_channels", set())
+            if tenant_id_from_channel(channel) == request_tenant_id
+        }
+
+    def can_read_channel(self, user: "User | None", channel: str) -> bool:
+        """Re-verify tenant membership once the stream is established.
+
+        Args:
+            user: The connection's authenticated `User`, or `None` for an
+                anonymous connection — django-eventstream passes `None`
+                rather than an `AnonymousUser`.
+            channel: The channel name being read, in the canonical
+                `<prefix>:<tenant_id>:<resource_id>` format.
+
+        Returns:
+            `True` only when `user` is authenticated and a member of the
+            tenant embedded in `channel`; `False` otherwise, including for
+            anonymous connections and malformed channel names.
+        """
+        if user is None or not user.is_authenticated:
+            return False
+        tenant_id = tenant_id_from_channel(channel)
+        if tenant_id is None:
+            return False
+        return user.is_member_of_tenant(tenant_id)
+
+    def is_channel_reliable(self, channel: str) -> bool:
+        """Report whether the channel keeps a server-side replay buffer.
+
+        Args:
+            channel: The channel name being queried.
+
+        Returns:
+            `False`, unconditionally. Replay storage is not configured
+        """
+        return False
diff --git a/api/src/backend/api/sse/utils.py b/api/src/backend/api/sse/utils.py
new file mode 100644
index 0000000000..a30ed26311
--- /dev/null
+++ b/api/src/backend/api/sse/utils.py
@@ -0,0 +1,51 @@
+"""Channel-name convention shared by SSE publishers, consumers, and the
+channel manager. The format is `<prefix>:<tenant_id>:<resource_id>`.
+"""
+
+from __future__ import annotations
+
+import uuid
+
+CHANNEL_SEPARATOR = ":"
+
+
+def make_channel_name(
+    prefix: str,
+    tenant_id: str | uuid.UUID,
+    resource_id: str | uuid.UUID,
+) -> str:
+    """Build the canonical channel name for a resource.
+
+    Args:
+        prefix: Feature-owned prefix (e.g. `"lighthouse-session"`).
+        tenant_id: Tenant the resource belongs to.
+        resource_id: Resource identifier within the tenant.
+
+    Raises:
+        ValueError: If any segment contains `CHANNEL_SEPARATOR`, which
+            would break the `<prefix>:<tenant_id>:<resource_id>` contract
+            and let a crafted name smuggle extra segments past the parser.
+    """
+    segments = (str(prefix), str(tenant_id), str(resource_id))
+    if any(CHANNEL_SEPARATOR in segment for segment in segments):
+        raise ValueError(
+            f"Channel segments must not contain '{CHANNEL_SEPARATOR}': {segments!r}"
+        )
+    return CHANNEL_SEPARATOR.join(segments)
+
+
+def tenant_id_from_channel(channel: str) -> uuid.UUID | None:
+    """Return the tenant UUID embedded in *channel*, or `None` if
+    *channel* does not follow the platform convention.
+
+    A `None` result MUST be treated by callers as "not authorized" or
+    a malformed channel cannot be safely read.
+    """
+    segments = channel.split(CHANNEL_SEPARATOR)
+    if len(segments) != 3:
+        # Reject non-canonical names
+        return None
+    try:
+        return uuid.UUID(segments[1])
+    except ValueError:
+        return None
diff --git a/api/src/backend/api/tests/test_apps.py b/api/src/backend/api/tests/test_apps.py
index 5889b4e2cb..2f5b55a6e2 100644
--- a/api/src/backend/api/tests/test_apps.py
+++ b/api/src/backend/api/tests/test_apps.py
@@ -182,23 +182,19 @@ def _make_app():
     return ApiConfig("api", api)
 
 
-def test_ready_initializes_driver_for_api_process(monkeypatch):
+@pytest.mark.parametrize(
+    "argv",
+    [
+        ["gunicorn"],
+        ["celery", "-A", "api"],
+        ["manage.py", "migrate"],
+    ],
+    ids=["api", "celery", "manage_py"],
+)
+def test_ready_never_eagerly_initializes_neo4j_driver(monkeypatch, argv):
+    """ready() must never contact Neo4j; the driver is created lazily on first use."""
     config = _make_app()
-    _set_argv(monkeypatch, ["gunicorn"])
-    _set_testing(monkeypatch, False)
-
-    with (
-        patch.object(ApiConfig, "_ensure_crypto_keys", return_value=None),
-        patch("api.attack_paths.database.init_driver") as init_driver,
-    ):
-        config.ready()
-
-    init_driver.assert_called_once()
-
-
-def test_ready_skips_driver_for_celery(monkeypatch):
-    config = _make_app()
-    _set_argv(monkeypatch, ["celery", "-A", "api"])
+    _set_argv(monkeypatch, argv)
     _set_testing(monkeypatch, False)
 
     with (
@@ -208,31 +204,3 @@ def test_ready_skips_driver_for_celery(monkeypatch):
         config.ready()
 
     init_driver.assert_not_called()
-
-
-def test_ready_skips_driver_for_manage_py_skip_command(monkeypatch):
-    config = _make_app()
-    _set_argv(monkeypatch, ["manage.py", "migrate"])
-    _set_testing(monkeypatch, False)
-
-    with (
-        patch.object(ApiConfig, "_ensure_crypto_keys", return_value=None),
-        patch("api.attack_paths.database.init_driver") as init_driver,
-    ):
-        config.ready()
-
-    init_driver.assert_not_called()
-
-
-def test_ready_skips_driver_when_testing(monkeypatch):
-    config = _make_app()
-    _set_argv(monkeypatch, ["gunicorn"])
-    _set_testing(monkeypatch, True)
-
-    with (
-        patch.object(ApiConfig, "_ensure_crypto_keys", return_value=None),
-        patch("api.attack_paths.database.init_driver") as init_driver,
-    ):
-        config.ready()
-
-    init_driver.assert_not_called()
diff --git a/api/src/backend/api/tests/test_attack_paths_database.py b/api/src/backend/api/tests/test_attack_paths_database.py
index 8828d23911..7ca8a4accb 100644
--- a/api/src/backend/api/tests/test_attack_paths_database.py
+++ b/api/src/backend/api/tests/test_attack_paths_database.py
@@ -1,15 +1,16 @@
 """
 Tests for Neo4j database lazy initialization.
 
-The Neo4j driver connects on first use by default. API processes may
-eagerly initialize the driver during app startup, while Celery workers
-remain lazy. These tests validate the database module behavior itself.
+The Neo4j driver is created on first use for every process type; app startup
+never contacts Neo4j. These tests validate the database module behavior itself.
 """
 
 import threading
+
 from unittest.mock import MagicMock, patch
 
 import neo4j
+import neo4j.exceptions
 import pytest
 
 import api.attack_paths.database as db_module
@@ -59,6 +60,32 @@ class TestLazyInitialization:
         assert result is mock_driver
         assert db_module._driver is mock_driver
 
+    @patch("api.attack_paths.database.settings")
+    @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
+    def test_init_driver_leaves_driver_none_when_verify_fails(
+        self, mock_driver_factory, mock_settings
+    ):
+        """A failed verify_connectivity() must not publish or leak the driver."""
+        mock_driver = MagicMock()
+        mock_driver.verify_connectivity.side_effect = (
+            neo4j.exceptions.ServiceUnavailable("down")
+        )
+        mock_driver_factory.return_value = mock_driver
+        mock_settings.DATABASES = {
+            "neo4j": {
+                "HOST": "localhost",
+                "PORT": 7687,
+                "USER": "neo4j",
+                "PASSWORD": "password",
+            }
+        }
+
+        with pytest.raises(neo4j.exceptions.ServiceUnavailable):
+            db_module.init_driver()
+
+        assert db_module._driver is None
+        mock_driver.close.assert_called_once()
+
     @patch("api.attack_paths.database.settings")
     @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
     def test_init_driver_returns_cached_driver_on_subsequent_calls(
@@ -116,21 +143,23 @@ class TestConnectionAcquisitionTimeout:
     @pytest.fixture(autouse=True)
     def reset_module_state(self):
         original_driver = db_module._driver
-        original_timeout = db_module.CONN_ACQUISITION_TIMEOUT
+        original_acq_timeout = db_module.CONN_ACQUISITION_TIMEOUT
+        original_conn_timeout = db_module.CONNECTION_TIMEOUT
 
         db_module._driver = None
 
         yield
 
         db_module._driver = original_driver
-        db_module.CONN_ACQUISITION_TIMEOUT = original_timeout
+        db_module.CONN_ACQUISITION_TIMEOUT = original_acq_timeout
+        db_module.CONNECTION_TIMEOUT = original_conn_timeout
 
     @patch("api.attack_paths.database.settings")
     @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
     def test_driver_receives_configured_timeout(
         self, mock_driver_factory, mock_settings
     ):
-        """init_driver() should pass CONN_ACQUISITION_TIMEOUT to the neo4j driver."""
+        """init_driver() should pass the configured timeouts to the neo4j driver."""
         mock_driver_factory.return_value = MagicMock()
         mock_settings.DATABASES = {
             "neo4j": {
@@ -141,11 +170,13 @@ class TestConnectionAcquisitionTimeout:
             }
         }
         db_module.CONN_ACQUISITION_TIMEOUT = 42
+        db_module.CONNECTION_TIMEOUT = 7
 
         db_module.init_driver()
 
         _, kwargs = mock_driver_factory.call_args
         assert kwargs["connection_acquisition_timeout"] == 42
+        assert kwargs["connection_timeout"] == 7
 
 
 class TestAtexitRegistration:
@@ -511,3 +542,84 @@ class TestHasProviderData:
         ):
             with pytest.raises(db_module.GraphDatabaseQueryException):
                 db_module.has_provider_data("db-tenant-abc", "provider-123")
+
+
+class TestDropSubgraph:
+    """Test drop_subgraph two-phase batched deletion of a provider's graph."""
+
+    @staticmethod
+    def _result(count):
+        result = MagicMock()
+        result.single.return_value.get.return_value = count
+        return result
+
+    @staticmethod
+    def _session_ctx(session):
+        ctx = MagicMock()
+        ctx.__enter__.return_value = session
+        ctx.__exit__.return_value = False
+        return ctx
+
+    def test_deletes_relationships_then_nodes_in_batches(self):
+        session = MagicMock()
+        # Phase 1 (relationships): one full batch then empty.
+        # Phase 2 (nodes): one full batch then empty.
+        session.run.side_effect = [
+            self._result(1000),
+            self._result(0),
+            self._result(1000),
+            self._result(0),
+        ]
+
+        with patch(
+            "api.attack_paths.database.get_session",
+            return_value=self._session_ctx(session),
+        ):
+            deleted = db_module.drop_subgraph("db-tenant-abc", "provider-123")
+
+        # Only phase-2 node counts contribute to the return value.
+        assert deleted == 1000
+        assert session.run.call_count == 4
+
+        queries = [call.args[0] for call in session.run.call_args_list]
+
+        # Regression guard: the memory blow-up was caused by DETACH DELETE.
+        assert all("DETACH DELETE" not in query for query in queries)
+
+        rel_queries = [query for query in queries if "DELETE r" in query]
+        node_queries = [query for query in queries if "DELETE n" in query]
+        assert rel_queries and node_queries
+        # DISTINCT avoids double-counting relationships matched from both ends.
+        assert all("DISTINCT r" in query for query in rel_queries)
+
+        # Relationships must be fully drained before nodes are deleted.
+        first_node = next(i for i, q in enumerate(queries) if "DELETE n" in q)
+        last_rel = max(i for i, q in enumerate(queries) if "DELETE r" in q)
+        assert last_rel < first_node
+
+    def test_returns_zero_when_database_not_found(self):
+        session_ctx = MagicMock()
+        session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
+            message="Database does not exist",
+            code="Neo.ClientError.Database.DatabaseNotFound",
+        )
+
+        with patch(
+            "api.attack_paths.database.get_session",
+            return_value=session_ctx,
+        ):
+            assert db_module.drop_subgraph("db-tenant-gone", "provider-123") == 0
+
+    def test_raises_on_other_errors(self):
+        session_ctx = MagicMock()
+        session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
+            message="Connection refused",
+            code="Neo.TransientError.General.UnknownError",
+        )
+
+        with patch(
+            "api.attack_paths.database.get_session",
+            return_value=session_ctx,
+        ):
+            with pytest.raises(db_module.GraphDatabaseQueryException):
+                db_module.drop_subgraph("db-tenant-abc", "provider-123")
diff --git a/api/src/backend/api/tests/test_authentication.py b/api/src/backend/api/tests/test_authentication.py
index 6745c36e91..505d7c9320 100644
--- a/api/src/backend/api/tests/test_authentication.py
+++ b/api/src/backend/api/tests/test_authentication.py
@@ -1,13 +1,13 @@
 import time
 from datetime import datetime, timedelta, timezone
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
 import pytest
 from django.test import RequestFactory
 from rest_framework.exceptions import AuthenticationFailed
 
-from api.authentication import TenantAPIKeyAuthentication
+from api.authentication import SSEAuthentication, TenantAPIKeyAuthentication
 from api.db_router import MainRouter
 from api.models import TenantAPIKey
 
@@ -382,3 +382,62 @@ class TestTenantAPIKeyAuthentication:
             auth_backend.authenticate(request)
 
         assert str(exc_info.value.detail) == "API Key has already expired."
+
+
+class TestSSEAuthentication:
+    """`SSEAuthentication` adds an `?access_token=<jwt>` fallback for
+    browser `EventSource` clients while keeping the standard
+    `Authorization` header as the authoritative source."""
+
+    def test_header_present_delegates_to_super(self):
+        request = MagicMock()
+        request.headers = {"Authorization": "Bearer header-token"}
+        with patch.object(
+            SSEAuthentication.__bases__[0], "authenticate", return_value=("user", "tok")
+        ) as super_auth:
+            result = SSEAuthentication().authenticate(request)
+        super_auth.assert_called_once_with(request)
+        assert result == ("user", "tok")
+
+    def test_no_header_no_query_token_delegates_to_super(self):
+        request = MagicMock()
+        request.headers = {}
+        request.query_params = {}
+        with patch.object(
+            SSEAuthentication.__bases__[0], "authenticate", return_value=None
+        ) as super_auth:
+            result = SSEAuthentication().authenticate(request)
+        super_auth.assert_called_once_with(request)
+        assert result is None
+
+    def test_query_token_used_only_as_fallback(self):
+        request = MagicMock()
+        request.headers = {}
+        request.query_params = {"access_token": "query-jwt"}
+
+        jwt_instance = MagicMock()
+        jwt_instance.get_validated_token.return_value = "validated"
+        jwt_instance.get_user.return_value = "query-user"
+
+        with patch.object(SSEAuthentication, "jwt_auth", jwt_instance):
+            user, token = SSEAuthentication().authenticate(request)
+
+        jwt_instance.get_validated_token.assert_called_once_with("query-jwt")
+        assert user == "query-user"
+        assert token == "validated"
+
+    def test_query_token_invalid_raises_authentication_failed(self):
+        request = MagicMock()
+        request.headers = {}
+        request.query_params = {"access_token": "bad-token"}
+
+        jwt_instance = MagicMock()
+        jwt_instance.get_validated_token.side_effect = AuthenticationFailed(
+            "Invalid token"
+        )
+
+        with patch.object(SSEAuthentication, "jwt_auth", jwt_instance):
+            with pytest.raises(AuthenticationFailed):
+                SSEAuthentication().authenticate(request)
+
+        jwt_instance.get_validated_token.assert_called_once_with("bad-token")
diff --git a/api/src/backend/api/tests/test_compliance.py b/api/src/backend/api/tests/test_compliance.py
index ce30a3cc52..99a31ea12c 100644
--- a/api/src/backend/api/tests/test_compliance.py
+++ b/api/src/backend/api/tests/test_compliance.py
@@ -10,9 +10,12 @@ from api.compliance import (
     get_prowler_provider_checks,
     get_prowler_provider_compliance,
     load_prowler_checks,
+    warm_compliance_caches,
 )
 from api.models import Provider
-from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.check.compliance_models import (
+    get_bulk_compliance_frameworks_universal,
+)
 
 
 class TestCompliance:
@@ -28,16 +31,16 @@ class TestCompliance:
         assert set(checks) == {"check1", "check2", "check3"}
         mock_check_metadata.get_bulk.assert_called_once_with(provider_type)
 
-    @patch("api.compliance.Compliance")
-    def test_get_prowler_provider_compliance(self, mock_compliance):
+    @patch("api.compliance.get_bulk_compliance_frameworks_universal")
+    def test_get_prowler_provider_compliance(self, mock_get_bulk):
         provider_type = Provider.ProviderChoices.AWS
-        mock_compliance.get_bulk.return_value = {
+        mock_get_bulk.return_value = {
             "compliance1": MagicMock(),
             "compliance2": MagicMock(),
         }
         compliance_data = get_prowler_provider_compliance(provider_type)
-        assert compliance_data == mock_compliance.get_bulk.return_value
-        mock_compliance.get_bulk.assert_called_once_with(provider_type)
+        assert compliance_data == mock_get_bulk.return_value
+        mock_get_bulk.assert_called_once_with(provider_type)
 
     @patch("api.compliance.get_prowler_provider_checks")
     @patch("api.models.Provider.ProviderChoices")
@@ -51,9 +54,9 @@ class TestCompliance:
         prowler_compliance = {
             "aws": {
                 "compliance1": MagicMock(
-                    Requirements=[
+                    requirements=[
                         MagicMock(
-                            Checks=["check1", "check2"],
+                            checks={"aws": ["check1", "check2"]},
                         ),
                     ],
                 ),
@@ -167,35 +170,38 @@ class TestCompliance:
     def test_generate_compliance_overview_template(self, mock_provider_choices):
         mock_provider_choices.values = ["aws"]
 
+        # ``name`` is a reserved MagicMock kwarg (it labels the mock for repr,
+        # it does NOT set a ``.name`` attribute), so it must be assigned
+        # explicitly after construction.
         requirement1 = MagicMock(
-            Id="requirement1",
-            Name="Requirement 1",
-            Description="Description of requirement 1",
-            Attributes=[],
-            Checks=["check1", "check2"],
-            Tactics=["tactic1"],
-            SubTechniques=["subtechnique1"],
-            Platforms=["platform1"],
-            TechniqueURL="https://example.com",
+            id="requirement1",
+            description="Description of requirement 1",
+            attributes=[],
+            checks={"aws": ["check1", "check2"]},
+            tactics=["tactic1"],
+            sub_techniques=["subtechnique1"],
+            platforms=["platform1"],
+            technique_url="https://example.com",
         )
+        requirement1.name = "Requirement 1"
         requirement2 = MagicMock(
-            Id="requirement2",
-            Name="Requirement 2",
-            Description="Description of requirement 2",
-            Attributes=[],
-            Checks=[],
-            Tactics=[],
-            SubTechniques=[],
-            Platforms=[],
-            TechniqueURL="",
+            id="requirement2",
+            description="Description of requirement 2",
+            attributes=[],
+            checks={"aws": []},
+            tactics=[],
+            sub_techniques=[],
+            platforms=[],
+            technique_url="",
         )
+        requirement2.name = "Requirement 2"
         compliance1 = MagicMock(
-            Requirements=[requirement1, requirement2],
-            Framework="Framework 1",
-            Version="1.0",
-            Description="Description of compliance1",
-            Name="Compliance 1",
+            requirements=[requirement1, requirement2],
+            framework="Framework 1",
+            version="1.0",
+            description="Description of compliance1",
         )
+        compliance1.name = "Compliance 1"
         prowler_compliance = {"aws": {"compliance1": compliance1}}
 
         template = generate_compliance_overview_template(prowler_compliance)
@@ -262,33 +268,43 @@ def reset_compliance_cache():
     """Reset the module-level cache so each test starts cold."""
     previous = dict(compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS)
     compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS.clear()
+    # The warming flags are module-global; clear them so they do not leak
+    # between tests that call warm_compliance_caches.
+    compliance_module.COMPLIANCE_WARMING_STARTED.clear()
+    compliance_module.COMPLIANCE_WARMED.clear()
     try:
         yield
     finally:
         compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS.clear()
         compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS.update(previous)
+        compliance_module.COMPLIANCE_WARMING_STARTED.clear()
+        compliance_module.COMPLIANCE_WARMED.clear()
 
 
 class TestGetComplianceFrameworks:
     def test_returns_keys_from_compliance_get_bulk(self, reset_compliance_cache):
-        with patch("api.compliance.Compliance") as mock_compliance:
-            mock_compliance.get_bulk.return_value = {
+        with patch(
+            "api.compliance.get_bulk_compliance_frameworks_universal"
+        ) as mock_get_bulk:
+            mock_get_bulk.return_value = {
                 "cis_1.4_aws": MagicMock(),
                 "mitre_attack_aws": MagicMock(),
             }
             result = get_compliance_frameworks(Provider.ProviderChoices.AWS)
 
         assert sorted(result) == ["cis_1.4_aws", "mitre_attack_aws"]
-        mock_compliance.get_bulk.assert_called_once_with(Provider.ProviderChoices.AWS)
+        mock_get_bulk.assert_called_once_with(Provider.ProviderChoices.AWS)
 
     def test_caches_result_per_provider(self, reset_compliance_cache):
-        with patch("api.compliance.Compliance") as mock_compliance:
-            mock_compliance.get_bulk.return_value = {"cis_1.4_aws": MagicMock()}
+        with patch(
+            "api.compliance.get_bulk_compliance_frameworks_universal"
+        ) as mock_get_bulk:
+            mock_get_bulk.return_value = {"cis_1.4_aws": MagicMock()}
             get_compliance_frameworks(Provider.ProviderChoices.AWS)
             get_compliance_frameworks(Provider.ProviderChoices.AWS)
 
         # Cached after first call.
-        assert mock_compliance.get_bulk.call_count == 1
+        assert mock_get_bulk.call_count == 1
 
     @pytest.mark.parametrize(
         "provider_type",
@@ -296,17 +312,105 @@ class TestGetComplianceFrameworks:
     )
     def test_listing_is_subset_of_bulk(self, reset_compliance_cache, provider_type):
         """Regression for CLOUD-API-40S: every name returned by
-        ``get_compliance_frameworks`` must be loadable via ``Compliance.get_bulk``.
+        ``get_compliance_frameworks`` must be loadable via
+        ``get_bulk_compliance_frameworks_universal``.
 
         A divergence here is what produced ``KeyError: 'csa_ccm_4.0'`` in
         ``generate_outputs_task`` after universal/multi-provider compliance
         JSONs were introduced at the top-level ``prowler/compliance/`` path.
         """
-        bulk_keys = set(Compliance.get_bulk(provider_type).keys())
+        bulk_keys = set(get_bulk_compliance_frameworks_universal(provider_type).keys())
         listed = set(get_compliance_frameworks(provider_type))
 
         missing = listed - bulk_keys
         assert not missing, (
             f"get_compliance_frameworks({provider_type!r}) returned names not "
-            f"loadable by Compliance.get_bulk: {sorted(missing)}"
+            f"loadable by get_bulk_compliance_frameworks_universal: "
+            f"{sorted(missing)}"
         )
+
+
+class TestWarmComplianceCaches:
+    def test_warms_all_provider_types_by_default(self, reset_compliance_cache):
+        provider_types = list(Provider.ProviderChoices.values)
+        with (
+            patch("api.compliance.get_compliance_frameworks") as mock_frameworks,
+            patch("api.compliance._ensure_provider_loaded") as mock_ensure,
+        ):
+            warm_compliance_caches()
+
+        warmed = {call.args[0] for call in mock_frameworks.call_args_list}
+        assert warmed == set(provider_types)
+        assert mock_frameworks.call_count == len(provider_types)
+        assert mock_ensure.call_count == len(provider_types)
+
+    def test_warms_only_requested_provider_types(self, reset_compliance_cache):
+        with (
+            patch("api.compliance.get_compliance_frameworks") as mock_frameworks,
+            patch("api.compliance._ensure_provider_loaded") as mock_ensure,
+        ):
+            warm_compliance_caches([Provider.ProviderChoices.AWS])
+
+        mock_frameworks.assert_called_once_with(Provider.ProviderChoices.AWS)
+        mock_ensure.assert_called_once_with(Provider.ProviderChoices.AWS)
+
+    def test_populates_module_cache(self, reset_compliance_cache):
+        with (
+            patch(
+                "api.compliance.get_bulk_compliance_frameworks_universal"
+            ) as mock_get_bulk,
+            patch("api.compliance._ensure_provider_loaded"),
+        ):
+            mock_get_bulk.return_value = {"cis_1.4_aws": MagicMock()}
+            warm_compliance_caches([Provider.ProviderChoices.AWS])
+
+        assert (
+            Provider.ProviderChoices.AWS
+            in compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS
+        )
+
+    def test_failing_provider_does_not_abort_the_rest(self, reset_compliance_cache):
+        """A failing provider (even on SystemExit) is isolated; others warm."""
+        providers = [Provider.ProviderChoices.AWS, Provider.ProviderChoices.OKTA]
+
+        def fake_frameworks(provider_type):
+            if provider_type == Provider.ProviderChoices.OKTA:
+                raise SystemExit(1)
+            return []
+
+        with (
+            patch(
+                "api.compliance.get_compliance_frameworks", side_effect=fake_frameworks
+            ),
+            patch("api.compliance._ensure_provider_loaded") as mock_ensure,
+        ):
+            failed = warm_compliance_caches(providers)
+
+        assert failed == [Provider.ProviderChoices.OKTA]
+        mock_ensure.assert_called_once_with(Provider.ProviderChoices.AWS)
+
+    def test_sets_readiness_flags(self, reset_compliance_cache):
+        assert not compliance_module.COMPLIANCE_WARMING_STARTED.is_set()
+        assert not compliance_module.COMPLIANCE_WARMED.is_set()
+
+        with (
+            patch("api.compliance.get_compliance_frameworks"),
+            patch("api.compliance._ensure_provider_loaded"),
+        ):
+            warm_compliance_caches([Provider.ProviderChoices.AWS])
+
+        assert compliance_module.COMPLIANCE_WARMING_STARTED.is_set()
+        assert compliance_module.COMPLIANCE_WARMED.is_set()
+
+    def test_marks_warmed_even_when_a_provider_fails(self, reset_compliance_cache):
+        """A failed provider still leaves the caches flagged as warmed."""
+        with (
+            patch(
+                "api.compliance.get_compliance_frameworks",
+                side_effect=SystemExit(1),
+            ),
+            patch("api.compliance._ensure_provider_loaded"),
+        ):
+            warm_compliance_caches([Provider.ProviderChoices.AWS])
+
+        assert compliance_module.COMPLIANCE_WARMED.is_set()
diff --git a/api/src/backend/api/tests/test_db_connection_labels.py b/api/src/backend/api/tests/test_db_connection_labels.py
new file mode 100644
index 0000000000..a39e7d9051
--- /dev/null
+++ b/api/src/backend/api/tests/test_db_connection_labels.py
@@ -0,0 +1,55 @@
+from config.django.base import label_postgres_connections
+
+
+class TestLabelPostgresConnections:
+    def test_labels_postgres_and_skips_neo4j(self, monkeypatch):
+        monkeypatch.setenv("DJANGO_APP_COMPONENT", "scan")
+        databases = {
+            "default": {"ENGINE": "psqlextra.backend"},
+            "neo4j": {"HOST": "neo4j", "PORT": "7687"},
+        }
+
+        label_postgres_connections(databases)
+
+        assert databases["default"]["OPTIONS"]["application_name"] == "scan:default"
+        assert "OPTIONS" not in databases["neo4j"]
+
+    def test_labels_plain_postgresql_backend(self, monkeypatch):
+        monkeypatch.setenv("DJANGO_APP_COMPONENT", "api")
+        databases = {"saas": {"ENGINE": "django.db.backends.postgresql"}}
+
+        label_postgres_connections(databases)
+
+        assert databases["saas"]["OPTIONS"]["application_name"] == "api:saas"
+
+    def test_defaults_component_to_api_when_unset(self, monkeypatch):
+        monkeypatch.delenv("DJANGO_APP_COMPONENT", raising=False)
+        databases = {"default": {"ENGINE": "psqlextra.backend"}}
+
+        label_postgres_connections(databases)
+
+        assert databases["default"]["OPTIONS"]["application_name"] == "api:default"
+
+    def test_preserves_existing_options(self, monkeypatch):
+        monkeypatch.setenv("DJANGO_APP_COMPONENT", "worker")
+        databases = {
+            "replica": {
+                "ENGINE": "psqlextra.backend",
+                "OPTIONS": {"sslmode": "require"},
+            }
+        }
+
+        label_postgres_connections(databases)
+
+        assert databases["replica"]["OPTIONS"] == {
+            "sslmode": "require",
+            "application_name": "worker:replica",
+        }
+
+    def test_truncates_application_name_to_63_bytes(self, monkeypatch):
+        monkeypatch.setenv("DJANGO_APP_COMPONENT", "c" * 80)
+        databases = {"default": {"ENGINE": "psqlextra.backend"}}
+
+        label_postgres_connections(databases)
+
+        assert len(databases["default"]["OPTIONS"]["application_name"]) == 63
diff --git a/api/src/backend/api/tests/test_sse.py b/api/src/backend/api/tests/test_sse.py
new file mode 100644
index 0000000000..beba821e64
--- /dev/null
+++ b/api/src/backend/api/tests/test_sse.py
@@ -0,0 +1,191 @@
+"""Tests for the platform SSE infrastructure (``api.sse``).
+
+Cover the two security-critical platform pieces — the channel-name
+convention (:mod:`api.sse.utils`) and the tenant gate enforced by
+:class:`api.sse.channelmanager.SSEChannelManager`. The SSE authentication
+class lives in :mod:`api.authentication` with the rest of the auth stack,
+so its tests live in ``test_authentication.py``. Per-feature SSE endpoints
+add their own tests on top of these.
+"""
+
+import uuid
+from unittest.mock import MagicMock
+
+import pytest
+from django.http import StreamingHttpResponse
+from rest_framework.test import APIRequestFactory, force_authenticate
+
+from api.sse.base_views import BaseSSEViewSet
+from api.sse.channelmanager import SSEChannelManager
+from api.sse.utils import make_channel_name, tenant_id_from_channel
+
+
+class TestMakeChannel:
+    def test_round_trips_tenant_id(self):
+        tenant_id = uuid.uuid4()
+        channel = make_channel_name("lighthouse-session", tenant_id, uuid.uuid4())
+        assert tenant_id_from_channel(channel) == tenant_id
+
+    def test_accepts_str_arguments(self):
+        tenant_id = uuid.uuid4()
+        channel = make_channel_name("lighthouse-session", str(tenant_id), "resource-1")
+        assert channel == f"lighthouse-session:{tenant_id}:resource-1"
+
+    def test_prefix_with_hyphen_is_not_split(self):
+        # Prefixes contain hyphens but never colons, so the tenant id is
+        # always the second colon-separated segment.
+        tenant_id = uuid.uuid4()
+        channel = make_channel_name("a-long-hyphenated-prefix", tenant_id, "res")
+        assert tenant_id_from_channel(channel) == tenant_id
+
+    @pytest.mark.parametrize(
+        "prefix, tenant_id, resource_id",
+        [
+            ("evil:prefix", uuid.uuid4(), "res"),
+            ("prefix", uuid.uuid4(), "res:extra"),
+            ("prefix", "tenant:smuggled", "res"),
+        ],
+    )
+    def test_rejects_separator_injection(self, prefix, tenant_id, resource_id):
+        # A colon in any segment would let a crafted name smuggle extra
+        # segments past the parser, so construction must fail loudly.
+        with pytest.raises(ValueError):
+            make_channel_name(prefix, tenant_id, resource_id)
+
+
+class TestTenantIdFromChannel:
+    def test_returns_none_for_too_few_segments(self):
+        assert tenant_id_from_channel("prefix:only") is None
+        assert tenant_id_from_channel("garbage") is None
+
+    def test_returns_none_for_too_many_segments(self):
+        # A valid tenant UUID in position 1 must not authorize a
+        # non-canonical name that carries extra segments.
+        tenant_id = uuid.uuid4()
+        assert tenant_id_from_channel(f"prefix:{tenant_id}:resource:extra") is None
+
+    def test_returns_none_for_non_uuid_tenant_segment(self):
+        assert tenant_id_from_channel("prefix:not-a-uuid:resource") is None
+
+    def test_parses_valid_channel(self):
+        tenant_id = uuid.uuid4()
+        assert tenant_id_from_channel(f"prefix:{tenant_id}:resource") == tenant_id
+
+
+@pytest.mark.django_db
+class TestSSEChannelManager:
+    def test_member_can_read_own_tenant_channel(
+        self, create_test_user, tenants_fixture
+    ):
+        tenant = tenants_fixture[0]
+        channel = make_channel_name("lighthouse-session", tenant.id, uuid.uuid4())
+        assert SSEChannelManager().can_read_channel(create_test_user, channel)
+
+    def test_non_member_cannot_read_other_tenant_channel(
+        self, create_test_user, tenants_fixture
+    ):
+        # create_test_user is a member of tenant1 and tenant2 but not tenant3.
+        foreign_tenant = tenants_fixture[2]
+        channel = make_channel_name(
+            "lighthouse-session", foreign_tenant.id, uuid.uuid4()
+        )
+        assert not SSEChannelManager().can_read_channel(create_test_user, channel)
+
+    def test_anonymous_user_is_rejected(self, tenants_fixture):
+        channel = make_channel_name(
+            "lighthouse-session", tenants_fixture[0].id, uuid.uuid4()
+        )
+        assert not SSEChannelManager().can_read_channel(None, channel)
+
+        anon = MagicMock(is_authenticated=False)
+        assert not SSEChannelManager().can_read_channel(anon, channel)
+
+    def test_malformed_channel_is_rejected(self, create_test_user, tenants_fixture):
+        assert not SSEChannelManager().can_read_channel(create_test_user, "garbage")
+
+    def test_get_channels_for_request_returns_active_tenant_channels(self):
+        tenant_id = uuid.uuid4()
+        own = make_channel_name("prefix", tenant_id, "resource")
+        request = MagicMock()
+        request.tenant_id = str(tenant_id)
+        request.sse_channels = {own}
+        assert SSEChannelManager().get_channels_for_request(request, {}) == {own}
+
+    def test_get_channels_for_request_drops_other_tenant_channels(self):
+        # Fail-closed: a channel for a tenant other than the active JWT
+        # tenant is dropped before reaching django-eventstream, even if the
+        # viewset mistakenly stashed it. This is the primary tenant gate that
+        # binds authorization to request.tenant_id, not just membership.
+        active_tenant = uuid.uuid4()
+        own = make_channel_name("prefix", active_tenant, "resource")
+        foreign = make_channel_name("prefix", uuid.uuid4(), "resource")
+        request = MagicMock()
+        request.tenant_id = str(active_tenant)
+        request.sse_channels = {own, foreign}
+        assert SSEChannelManager().get_channels_for_request(request, {}) == {own}
+
+    def test_get_channels_for_request_drops_malformed_channels(self):
+        request = MagicMock()
+        request.tenant_id = str(uuid.uuid4())
+        request.sse_channels = {"garbage", "prefix:not-a-uuid:resource"}
+        assert SSEChannelManager().get_channels_for_request(request, {}) == set()
+
+    def test_get_channels_for_request_without_tenant_returns_empty(self):
+        # No active tenant on the request (auth/RLS never ran) → fail closed,
+        # regardless of any channels stashed on it.
+        request = MagicMock(spec=[])
+        assert SSEChannelManager().get_channels_for_request(request, {}) == set()
+
+    def test_get_channels_for_request_defaults_to_empty(self):
+        # A request that never went through BaseSSEViewSet.list has no
+        # sse_channels attribute; the manager must not raise.
+        request = object()
+        assert SSEChannelManager().get_channels_for_request(request, {}) == set()
+
+    def test_channel_is_not_reliable(self):
+        # v1 ships without server-side replay storage.
+        assert (
+            SSEChannelManager().is_channel_reliable("prefix:tenant:resource") is False
+        )
+
+
+@pytest.mark.django_db
+class TestBaseSSEViewSet:
+    """End-to-end check that the base viewset opens a stream.
+
+    ``BaseSSEViewSet.list`` hands the DRF ``Request`` straight to
+    django-eventstream's ``events()``, which is written for a plain
+    Django request. This drives a real request through the full DRF
+    stack (authentication, RLS, content negotiation, channel manager)
+    and asserts the result is an SSE stream, so the DRF/Django request
+    mismatch cannot regress silently.
+    """
+
+    def test_list_opens_event_stream(self, create_test_user, tenants_fixture):
+        tenant = tenants_fixture[0]
+        channel = make_channel_name("test-sse", tenant.id, uuid.uuid4())
+        seen_tenant_ids = []
+
+        class _StreamingSSEViewSet(BaseSSEViewSet):
+            def get_channels(self):
+                # Reached only after dispatch/initial ran, so the RLS
+                # tenant context is already on the request.
+                seen_tenant_ids.append(self.request.tenant_id)
+                return {channel}
+
+        request = APIRequestFactory().get("/api/v1/test-sse/stream")
+        force_authenticate(
+            request, user=create_test_user, token={"tenant_id": str(tenant.id)}
+        )
+
+        view = _StreamingSSEViewSet.as_view({"get": "list"})
+        response = view(request)
+
+        # A StreamingHttpResponse (not the plain HttpResponse used for SSE
+        # error envelopes) means events() accepted the DRF request, the
+        # channel manager handed it a non-empty channel set, and the
+        # stream was opened end to end.
+        assert isinstance(response, StreamingHttpResponse)
+        assert response.status_code == 200
+        assert response["Content-Type"] == "text/event-stream"
+        assert seen_tenant_ids == [str(tenant.id)]
diff --git a/api/src/backend/api/tests/test_utils.py b/api/src/backend/api/tests/test_utils.py
index 3a7f030a9c..3fd9235dac 100644
--- a/api/src/backend/api/tests/test_utils.py
+++ b/api/src/backend/api/tests/test_utils.py
@@ -357,6 +357,30 @@ class TestGetProwlerProviderKwargs:
         expected_result = {**secret_dict, **expected_extra_kwargs}
         assert result == expected_result
 
+    def test_get_prowler_provider_kwargs_oraclecloud_converts_region_string_to_set(
+        self,
+    ):
+        secret_dict = {
+            "user": "ocid1.user.oc1..fake",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----",
+            "tenancy": "ocid1.tenancy.oc1..fake",
+            "region": "us-ashburn-1",
+            "pass_phrase": "fake-passphrase",
+        }
+        secret_mock = MagicMock()
+        secret_mock.secret = secret_dict
+
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret = secret_mock
+        provider.uid = "ocid1.tenancy.oc1..fake"
+
+        result = get_prowler_provider_kwargs(provider)
+
+        expected_result = {**secret_dict, "region": {"us-ashburn-1"}}
+        assert result == expected_result
+
     def test_get_prowler_provider_kwargs_with_mutelist(self):
         provider_uid = "provider_uid"
         secret_dict = {"key": "value"}
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index ebd9128407..35098c1907 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -24,9 +24,11 @@ from conftest import (
     today_after_n_days,
 )
 from django.conf import settings
+from django.db import connection
 from django.db.models import Count
 from django.http import JsonResponse
 from django.test import RequestFactory
+from django.test.utils import CaptureQueriesContext
 from django.urls import reverse
 from django_celery_results.models import TaskResult
 from rest_framework import status
@@ -64,6 +66,7 @@ from api.models import (
     ProviderSecret,
     Resource,
     ResourceFindingMapping,
+    ResourceTag,
     Role,
     RoleProviderGroupRelationship,
     SAMLConfiguration,
@@ -1408,6 +1411,42 @@ class TestProviderViewSet:
         )
         assert response.status_code == status.HTTP_400_BAD_REQUEST
 
+    def test_providers_filter_provider_groups(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("provider-list"), {"filter[provider_groups]": str(group1.id)}
+        )
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        assert [item["id"] for item in data] == [str(provider1.id)]
+
+        response = authenticated_client.get(
+            reverse("provider-list"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        provider_ids = {item["id"] for item in response.json()["data"]}
+        assert provider_ids == {str(provider1.id), str(provider2.id)}
+        assert len(response.json()["data"]) == 2
+
     def test_providers_disable_pagination(
         self, authenticated_client, providers_fixture, tenants_fixture
     ):
@@ -3712,6 +3751,41 @@ class TestScanViewSet:
         assert response.status_code == status.HTTP_200_OK
         assert len(response.json()["data"]) == expected_count
 
+    def test_scans_filter_provider_groups(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        scans_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        scan1, scan2, *_ = scans_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=scan1.provider, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=scan1.provider, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=scan2.provider, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("scan-list"), {"filter[provider_groups]": str(group1.id)}
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert {item["id"] for item in response.json()["data"]} == {str(scan1.id)}
+
+        response = authenticated_client.get(
+            reverse("scan-list"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        scan_ids = {item["id"] for item in response.json()["data"]}
+        assert scan_ids == {str(scan1.id), str(scan2.id), str(scans_fixture[2].id)}
+        assert len(response.json()["data"]) == 3
+
     @pytest.mark.parametrize(
         "filter_name",
         [
@@ -3856,16 +3930,20 @@ class TestScanViewSet:
         scan.output_location = "dummy"
         scan.save()
 
-        dummy_task = Task.objects.create(tenant_id=scan.tenant_id)
-        dummy_task.id = "dummy-task-id"
-        dummy_task_data = {"id": dummy_task.id, "state": StateChoices.EXECUTING}
+        task_result = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan-report",
+            task_kwargs={"scan_id": str(scan.id)},
+        )
+        task = Task.objects.create(
+            tenant_id=scan.tenant_id,
+            task_runner_task=task_result,
+        )
+        dummy_task_data = {"id": str(task.id), "state": StateChoices.EXECUTING}
 
-        with (
-            patch("api.v1.views.Task.objects.get", return_value=dummy_task),
-            patch(
-                "api.v1.views.TaskSerializer",
-                return_value=type("DummySerializer", (), {"data": dummy_task_data}),
-            ),
+        with patch(
+            "api.v1.views.TaskSerializer",
+            return_value=type("DummySerializer", (), {"data": dummy_task_data}),
         ):
             url = reverse("scan-report", kwargs={"pk": scan.id})
             response = authenticated_client.get(url)
@@ -4186,6 +4264,88 @@ class TestScanViewSet:
         assert resp.status_code == status.HTTP_302_FOUND
         assert resp["Location"] == presigned_url
 
+    def test_compliance_s3_returns_latest_match(
+        self, authenticated_client, scans_fixture, monkeypatch
+    ):
+        """When several files match, the most recently modified one is served."""
+        scan = scans_fixture[0]
+        bucket = "bucket"
+        scan.output_location = f"s3://{bucket}/path/scan.zip"
+        scan.state = StateChoices.COMPLETED
+        scan.save()
+
+        monkeypatch.setattr(
+            "api.v1.views.env",
+            type("env", (), {"str": lambda self, *args, **kwargs: "test-bucket"})(),
+        )
+
+        old_key = "path/compliance/prowler-output-aws-20240101000000_cis_1.4_aws.csv"
+        latest_key = "path/compliance/prowler-output-aws-20240202000000_cis_1.4_aws.csv"
+
+        class FakeS3Client:
+            def list_objects_v2(self, Bucket, Prefix):
+                return {
+                    "Contents": [
+                        {
+                            "Key": old_key,
+                            "LastModified": datetime(2024, 1, 1, tzinfo=timezone.utc),
+                        },
+                        {
+                            "Key": latest_key,
+                            "LastModified": datetime(2024, 2, 2, tzinfo=timezone.utc),
+                        },
+                    ]
+                }
+
+            def generate_presigned_url(self, ClientMethod, Params, ExpiresIn):
+                assert Params["Key"] == latest_key
+                return "https://test-bucket.s3.amazonaws.com/latest"
+
+        monkeypatch.setattr("api.v1.views.get_s3_client", lambda: FakeS3Client())
+
+        url = reverse("scan-compliance", kwargs={"pk": scan.id, "name": "cis_1.4_aws"})
+        resp = authenticated_client.get(url)
+        assert resp.status_code == status.HTTP_302_FOUND
+        assert resp["Location"].endswith("/latest")
+
+    def test_compliance_local_returns_latest_match(
+        self, authenticated_client, scans_fixture, monkeypatch
+    ):
+        """The local branch serves the most recently modified matching file."""
+        scan = scans_fixture[0]
+        scan.state = StateChoices.COMPLETED
+
+        with tempfile.TemporaryDirectory() as tmp:
+            comp_dir = Path(tmp) / "reports" / "compliance"
+            comp_dir.mkdir(parents=True, exist_ok=True)
+
+            old_file = comp_dir / "prowler-output-aws-20240101000000_cis_1.4_aws.csv"
+            old_file.write_bytes(b"old")
+            latest_file = comp_dir / "prowler-output-aws-20240202000000_cis_1.4_aws.csv"
+            latest_file.write_bytes(b"latest")
+            # Make `latest_file` newer regardless of creation order.
+            os.utime(old_file, (1_700_000_000, 1_700_000_000))
+            os.utime(latest_file, (1_700_000_100, 1_700_000_100))
+
+            scan.output_location = str(Path(tmp) / "reports" / "scan.zip")
+            scan.save()
+
+            monkeypatch.setattr(
+                glob,
+                "glob",
+                lambda p: [str(old_file), str(latest_file)],
+            )
+
+            url = reverse(
+                "scan-compliance", kwargs={"pk": scan.id, "name": "cis_1.4_aws"}
+            )
+            resp = authenticated_client.get(url)
+            assert resp.status_code == status.HTTP_200_OK
+            assert resp.content == b"latest"
+            assert resp["Content-Disposition"].endswith(
+                f'filename="{latest_file.name}"'
+            )
+
     def test_compliance_s3_not_found(
         self, authenticated_client, scans_fixture, monkeypatch
     ):
@@ -4294,18 +4454,24 @@ class TestScanViewSet:
             assert cd.startswith('attachment; filename="')
             assert cd.endswith(f'filename="{fname.name}"')
 
-    @patch("api.v1.views.Task.objects.get")
     @patch("api.v1.views.TaskSerializer")
     def test__get_task_status_returns_none_if_task_not_executing(
-        self, mock_task_serializer, mock_task_get, authenticated_client, scans_fixture
+        self, mock_task_serializer, authenticated_client, scans_fixture
     ):
         scan = scans_fixture[0]
         scan.state = StateChoices.COMPLETED
         scan.output_location = "dummy"
         scan.save()
 
-        task = Task.objects.create(tenant_id=scan.tenant_id)
-        mock_task_get.return_value = task
+        task_result = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan-report",
+            task_kwargs={"scan_id": str(scan.id)},
+        )
+        task = Task.objects.create(
+            tenant_id=scan.tenant_id,
+            task_runner_task=task_result,
+        )
         mock_task_serializer.return_value.data = {
             "id": str(task.id),
             "state": StateChoices.COMPLETED,
@@ -4326,6 +4492,7 @@ class TestScanViewSet:
         scan.save()
 
         task_result = TaskResult.objects.create(
+            task_id=str(uuid4()),
             task_name="scan-report",
             task_kwargs={"scan_id": str(scan.id)},
         )
@@ -4346,6 +4513,51 @@ class TestScanViewSet:
         assert response.status_code == status.HTTP_202_ACCEPTED
         assert response.data["id"] == str(task.id)
 
+    @patch("api.v1.views.TaskSerializer")
+    def test__get_task_status_returns_latest_task(
+        self, mock_task_serializer, authenticated_client, scans_fixture
+    ):
+        """With several scan-report tasks for the scan, the most recent is used."""
+        scan = scans_fixture[0]
+        scan.state = StateChoices.COMPLETED
+        scan.output_location = "dummy"
+        scan.save()
+
+        old_task = Task.objects.create(
+            tenant_id=scan.tenant_id,
+            task_runner_task=TaskResult.objects.create(
+                task_id=str(uuid4()),
+                task_name="scan-report",
+                task_kwargs={"scan_id": str(scan.id)},
+            ),
+        )
+        new_task = Task.objects.create(
+            tenant_id=scan.tenant_id,
+            task_runner_task=TaskResult.objects.create(
+                task_id=str(uuid4()),
+                task_name="scan-report",
+                task_kwargs={"scan_id": str(scan.id)},
+            ),
+        )
+        # `inserted_at` is `auto_now_add`, and within the test transaction the DB
+        # `now()` is constant, so force distinct timestamps to make order_by stable.
+        base = datetime(2024, 1, 1, tzinfo=timezone.utc)
+        Task.objects.filter(pk=old_task.pk).update(inserted_at=base)
+        Task.objects.filter(pk=new_task.pk).update(
+            inserted_at=base + timedelta(hours=1)
+        )
+
+        mock_task_serializer.side_effect = lambda instance, *a, **k: SimpleNamespace(
+            data={"id": str(instance.id), "state": StateChoices.EXECUTING}
+        )
+
+        url = reverse("scan-report", kwargs={"pk": scan.id})
+        response = authenticated_client.get(url)
+
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        assert str(new_task.id) in response["Content-Location"]
+        assert str(old_task.id) not in response["Content-Location"]
+
     @patch("api.v1.views.get_s3_client")
     @patch("api.v1.views.sentry_sdk.capture_exception")
     def test_compliance_list_objects_client_error(
@@ -5855,6 +6067,49 @@ class TestResourceViewSet:
         assert response.status_code == status.HTTP_200_OK
         assert len(response.json()["data"]) == expected_count
 
+    def test_resource_filter_provider_groups(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        resources_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        resource1, resource2, resource3, *_ = resources_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=resource1.provider, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=resource1.provider, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=resource3.provider, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("resource-list"),
+            {"filter[updated_at]": TODAY, "filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 2
+        assert {item["id"] for item in response.json()["data"]} == {
+            str(resource1.id),
+            str(resource2.id),
+        }
+
+        response = authenticated_client.get(
+            reverse("resource-list"),
+            {
+                "filter[updated_at]": TODAY,
+                "filter[provider_groups__in]": f"{group1.id},{group2.id}",
+            },
+        )
+        assert response.status_code == status.HTTP_200_OK
+        resource_ids = {item["id"] for item in response.json()["data"]}
+        assert resource_ids == {str(resource1.id), str(resource2.id), str(resource3.id)}
+        assert len(response.json()["data"]) == 3
+
     def test_resource_filter_by_scan_id(
         self, authenticated_client, resources_fixture, scans_fixture
     ):
@@ -6916,6 +7171,80 @@ class TestFindingViewSet:
             == findings_fixture[0].status
         )
 
+    def test_findings_list_resource_tags_no_n_plus_one(
+        self, authenticated_client, findings_fixture
+    ):
+        """Listing findings must load every resource's tags in a constant
+        number of queries, no matter how many findings/resources are returned.
+
+        This guards ``FindingViewSet._optimize_tags_loading`` against
+        regressions that would reintroduce one extra query per resource (the
+        N+1 the prefetch was added to remove).
+        """
+        scan = findings_fixture[0].scan
+        tenant_id = findings_fixture[0].tenant_id
+        provider = scan.provider
+
+        def _create_finding_with_tagged_resource(index):
+            resource = Resource.objects.create(
+                tenant_id=tenant_id,
+                provider=provider,
+                uid=f"arn:aws:ec2:us-east-1:123456789012:instance/n-plus-one-{index}",
+                name=f"N+1 Instance {index}",
+                region="us-east-1",
+                service="ec2",
+                type="prowler-test",
+            )
+            resource.upsert_or_delete_tags(
+                [
+                    ResourceTag.objects.create(
+                        tenant_id=tenant_id,
+                        key=f"key-{index}",
+                        value=f"value-{index}",
+                    )
+                ]
+            )
+            finding = Finding.objects.create(
+                tenant_id=tenant_id,
+                uid=f"n_plus_one_finding_{index}",
+                scan=scan,
+                status=Status.FAIL,
+                status_extended="n+1 status",
+                impact=Severity.medium,
+                severity=Severity.medium,
+                check_id="test_check_id",
+                check_metadata={"CheckId": "test_check_id", "servicename": "ec2"},
+                first_seen_at="2024-01-02T00:00:00Z",
+            )
+            finding.add_resources([resource])
+            return finding
+
+        params = {"filter[inserted_at]": TODAY, "include": "resources"}
+
+        # Baseline: the two findings provided by the fixture.
+        with CaptureQueriesContext(connection) as baseline:
+            response = authenticated_client.get(reverse("finding-list"), params)
+        assert response.status_code == status.HTTP_200_OK
+
+        # Add more findings, each with its own resource carrying tags.
+        extra_findings = 5
+        for index in range(extra_findings):
+            _create_finding_with_tagged_resource(index)
+
+        with CaptureQueriesContext(connection) as scaled:
+            response = authenticated_client.get(reverse("finding-list"), params)
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == len(findings_fixture) + extra_findings
+
+        # The query count must not grow with the number of findings/resources.
+        assert len(scaled.captured_queries) == len(baseline.captured_queries), (
+            "Resource tags are not being prefetched: "
+            f"{len(baseline.captured_queries)} queries for {len(findings_fixture)} "
+            f"findings vs {len(scaled.captured_queries)} for "
+            f"{len(findings_fixture) + extra_findings}. Likely an N+1 regression "
+            "in FindingViewSet._optimize_tags_loading."
+        )
+
     @pytest.mark.parametrize(
         "include_values, expected_resources",
         [
@@ -7093,6 +7422,40 @@ class TestFindingViewSet:
         assert response.status_code == status.HTTP_200_OK
         assert len(response.json()["data"]) == 2
 
+    def test_finding_filter_provider_groups(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        findings_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        finding1, finding2, *_ = findings_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=finding1.scan.provider, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=finding1.scan.provider, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("finding-list"),
+            {"filter[inserted_at]": TODAY, "filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 2
+
+        response = authenticated_client.get(
+            reverse("finding-list"),
+            {
+                "filter[inserted_at]": TODAY,
+                "filter[provider_groups__in]": f"{group1.id},{group2.id}",
+            },
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 2
+
     @pytest.mark.parametrize(
         "filter_name",
         (
@@ -9063,6 +9426,118 @@ class TestComplianceOverviewViewSet:
         with patch("api.v1.views.backfill_compliance_summaries_task.delay") as mock:
             yield mock
 
+    def _create_completed_scan(self, provider, name):
+        return Scan.objects.create(
+            name=name,
+            provider=provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=provider.tenant_id,
+            started_at=datetime.now(timezone.utc),
+            completed_at=datetime.now(timezone.utc),
+        )
+
+    def _create_requirement(
+        self,
+        scan,
+        requirement_id,
+        status_choice,
+        region="eu-west-1",
+        compliance_id="cis_1.4_aws",
+    ):
+        passed = 1 if status_choice == StatusChoices.PASS else 0
+        total = 1 if status_choice != StatusChoices.MANUAL else 0
+        return ComplianceRequirementOverview.objects.create(
+            tenant_id=scan.tenant_id,
+            scan=scan,
+            compliance_id=compliance_id,
+            framework="CIS-1.4-AWS",
+            version="1.4",
+            description="CIS AWS Foundations Benchmark v1.4.0",
+            region=region,
+            requirement_id=requirement_id,
+            requirement_status=status_choice,
+            passed_checks=passed,
+            failed_checks=0
+            if status_choice in (StatusChoices.PASS, StatusChoices.MANUAL)
+            else 1,
+            total_checks=total,
+            passed_findings=passed,
+            total_findings=total,
+        )
+
+    def _create_compliance_summary(
+        self,
+        scan,
+        *,
+        passed,
+        failed,
+        manual=0,
+        compliance_id="cis_1.4_aws",
+    ):
+        return ComplianceOverviewSummary.objects.create(
+            tenant_id=scan.tenant_id,
+            scan=scan,
+            compliance_id=compliance_id,
+            requirements_passed=passed,
+            requirements_failed=failed,
+            requirements_manual=manual,
+            total_requirements=passed + failed + manual,
+        )
+
+    def _overview_attrs_by_id(self, response):
+        assert response.status_code == status.HTTP_200_OK
+        return {item["id"]: item["attributes"] for item in response.json()["data"]}
+
+    def _prepare_latest_compliance_data(self, providers_fixture):
+        provider1, provider2, provider3, *_ = providers_fixture
+        old_scan = self._create_completed_scan(provider1, "old aws compliance scan")
+        latest_scan1 = self._create_completed_scan(
+            provider1, "latest aws compliance scan 1"
+        )
+        latest_scan2 = self._create_completed_scan(
+            provider2, "latest aws compliance scan 2"
+        )
+        latest_gcp_scan = self._create_completed_scan(
+            provider3, "latest gcp compliance scan"
+        )
+
+        self._create_requirement(old_scan, "1.1", StatusChoices.FAIL)
+        self._create_requirement(old_scan, "1.2", StatusChoices.FAIL)
+        self._create_compliance_summary(old_scan, passed=0, failed=2)
+
+        self._create_requirement(
+            latest_scan1, "1.1", StatusChoices.PASS, region="eu-west-1"
+        )
+        self._create_requirement(
+            latest_scan1, "1.2", StatusChoices.PASS, region="eu-west-1"
+        )
+        self._create_compliance_summary(latest_scan1, passed=2, failed=0)
+
+        self._create_requirement(
+            latest_scan2, "1.1", StatusChoices.FAIL, region="us-east-1"
+        )
+        self._create_requirement(
+            latest_scan2, "1.2", StatusChoices.PASS, region="us-east-1"
+        )
+        self._create_compliance_summary(latest_scan2, passed=1, failed=1)
+
+        self._create_requirement(
+            latest_gcp_scan,
+            "gcp-1.1",
+            StatusChoices.FAIL,
+            region="europe-west1",
+            compliance_id="cis_1.3_gcp",
+        )
+        self._create_compliance_summary(
+            latest_gcp_scan,
+            passed=0,
+            failed=1,
+            compliance_id="cis_1.3_gcp",
+        )
+
+        return old_scan, latest_scan1, latest_scan2, latest_gcp_scan
+
     def test_compliance_overview_list_none(
         self,
         authenticated_client,
@@ -9210,6 +9685,283 @@ class TestComplianceOverviewViewSet:
         assert len(response.json()["data"]) >= 1
         mock_backfill_task.assert_not_called()
 
+    def test_compliance_overview_provider_id_filter_uses_latest_scan(
+        self,
+        authenticated_client,
+        providers_fixture,
+        mock_backfill_task,
+    ):
+        _, latest_scan, *_ = self._prepare_latest_compliance_data(providers_fixture)
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {"filter[provider_id]": str(latest_scan.provider_id)},
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 2
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 0
+        assert "cis_1.3_gcp" not in attrs_by_id
+        mock_backfill_task.assert_not_called()
+
+    def test_compliance_overview_provider_id_in_filter_aggregates_latest_scans(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        _, latest_scan1, latest_scan2, *_ = self._prepare_latest_compliance_data(
+            providers_fixture
+        )
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {
+                "filter[provider_id__in]": (
+                    f"{latest_scan1.provider_id},{latest_scan2.provider_id}"
+                )
+            },
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["total_requirements"] == 2
+        assert "cis_1.3_gcp" not in attrs_by_id
+
+    def test_compliance_overview_provider_type_filter_uses_latest_scans(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        self._prepare_latest_compliance_data(providers_fixture)
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {"filter[provider_type]": Provider.ProviderChoices.AWS.value},
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["total_requirements"] == 2
+        assert "cis_1.3_gcp" not in attrs_by_id
+
+    def test_compliance_overview_provider_groups_filters_use_latest_scans(
+        self,
+        authenticated_client,
+        providers_fixture,
+        provider_groups_fixture,
+        tenants_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        _, latest_scan1, latest_scan2, *_ = self._prepare_latest_compliance_data(
+            providers_fixture
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id,
+            provider=provider1,
+            provider_group=group1,
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id,
+            provider=provider2,
+            provider_group=group2,
+        )
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {"filter[provider_groups]": str(group1.id)},
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 2
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 0
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["total_requirements"] == 2
+
+    def _assert_latest_provider_scan_task_response(
+        self,
+        authenticated_client,
+        endpoint,
+        scan,
+        query_params=None,
+    ):
+        query_params = {**(query_params or {})}
+        if not any(key.startswith("filter[provider_") for key in query_params):
+            query_params = {
+                "filter[provider_id]": str(scan.provider_id),
+                **query_params,
+            }
+
+        with patch.object(
+            ComplianceOverviewViewSet, "get_task_response_if_running"
+        ) as mock_task_response:
+            mock_task_response.return_value = Response(
+                {"detail": "Task is running"}, status=status.HTTP_202_ACCEPTED
+            )
+
+            response = authenticated_client.get(reverse(endpoint), query_params)
+
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        mock_task_response.assert_called_once()
+        _, kwargs = mock_task_response.call_args
+        assert kwargs["task_name"] == "scan-compliance-overviews"
+        assert str(kwargs["task_kwargs"]["tenant_id"]) == str(scan.tenant_id)
+        assert str(kwargs["task_kwargs"]["scan_id"]) == str(scan.id)
+        assert kwargs["raise_on_not_found"] is False
+
+    def test_compliance_overview_provider_filter_returns_running_task_without_data(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        scan = self._create_completed_scan(
+            providers_fixture[0], "latest scan without compliance data"
+        )
+
+        self._assert_latest_provider_scan_task_response(
+            authenticated_client,
+            "complianceoverview-list",
+            scan,
+        )
+
+    def test_compliance_overview_provider_filter_returns_running_task_for_partial_data(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        provider_with_data, provider_without_data, *_ = providers_fixture
+        scan_with_data = self._create_completed_scan(
+            provider_with_data, "latest scan with compliance data"
+        )
+        scan_without_data = self._create_completed_scan(
+            provider_without_data, "latest scan without partial compliance data"
+        )
+        self._create_requirement(scan_with_data, "1.1", StatusChoices.PASS)
+
+        self._assert_latest_provider_scan_task_response(
+            authenticated_client,
+            "complianceoverview-list",
+            scan_without_data,
+            {
+                "filter[provider_id__in]": (
+                    f"{provider_with_data.id},{provider_without_data.id}"
+                )
+            },
+        )
+
+    def test_compliance_overview_provider_filter_empty_response_uses_scan_data_presence(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        scan = self._create_completed_scan(
+            providers_fixture[0], "latest scan with filtered compliance data"
+        )
+        self._create_requirement(scan, "1.1", StatusChoices.PASS, region="eu-west-1")
+
+        with patch.object(
+            ComplianceOverviewViewSet, "get_task_response_if_running"
+        ) as mock_task_response:
+            mock_task_response.return_value = Response(
+                {"detail": "Task is running"}, status=status.HTTP_202_ACCEPTED
+            )
+
+            response = authenticated_client.get(
+                reverse("complianceoverview-list"),
+                {
+                    "filter[provider_id]": str(scan.provider_id),
+                    "filter[region]": "us-east-1",
+                },
+            )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json()["data"] == []
+        mock_task_response.assert_not_called()
+
+    def test_compliance_overview_metadata_provider_filter_returns_running_task_without_data(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        scan = self._create_completed_scan(
+            providers_fixture[0], "latest scan without compliance metadata"
+        )
+
+        self._assert_latest_provider_scan_task_response(
+            authenticated_client,
+            "complianceoverview-metadata",
+            scan,
+        )
+
+    def test_compliance_overview_requirements_provider_filter_returns_running_task_without_data(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        scan = self._create_completed_scan(
+            providers_fixture[0], "latest scan without compliance requirements"
+        )
+
+        self._assert_latest_provider_scan_task_response(
+            authenticated_client,
+            "complianceoverview-requirements",
+            scan,
+            {"filter[compliance_id]": "cis_1.4_aws"},
+        )
+
+    def test_compliance_overview_metadata_accepts_provider_filters(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        _, latest_scan, *_ = self._prepare_latest_compliance_data(providers_fixture)
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-metadata"),
+            {"filter[provider_id]": str(latest_scan.provider_id)},
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        regions = response.json()["data"]["attributes"]["regions"]
+        assert regions == ["eu-west-1"]
+
+    def test_compliance_overview_requirements_accepts_provider_filters(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        _, latest_scan1, latest_scan2, *_ = self._prepare_latest_compliance_data(
+            providers_fixture
+        )
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-requirements"),
+            {
+                "filter[provider_id__in]": (
+                    f"{latest_scan1.provider_id},{latest_scan2.provider_id}"
+                ),
+                "filter[compliance_id]": "cis_1.4_aws",
+            },
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        requirements_by_id = {
+            item["id"]: item["attributes"] for item in response.json()["data"]
+        }
+        assert requirements_by_id["1.1"]["status"] == "FAIL"
+        assert requirements_by_id["1.2"]["status"] == "PASS"
+
     def test_compliance_overview_metadata(
         self, authenticated_client, compliance_requirements_overviews_fixture
     ):
@@ -9345,6 +10097,198 @@ class TestComplianceOverviewViewSet:
             assert "platforms" in attributes["attributes"]["technique_details"]
             assert "technique_url" in attributes["attributes"]["technique_details"]
 
+            # Guard against the `_raw_attributes` wrapper leaking through —
+            # the UI reads metadata[i].Category / .AWSService directly.
+            metadata = attributes["attributes"]["metadata"]
+            assert isinstance(metadata, list) and len(metadata) > 0
+            first_attr = metadata[0]
+            assert isinstance(first_attr, dict)
+            assert "_raw_attributes" not in first_attr
+            assert "Category" in first_attr
+            assert "AWSService" in first_attr
+
+    def test_compliance_overview_attributes_resolves_provider_from_scan(
+        self, authenticated_client, tenants_fixture, providers_fixture
+    ):
+        # csa_ccm_4.0 is a multi-provider universal framework: a single
+        # compliance_id whose requirements expose different checks per provider.
+        # Passing a scan must return the check IDs for that scan's provider,
+        # otherwise the endpoint defaults to the first provider that declares the
+        # framework and azure/gcp requirements end up with check IDs that match
+        # no findings.
+        tenant = tenants_fixture[0]
+        gcp_provider = providers_fixture[2]
+        azure_provider = providers_fixture[4]
+        assert gcp_provider.provider == Provider.ProviderChoices.GCP.value
+        assert azure_provider.provider == Provider.ProviderChoices.AZURE.value
+
+        now = datetime.now(timezone.utc)
+        gcp_scan = Scan.objects.create(
+            name="gcp scan",
+            provider=gcp_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+        azure_scan = Scan.objects.create(
+            name="azure scan",
+            provider=azure_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+
+        def request_attributes(scan_id=None):
+            params = {"filter[compliance_id]": "csa_ccm_4.0"}
+            if scan_id is not None:
+                params["filter[scan_id]"] = str(scan_id)
+            return authenticated_client.get(
+                reverse("complianceoverview-attributes"), params
+            )
+
+        def collect_check_ids(scan_id=None):
+            response = request_attributes(scan_id)
+            assert response.status_code == status.HTTP_200_OK
+            check_ids = set()
+            for item in response.json()["data"]:
+                check_ids.update(item["attributes"]["attributes"]["check_ids"])
+            return check_ids
+
+        gcp_check_ids = collect_check_ids(gcp_scan.id)
+        azure_check_ids = collect_check_ids(azure_scan.id)
+
+        # Each scan resolves to its own provider's checks, and they differ.
+        assert gcp_check_ids
+        assert azure_check_ids
+        assert gcp_check_ids != azure_check_ids
+
+        # The returned check IDs belong to the SDK's per-provider definition.
+        from api.compliance import get_prowler_provider_compliance
+
+        def expected_check_ids(provider_type):
+            framework = get_prowler_provider_compliance(provider_type)["csa_ccm_4.0"]
+            expected = set()
+            for requirement in framework.requirements:
+                expected.update(requirement.checks.get(provider_type, []))
+            return expected
+
+        assert gcp_check_ids <= expected_check_ids(Provider.ProviderChoices.GCP.value)
+        assert azure_check_ids <= expected_check_ids(
+            Provider.ProviderChoices.AZURE.value
+        )
+
+        # An explicit scan_id is authoritative: a non-existent scan must fail
+        # closed with 404 instead of silently falling back to another provider.
+        missing_response = request_attributes("00000000-0000-0000-0000-000000000000")
+        assert missing_response.status_code == status.HTTP_404_NOT_FOUND
+
+        # A malformed scan_id is rejected with 404 as well.
+        malformed_response = request_attributes("not-a-uuid")
+        assert malformed_response.status_code == status.HTTP_404_NOT_FOUND
+
+        # An empty value (filter[scan_id]=) must not fall back to the legacy
+        # provider picker: the explicit (if blank) selector fails closed.
+        empty_response = request_attributes("")
+        assert empty_response.status_code == status.HTTP_404_NOT_FOUND
+
+        # A scan belonging to another tenant is not visible (RLS), so it must
+        # return 404 rather than leaking the fallback provider's check IDs.
+        other_tenant = Tenant.objects.create(name="Other Compliance Tenant")
+        foreign_provider = Provider.objects.create(
+            provider="gcp",
+            uid="foreign-gcp-test",
+            alias="foreign_gcp",
+            tenant_id=other_tenant.id,
+        )
+        foreign_scan = Scan.objects.create(
+            name="foreign scan",
+            provider=foreign_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=other_tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+        foreign_response = request_attributes(foreign_scan.id)
+        assert foreign_response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_compliance_overview_attributes_scan_scoped_by_provider_group(
+        self,
+        authenticated_client_no_permissions_rbac,
+        providers_fixture,
+    ):
+        # A user with limited visibility (no UNLIMITED_VISIBILITY) must only be
+        # able to resolve scans for providers in its provider groups. Tenant RLS
+        # alone is not enough here: both scans belong to the same tenant, so the
+        # endpoint has to scope the scan lookup by provider group, otherwise a
+        # restricted user could read another provider's compliance metadata.
+        client = authenticated_client_no_permissions_rbac
+        limited_user = client.user
+        membership = Membership.objects.filter(user=limited_user).first()
+        tenant = membership.tenant
+
+        allowed_provider = providers_fixture[2]
+        denied_provider = providers_fixture[4]
+        assert allowed_provider.provider == Provider.ProviderChoices.GCP.value
+        assert denied_provider.provider == Provider.ProviderChoices.AZURE.value
+
+        provider_group = ProviderGroup.objects.create(
+            name="limited-compliance-group",
+            tenant_id=tenant.id,
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id,
+            provider_group=provider_group,
+            provider=allowed_provider,
+        )
+        RoleProviderGroupRelationship.objects.create(
+            tenant_id=tenant.id,
+            role=limited_user.roles.first(),
+            provider_group=provider_group,
+        )
+
+        now = datetime.now(timezone.utc)
+        allowed_scan = Scan.objects.create(
+            name="allowed scan",
+            provider=allowed_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+        denied_scan = Scan.objects.create(
+            name="denied scan",
+            provider=denied_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+
+        def request_attributes(scan_id):
+            return client.get(
+                reverse("complianceoverview-attributes"),
+                {
+                    "filter[compliance_id]": "csa_ccm_4.0",
+                    "filter[scan_id]": str(scan_id),
+                },
+            )
+
+        # The scan in the user's provider group resolves normally.
+        assert request_attributes(allowed_scan.id).status_code == status.HTTP_200_OK
+
+        # The scan outside the user's provider group is invisible, so it fails
+        # closed with 404 instead of leaking the other provider's check IDs.
+        assert (
+            request_attributes(denied_scan.id).status_code == status.HTTP_404_NOT_FOUND
+        )
+
     def test_compliance_overview_attributes_missing_compliance_id(
         self, authenticated_client
     ):
@@ -9353,6 +10297,39 @@ class TestComplianceOverviewViewSet:
         )
         assert response.status_code == status.HTTP_400_BAD_REQUEST
 
+    def test_compliance_overview_attributes_503_while_warming(
+        self, authenticated_client
+    ):
+        from api.compliance import COMPLIANCE_WARMED, COMPLIANCE_WARMING_STARTED
+
+        COMPLIANCE_WARMING_STARTED.set()
+        COMPLIANCE_WARMED.clear()
+        try:
+            response = authenticated_client.get(
+                reverse("complianceoverview-attributes"),
+                {"filter[compliance_id]": "aws_account_security_onboarding_aws"},
+            )
+        finally:
+            COMPLIANCE_WARMING_STARTED.clear()
+
+        assert response.status_code == status.HTTP_503_SERVICE_UNAVAILABLE
+        assert response.json()["errors"][0]["code"] == "compliance_warming"
+
+    def test_compliance_overview_attributes_serves_when_warming_not_started(
+        self, authenticated_client
+    ):
+        # Dev fallback: under runserver warming never runs, so the guard must
+        # not refuse — the endpoint lazily loads and serves as before.
+        from api.compliance import COMPLIANCE_WARMED, COMPLIANCE_WARMING_STARTED
+
+        COMPLIANCE_WARMING_STARTED.clear()
+        COMPLIANCE_WARMED.clear()
+        response = authenticated_client.get(
+            reverse("complianceoverview-attributes"),
+            {"filter[compliance_id]": "aws_account_security_onboarding_aws"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+
     def test_compliance_overview_task_management_integration(
         self, authenticated_client, compliance_requirements_overviews_fixture
     ):
@@ -9591,6 +10568,40 @@ class TestOverviewViewSet:
         for entry in grouped_data:
             assert "findings" not in entry["attributes"]
 
+    def test_overview_providers_count_applies_limited_visibility(
+        self,
+        authenticated_client_no_permissions_rbac,
+        providers_fixture,
+        provider_groups_fixture,
+        tenants_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        client = authenticated_client_no_permissions_rbac
+        allowed_provider = providers_fixture[2]
+        denied_provider = providers_fixture[4]
+        provider_group = provider_groups_fixture[0]
+
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id,
+            provider_group=provider_group,
+            provider=allowed_provider,
+        )
+        RoleProviderGroupRelationship.objects.create(
+            tenant_id=tenant.id,
+            role=client.user.roles.first(),
+            provider_group=provider_group,
+        )
+
+        response = client.get(reverse("overview-providers-count"))
+
+        assert response.status_code == status.HTTP_200_OK
+        aggregated = {
+            entry["id"]: entry["attributes"]["count"]
+            for entry in response.json()["data"]
+        }
+        assert aggregated == {allowed_provider.provider: 1}
+        assert denied_provider.provider not in aggregated
+
     def _create_scan(self, tenant, provider, name, started_at=None):
         scan_started = started_at or datetime.now(timezone.utc) - timedelta(hours=1)
         return Scan.objects.create(
@@ -10138,6 +11149,87 @@ class TestOverviewViewSet:
         assert combined_attributes["muted"] == 3
         assert combined_attributes["total"] == 14
 
+    def test_overview_findings_provider_groups_filter(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        scan1 = Scan.objects.create(
+            name="scan-provider-group-one",
+            provider=provider1,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant=tenant,
+        )
+        scan2 = Scan.objects.create(
+            name="scan-provider-group-two",
+            provider=provider2,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant=tenant,
+        )
+        ScanSummary.objects.create(
+            tenant=tenant,
+            scan=scan1,
+            check_id="check-provider-group-one",
+            service="service-a",
+            severity="high",
+            region="region-a",
+            _pass=5,
+            fail=1,
+            muted=2,
+            total=8,
+        )
+        ScanSummary.objects.create(
+            tenant=tenant,
+            scan=scan2,
+            check_id="check-provider-group-two",
+            service="service-b",
+            severity="medium",
+            region="region-b",
+            _pass=2,
+            fail=3,
+            muted=1,
+            total=6,
+        )
+
+        response = authenticated_client.get(
+            reverse("overview-findings"),
+            {"filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        attributes = response.json()["data"]["attributes"]
+        assert attributes["pass"] == 5
+        assert attributes["fail"] == 1
+        assert attributes["muted"] == 2
+        assert attributes["total"] == 8
+
+        response = authenticated_client.get(
+            reverse("overview-findings"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        attributes = response.json()["data"]["attributes"]
+        assert attributes["pass"] == 7
+        assert attributes["fail"] == 4
+        assert attributes["muted"] == 3
+        assert attributes["total"] == 14
+
     def test_overview_findings_severity_provider_id_in_filter(
         self, authenticated_client, tenants_fixture, providers_fixture
     ):
@@ -10906,9 +11998,21 @@ class TestOverviewViewSet:
     @pytest.mark.parametrize(
         "filter_key,filter_value_fn,expected_total,expected_failed",
         [
-            ("filter[provider_id]", lambda p1, _: str(p1.id), 10, 5),
+            ("filter[provider_id]", lambda p1, *_: str(p1.id), 10, 5),
             ("filter[provider_type]", lambda *_: "aws", 10, 5),
             ("filter[provider_type__in]", lambda *_: "aws,gcp", 30, 20),
+            (
+                "filter[provider_groups]",
+                lambda p1, _, group1, __: str(group1.id),
+                10,
+                5,
+            ),
+            (
+                "filter[provider_groups__in]",
+                lambda p1, _, group1, group2: f"{group1.id},{group2.id}",
+                30,
+                20,
+            ),
         ],
     )
     def test_overview_categories_filters(
@@ -10916,6 +12020,7 @@ class TestOverviewViewSet:
         authenticated_client,
         tenants_fixture,
         providers_fixture,
+        provider_groups_fixture,
         create_scan_category_summary,
         filter_key,
         filter_value_fn,
@@ -10924,6 +12029,16 @@ class TestOverviewViewSet:
     ):
         tenant = tenants_fixture[0]
         provider1, _, gcp_provider, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=gcp_provider, provider_group=group2
+        )
 
         scan1 = Scan.objects.create(
             name="categories-scan-1",
@@ -10949,7 +12064,7 @@ class TestOverviewViewSet:
 
         response = authenticated_client.get(
             reverse("overview-categories"),
-            {filter_key: filter_value_fn(provider1, gcp_provider)},
+            {filter_key: filter_value_fn(provider1, gcp_provider, group1, group2)},
         )
         assert response.status_code == status.HTTP_200_OK
         data = response.json()["data"]
@@ -11123,10 +12238,22 @@ class TestOverviewViewSet:
     @pytest.mark.parametrize(
         "filter_key,filter_value_fn,expected_total,expected_failed",
         [
-            ("filter[provider_id]", lambda p1, p2: str(p1.id), 10, 5),
-            ("filter[provider_id__in]", lambda p1, p2: f"{p1.id},{p2.id}", 25, 12),
-            ("filter[provider_type]", lambda p1, p2: "aws", 10, 5),
-            ("filter[provider_type__in]", lambda p1, p2: "aws,gcp", 25, 12),
+            ("filter[provider_id]", lambda p1, *_: str(p1.id), 10, 5),
+            ("filter[provider_id__in]", lambda p1, p2, *_: f"{p1.id},{p2.id}", 25, 12),
+            ("filter[provider_type]", lambda *_: "aws", 10, 5),
+            ("filter[provider_type__in]", lambda *_: "aws,gcp", 25, 12),
+            (
+                "filter[provider_groups]",
+                lambda p1, p2, group1, group2: str(group1.id),
+                10,
+                5,
+            ),
+            (
+                "filter[provider_groups__in]",
+                lambda p1, p2, group1, group2: f"{group1.id},{group2.id}",
+                25,
+                12,
+            ),
         ],
     )
     def test_overview_groups_provider_filters(
@@ -11134,6 +12261,7 @@ class TestOverviewViewSet:
         authenticated_client,
         tenants_fixture,
         providers_fixture,
+        provider_groups_fixture,
         create_scan_resource_group_summary,
         filter_key,
         filter_value_fn,
@@ -11143,6 +12271,16 @@ class TestOverviewViewSet:
         tenant = tenants_fixture[0]
         provider1 = providers_fixture[0]  # AWS
         gcp_provider = providers_fixture[2]  # GCP
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=gcp_provider, provider_group=group2
+        )
 
         scan1 = Scan.objects.create(
             name="aws-rg-scan",
@@ -11168,7 +12306,7 @@ class TestOverviewViewSet:
 
         response = authenticated_client.get(
             reverse("overview-resource-groups"),
-            {filter_key: filter_value_fn(provider1, gcp_provider)},
+            {filter_key: filter_value_fn(provider1, gcp_provider, group1, group2)},
         )
         assert response.status_code == status.HTTP_200_OK
         data = response.json()["data"]
@@ -11343,6 +12481,49 @@ class TestOverviewViewSet:
         data = response.json()["data"]
         assert len(data) >= 1
 
+    def test_compliance_watchlist_provider_groups_filter(
+        self,
+        authenticated_client,
+        provider_compliance_scores_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+        tenants_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("overview-compliance-watchlist"),
+            {"filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        by_id = {item["id"]: item["attributes"] for item in data}
+        assert by_id["aws_cis_2.0"]["requirements_passed"] == 1
+        assert by_id["aws_cis_2.0"]["requirements_failed"] == 1
+        assert by_id["aws_cis_2.0"]["requirements_manual"] == 1
+
+        response = authenticated_client.get(
+            reverse("overview-compliance-watchlist"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        by_id = {item["id"]: item["attributes"] for item in data}
+        assert by_id["aws_cis_2.0"]["requirements_passed"] == 0
+        assert by_id["aws_cis_2.0"]["requirements_failed"] == 2
+        assert by_id["aws_cis_2.0"]["requirements_manual"] == 1
+
     def test_compliance_watchlist_empty_result(self, authenticated_client):
         response = authenticated_client.get(reverse("overview-compliance-watchlist"))
         assert response.status_code == status.HTTP_200_OK
@@ -12400,7 +13581,7 @@ class TestTenantFinishACSView:
                 "firstName": ["John"],
                 "lastName": ["Doe"],
                 "organization": ["testing_company"],
-                "userType": ["no_permissions"],
+                "userType": ["platform_team"],
             },
         )
 
@@ -12455,12 +13636,21 @@ class TestTenantFinishACSView:
         assert user.name == "John Doe"
         assert user.company_name == "testing_company"
 
-        role = Role.objects.using(MainRouter.admin_db).get(name="no_permissions")
+        role = Role.objects.using(MainRouter.admin_db).get(
+            name="platform_team", tenant=tenants_fixture[0]
+        )
         assert role.tenant == tenants_fixture[0]
+        assert not role.manage_users
+        assert not role.manage_account
+        assert not role.manage_billing
+        assert not role.manage_providers
+        assert not role.manage_integrations
+        assert not role.manage_scans
+        assert role.unlimited_visibility
 
         assert (
             UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(user=user, tenant_id=tenants_fixture[0].id)
+            .filter(user=user, role=role, tenant_id=tenants_fixture[0].id)
             .exists()
         )
 
@@ -12513,7 +13703,7 @@ class TestTenantFinishACSView:
             assert response.status_code == 302
             assert "sso_saml_failed=true" in response.url
 
-    def test_dispatch_skips_role_mapping_when_single_manage_account_user(
+    def test_dispatch_keeps_existing_roles_when_usertype_missing(
         self,
         create_test_user,
         tenants_fixture,
@@ -12522,7 +13712,7 @@ class TestTenantFinishACSView:
         settings,
         monkeypatch,
     ):
-        """Test that role mapping is skipped when tenant has only one user with MANAGE_ACCOUNT role"""
+        """Test that roles are left untouched when the IdP does not send userType"""
         monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
         user = create_test_user
         tenant = tenants_fixture[0]
@@ -12531,6 +13721,7 @@ class TestTenantFinishACSView:
         UserRoleRelationship.objects.using(MainRouter.admin_db).create(
             user=user, role=admin_role, tenant_id=tenant.id
         )
+        roles_before = Role.objects.using(MainRouter.admin_db).count()
 
         social_account = SocialAccount(
             user=user,
@@ -12539,7 +13730,6 @@ class TestTenantFinishACSView:
                 "firstName": ["John"],
                 "lastName": ["Doe"],
                 "organization": ["testing_company"],
-                "userType": ["no_permissions"],  # This should be ignored
             },
         )
 
@@ -12577,24 +13767,162 @@ class TestTenantFinishACSView:
 
         assert response.status_code == 302
 
-        # Verify the admin role is still assigned (not changed to no_permissions)
+        # Verify the existing role assignment was not modified
         assert (
             UserRoleRelationship.objects.using(MainRouter.admin_db)
             .filter(user=user, role=admin_role, tenant_id=tenant.id)
             .exists()
         )
 
-        # Verify no_permissions role was NOT created in the database
-        assert (
-            not Role.objects.using(MainRouter.admin_db)
-            .filter(name="no_permissions", tenant=tenant)
+        # Verify no new role was created
+        assert Role.objects.using(MainRouter.admin_db).count() == roles_before
+
+    def test_dispatch_assigns_no_role_to_new_user_when_usertype_missing(
+        self,
+        create_test_user,
+        tenants_fixture,
+        saml_setup,
+        settings,
+        monkeypatch,
+    ):
+        """Test that a user without roles gets none assigned when userType is missing"""
+        monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
+        user = create_test_user
+        tenant = tenants_fixture[0]
+        roles_before = Role.objects.using(MainRouter.admin_db).count()
+
+        social_account = SocialAccount(
+            user=user,
+            provider="saml",
+            extra_data={
+                "firstName": ["John"],
+                "lastName": ["Doe"],
+                "organization": ["testing_company"],
+            },
+        )
+
+        request = RequestFactory().get(
+            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+        )
+        request.user = user
+        request.session = {}
+
+        with (
+            patch(
+                "allauth.socialaccount.providers.saml.views.get_app_or_404"
+            ) as mock_get_app_or_404,
+            patch(
+                "allauth.socialaccount.models.SocialApp.objects.get"
+            ) as mock_socialapp_get,
+            patch(
+                "allauth.socialaccount.models.SocialAccount.objects.get"
+            ) as mock_sa_get,
+            patch("api.models.SAMLDomainIndex.objects.get") as mock_saml_domain_get,
+            patch("api.models.SAMLConfiguration.objects.get") as mock_saml_config_get,
+            patch("api.models.User.objects.get") as mock_user_get,
+        ):
+            mock_get_app_or_404.return_value = MagicMock(
+                provider="saml", client_id="testtenant", name="Test App", settings={}
+            )
+            mock_sa_get.return_value = social_account
+            mock_socialapp_get.return_value = MagicMock(provider_id="saml")
+            mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
+            mock_saml_config_get.return_value = MagicMock()
+            mock_user_get.return_value = user
+
+            view = TenantFinishACSView.as_view()
+            response = view(request, organization_slug="testtenant")
+
+        assert response.status_code == 302
+
+        # Verify no role was created or assigned
+        assert Role.objects.using(MainRouter.admin_db).count() == roles_before
+        assert not (
+            UserRoleRelationship.objects.using(MainRouter.admin_db)
+            .filter(user=user, tenant_id=tenant.id)
             .exists()
         )
 
-        # Verify no_permissions role was NOT assigned to the user
-        assert not (
+        # Membership is still created so the user belongs to the tenant
+        assert (
+            Membership.objects.using(MainRouter.admin_db)
+            .filter(user=user, tenant=tenant)
+            .exists()
+        )
+
+    def test_dispatch_skips_role_mapping_when_last_manage_account_user_maps_to_new_role(
+        self,
+        create_test_user,
+        tenants_fixture,
+        admin_role_fixture,
+        saml_setup,
+        settings,
+        monkeypatch,
+    ):
+        """Test that a new read-only role is neither created nor assigned if it would remove the last MANAGE_ACCOUNT user"""
+        monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
+        user = create_test_user
+        tenant = tenants_fixture[0]
+
+        admin_role = admin_role_fixture
+        UserRoleRelationship.objects.using(MainRouter.admin_db).create(
+            user=user, role=admin_role, tenant_id=tenant.id
+        )
+
+        social_account = SocialAccount(
+            user=user,
+            provider="saml",
+            extra_data={
+                "firstName": ["John"],
+                "lastName": ["Doe"],
+                "organization": ["testing_company"],
+                "userType": ["brand_new_role"],
+            },
+        )
+
+        request = RequestFactory().get(
+            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+        )
+        request.user = user
+        request.session = {}
+
+        with (
+            patch(
+                "allauth.socialaccount.providers.saml.views.get_app_or_404"
+            ) as mock_get_app_or_404,
+            patch(
+                "allauth.socialaccount.models.SocialApp.objects.get"
+            ) as mock_socialapp_get,
+            patch(
+                "allauth.socialaccount.models.SocialAccount.objects.get"
+            ) as mock_sa_get,
+            patch("api.models.SAMLDomainIndex.objects.get") as mock_saml_domain_get,
+            patch("api.models.SAMLConfiguration.objects.get") as mock_saml_config_get,
+            patch("api.models.User.objects.get") as mock_user_get,
+        ):
+            mock_get_app_or_404.return_value = MagicMock(
+                provider="saml", client_id="testtenant", name="Test App", settings={}
+            )
+            mock_sa_get.return_value = social_account
+            mock_socialapp_get.return_value = MagicMock(provider_id="saml")
+            mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
+            mock_saml_config_get.return_value = MagicMock()
+            mock_user_get.return_value = user
+
+            view = TenantFinishACSView.as_view()
+            response = view(request, organization_slug="testtenant")
+
+        assert response.status_code == 302
+
+        # The admin role is still assigned and the new role was not created
+        assert (
             UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(user=user, role__name="no_permissions", tenant_id=tenant.id)
+            .filter(user=user, role=admin_role, tenant_id=tenant.id)
+            .exists()
+        )
+        assert (
+            not Role.objects.using(MainRouter.admin_db)
+            .filter(name="brand_new_role", tenant=tenant)
             .exists()
         )
 
@@ -16495,6 +17823,44 @@ class TestFindingGroupViewSet:
         # All fixture findings are from AWS provider
         assert len(response.json()["data"]) == 5
 
+    def test_finding_groups_provider_groups_filter(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        finding_groups_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("finding-group-list"),
+            {"filter[inserted_at]": TODAY, "filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 4
+
+        response = authenticated_client.get(
+            reverse("finding-group-list"),
+            {
+                "filter[inserted_at]": TODAY,
+                "filter[provider_groups__in]": f"{group1.id},{group2.id}",
+            },
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 5
+
     def test_finding_groups_check_id_filter(
         self, authenticated_client, finding_groups_fixture
     ):
@@ -17405,6 +18771,41 @@ class TestFindingGroupViewSet:
         # All providers in fixture are AWS
         assert len(data) == 5
 
+    def test_finding_groups_latest_provider_groups_filter(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        finding_groups_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("finding-group-latest"),
+            {"filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 4
+
+        response = authenticated_client.get(
+            reverse("finding-group-latest"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 5
+
     def test_finding_groups_latest_check_id_filter(
         self, authenticated_client, finding_groups_fixture
     ):
diff --git a/api/src/backend/api/utils.py b/api/src/backend/api/utils.py
index 8da8d91226..678ed24772 100644
--- a/api/src/backend/api/utils.py
+++ b/api/src/backend/api/utils.py
@@ -243,6 +243,12 @@ def get_prowler_provider_kwargs(
             **prowler_provider_kwargs,
             "filter_accounts": [provider.uid],
         }
+    elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+        if isinstance(prowler_provider_kwargs.get("region"), str):
+            prowler_provider_kwargs = {
+                **prowler_provider_kwargs,
+                "region": {prowler_provider_kwargs["region"]},
+            }
     elif provider.provider == Provider.ProviderChoices.OPENSTACK.value:
         # clouds_yaml_content, clouds_yaml_cloud and provider_id are validated
         # in the provider itself, so it's not needed here.
diff --git a/api/src/backend/api/v1/mixins.py b/api/src/backend/api/v1/mixins.py
index e1a5d3470f..849c788366 100644
--- a/api/src/backend/api/v1/mixins.py
+++ b/api/src/backend/api/v1/mixins.py
@@ -1,6 +1,10 @@
+import uuid
+
+from django.http import QueryDict
 from django.urls import reverse
 from django_celery_results.models import TaskResult
 from rest_framework import status
+from rest_framework.exceptions import ValidationError
 from rest_framework.response import Response
 
 from api.exceptions import (
@@ -8,7 +12,7 @@ from api.exceptions import (
     TaskInProgressException,
     TaskNotFoundException,
 )
-from api.models import StateChoices, Task
+from api.models import Provider, StateChoices, Task
 from api.v1.serializers import TaskSerializer
 
 
@@ -74,6 +78,162 @@ class PaginateByPkMixin:
         return self.get_paginated_response(serialized)
 
 
+class JsonApiFilterMixin:
+    """Shared helpers for manually applying django-filter to JSON:API params."""
+
+    jsonapi_filter_replace_dots = False
+
+    def _normalize_jsonapi_params(
+        self,
+        query_params,
+        exclude_keys=None,
+        replace_dots=None,
+    ):
+        exclude_keys = exclude_keys or set()
+        if replace_dots is None:
+            replace_dots = self.jsonapi_filter_replace_dots
+
+        normalized = QueryDict(mutable=True)
+        for key, values in query_params.lists():
+            normalized_key = (
+                key[7:-1] if key.startswith("filter[") and key.endswith("]") else key
+            )
+            if replace_dots:
+                normalized_key = normalized_key.replace(".", "__")
+            if normalized_key not in exclude_keys:
+                normalized.setlist(normalized_key, values)
+        return normalized
+
+    def _apply_filterset(
+        self,
+        queryset,
+        filterset_class,
+        exclude_keys=None,
+        replace_dots=None,
+    ):
+        normalized_params = self._normalize_jsonapi_params(
+            self.request.query_params,
+            exclude_keys=set(exclude_keys or []),
+            replace_dots=replace_dots,
+        )
+        filterset = filterset_class(normalized_params, queryset=queryset)
+        if not filterset.is_valid():
+            raise ValidationError(filterset.errors)
+        return filterset.qs
+
+
+class ProviderFilterParamsMixin(JsonApiFilterMixin):
+    """Shared extraction of provider filters from JSON:API query params."""
+
+    PROVIDER_FILTER_KEYS = frozenset(
+        {
+            "provider_id",
+            "provider_id__in",
+            "provider_type",
+            "provider_type__in",
+            "provider_groups",
+            "provider_groups__in",
+        }
+    )
+    PROVIDER_FILTER_DOT_ALIAS_KEYS = frozenset(
+        {
+            "provider_id.in",
+            "provider_type.in",
+            "provider_groups.in",
+        }
+    )
+    PROVIDER_FILTER_QUERY_KEYS = PROVIDER_FILTER_KEYS | PROVIDER_FILTER_DOT_ALIAS_KEYS
+
+    def _csv_filter_values(self, value):
+        return [item.strip() for item in value.split(",") if item.strip()]
+
+    def _validate_uuid_filter_values(self, field_name, values):
+        try:
+            for value in values:
+                uuid.UUID(str(value))
+        except (TypeError, ValueError, AttributeError):
+            raise ValidationError({field_name: ["Enter a valid UUID."]})
+
+    def _has_provider_filters(self, include_dot_aliases=False):
+        provider_filter_keys = (
+            self.PROVIDER_FILTER_QUERY_KEYS
+            if include_dot_aliases
+            else self.PROVIDER_FILTER_KEYS
+        )
+        return any(
+            self.request.query_params.get(f"filter[{key}]")
+            for key in provider_filter_keys
+        )
+
+    def _extract_provider_filters_from_params(
+        self,
+        *,
+        validate_uuids=False,
+        include_dot_aliases=False,
+    ):
+        params = self.request.query_params
+        filters = {}
+        valid_provider_types = {
+            choice[0] for choice in Provider.ProviderChoices.choices
+        }
+
+        provider_id = params.get("filter[provider_id]")
+        if provider_id:
+            if validate_uuids:
+                self._validate_uuid_filter_values("provider_id", [provider_id])
+            filters["provider_id"] = provider_id
+
+        provider_id_in = params.get("filter[provider_id__in]")
+        if include_dot_aliases:
+            provider_id_in = provider_id_in or params.get("filter[provider_id.in]")
+        if provider_id_in:
+            values = self._csv_filter_values(provider_id_in)
+            if validate_uuids:
+                self._validate_uuid_filter_values("provider_id__in", values)
+            filters["provider_id__in"] = values
+
+        provider_type = params.get("filter[provider_type]")
+        if provider_type:
+            if provider_type not in valid_provider_types:
+                raise ValidationError(
+                    {"provider_type": f"Invalid choice: {provider_type}"}
+                )
+            filters["provider__provider"] = provider_type
+
+        provider_type_in = params.get("filter[provider_type__in]")
+        if include_dot_aliases:
+            provider_type_in = provider_type_in or params.get(
+                "filter[provider_type.in]"
+            )
+        if provider_type_in:
+            values = self._csv_filter_values(provider_type_in)
+            invalid = [value for value in values if value not in valid_provider_types]
+            if invalid:
+                raise ValidationError(
+                    {"provider_type__in": f"Invalid choices: {', '.join(invalid)}"}
+                )
+            filters["provider__provider__in"] = values
+
+        provider_groups = params.get("filter[provider_groups]")
+        if provider_groups:
+            if validate_uuids:
+                self._validate_uuid_filter_values("provider_groups", [provider_groups])
+            filters["provider__provider_groups__id"] = provider_groups
+
+        provider_groups_in = params.get("filter[provider_groups__in]")
+        if include_dot_aliases:
+            provider_groups_in = provider_groups_in or params.get(
+                "filter[provider_groups.in]"
+            )
+        if provider_groups_in:
+            values = self._csv_filter_values(provider_groups_in)
+            if validate_uuids:
+                self._validate_uuid_filter_values("provider_groups__in", values)
+            filters["provider__provider_groups__id__in"] = values
+
+        return filters
+
+
 class TaskManagementMixin:
     """
     Mixin to manage task status checking.
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 067a0403a3..4cf39cdce1 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -30,6 +30,7 @@ from dj_rest_auth.registration.views import SocialLoginView
 from django.conf import settings as django_settings
 from django.contrib.postgres.aggregates import ArrayAgg, BoolAnd, StringAgg
 from django.contrib.postgres.search import SearchQuery
+from django.core.exceptions import ValidationError as DjangoValidationError
 from django.db import transaction
 from django.db.models import (
     BooleanField,
@@ -114,13 +115,17 @@ from api.attack_paths import get_queries_for_provider, get_query_by_id
 from api.attack_paths import views_helpers as attack_paths_views_helpers
 from api.base_views import BaseRLSViewSet, BaseTenantViewset, BaseUserViewset
 from api.compliance import (
+    COMPLIANCE_WARMED,
+    COMPLIANCE_WARMING_STARTED,
     PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE,
     get_compliance_frameworks,
+    get_prowler_provider_compliance,
 )
 from api.constants import SEVERITY_ORDER
 from api.db_router import MainRouter
 from api.db_utils import rls_transaction
 from api.exceptions import (
+    ComplianceWarmingError,
     TaskFailedException,
     UpstreamAccessDeniedError,
     UpstreamAuthenticationError,
@@ -223,7 +228,13 @@ from api.utils import (
     validate_invitation,
 )
 from api.uuid_utils import datetime_to_uuid7, uuid7_start
-from api.v1.mixins import DisablePaginationMixin, PaginateByPkMixin, TaskManagementMixin
+from api.v1.mixins import (
+    DisablePaginationMixin,
+    JsonApiFilterMixin,
+    PaginateByPkMixin,
+    ProviderFilterParamsMixin,
+    TaskManagementMixin,
+)
 from api.v1.serializers import (
     AttackPathsCartographySchemaSerializer,
     AttackPathsCustomQueryRunRequestSerializer,
@@ -796,60 +807,70 @@ class TenantFinishACSView(FinishACSView):
             .tenant
         )
 
+        # Only remap roles when the IdP provides a userType attribute.
+        # Without it, the user's current roles are left untouched.
         role_name = (
-            extra.get("userType", ["no_permissions"])[0].strip()
-            if extra.get("userType")
-            else "no_permissions"
+            extra.get("userType", [""])[0].strip() if extra.get("userType") else ""
         )
-        role = (
-            Role.objects.using(MainRouter.admin_db)
-            .filter(name=role_name, tenant=tenant)
-            .first()
-        )
-
-        # Only skip mapping if it would remove the last MANAGE_ACCOUNT user
-        remaining_manage_account_users = (
-            UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(role__manage_account=True, tenant_id=tenant.id)
-            .exclude(user_id=user_id)
-            .values("user")
-            .distinct()
-            .count()
-        )
-        user_has_manage_account = (
-            UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(role__manage_account=True, tenant_id=tenant.id, user_id=user_id)
-            .exists()
-        )
-        role_manage_account = role.manage_account if role else False
-        would_remove_last_manage_account = (
-            user_has_manage_account
-            and remaining_manage_account_users == 0
-            and not role_manage_account
-        )
-
-        if not would_remove_last_manage_account:
-            if role is None:
-                role = Role.objects.using(MainRouter.admin_db).create(
-                    name=role_name,
-                    tenant=tenant,
-                    manage_users=False,
-                    manage_account=False,
-                    manage_billing=False,
-                    manage_providers=False,
-                    manage_integrations=False,
-                    manage_scans=False,
-                    unlimited_visibility=False,
+        if role_name:
+            with transaction.atomic(using=MainRouter.admin_db):
+                role = (
+                    Role.objects.using(MainRouter.admin_db)
+                    .filter(name=role_name, tenant=tenant)
+                    .first()
                 )
-            UserRoleRelationship.objects.using(MainRouter.admin_db).filter(
-                user=user,
-                tenant_id=tenant.id,
-            ).delete()
-            UserRoleRelationship.objects.using(MainRouter.admin_db).create(
-                user=user,
-                role=role,
-                tenant_id=tenant.id,
-            )
+
+                # Only skip mapping if it would remove the last MANAGE_ACCOUNT user
+                remaining_manage_account_users = (
+                    UserRoleRelationship.objects.using(MainRouter.admin_db)
+                    .filter(role__manage_account=True, tenant_id=tenant.id)
+                    .exclude(user_id=user_id)
+                    .values("user")
+                    .distinct()
+                    .count()
+                )
+                user_has_manage_account = (
+                    UserRoleRelationship.objects.using(MainRouter.admin_db)
+                    .filter(
+                        role__manage_account=True,
+                        tenant_id=tenant.id,
+                        user_id=user_id,
+                    )
+                    .exists()
+                )
+                role_manage_account = role.manage_account if role else False
+                would_remove_last_manage_account = (
+                    user_has_manage_account
+                    and remaining_manage_account_users == 0
+                    and not role_manage_account
+                )
+
+                if not would_remove_last_manage_account:
+                    if role is None:
+                        # Roles auto-created from userType get read-only access:
+                        # visibility over all providers, no management permissions
+                        role, _ = Role.objects.using(MainRouter.admin_db).get_or_create(
+                            name=role_name,
+                            tenant=tenant,
+                            defaults={
+                                "manage_users": False,
+                                "manage_account": False,
+                                "manage_billing": False,
+                                "manage_providers": False,
+                                "manage_integrations": False,
+                                "manage_scans": False,
+                                "unlimited_visibility": True,
+                            },
+                        )
+                    UserRoleRelationship.objects.using(MainRouter.admin_db).filter(
+                        user=user,
+                        tenant_id=tenant.id,
+                    ).delete()
+                    UserRoleRelationship.objects.using(MainRouter.admin_db).create(
+                        user=user,
+                        role=role,
+                        tenant_id=tenant.id,
+                    )
         membership, _ = Membership.objects.using(MainRouter.admin_db).get_or_create(
             user=user,
             tenant=tenant,
@@ -1849,7 +1870,42 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
             200: OpenApiResponse(
                 description="CSV file containing the compliance report"
             ),
-            404: OpenApiResponse(description="Compliance report not found"),
+            202: OpenApiResponse(description="The task is in progress"),
+            403: OpenApiResponse(description="There is a problem with credentials"),
+            404: OpenApiResponse(
+                description="Compliance report not found, or the scan has no reports yet"
+            ),
+        },
+        request=None,
+    ),
+    compliance_ocsf=extend_schema(
+        tags=["Scan"],
+        summary="Retrieve compliance report as OCSF JSON",
+        description=(
+            "Download a specific compliance report as an OCSF JSON file. "
+            "Only universal frameworks that declare an output configuration "
+            "produce this artifact (currently 'dora_2022_2554' and 'csa_ccm_4.0'); any "
+            "other framework returns 404."
+        ),
+        parameters=[
+            OpenApiParameter(
+                name="name",
+                type=str,
+                location=OpenApiParameter.PATH,
+                required=True,
+                description="The compliance report name, like 'dora_2022_2554'",
+            ),
+        ],
+        responses={
+            200: OpenApiResponse(
+                description="OCSF JSON file containing the compliance report"
+            ),
+            202: OpenApiResponse(description="The task is in progress"),
+            403: OpenApiResponse(description="There is a problem with credentials"),
+            404: OpenApiResponse(
+                description="Compliance report not found, the framework does "
+                "not provide an OCSF export, or the scan has no reports yet"
+            ),
         },
         request=None,
     ),
@@ -1992,35 +2048,23 @@ class ScanViewSet(BaseRLSViewSet):
         return queryset.select_related("provider", "task")
 
     def get_serializer_class(self):
-        if self.action == "create":
-            if hasattr(self, "response_serializer_class"):
-                return self.response_serializer_class
-            return ScanCreateSerializer
-        elif self.action == "partial_update":
+        if self.action == "partial_update":
             return ScanUpdateSerializer
-        elif self.action == "report":
-            if hasattr(self, "response_serializer_class"):
-                return self.response_serializer_class
-            return ScanReportSerializer
-        elif self.action == "compliance":
-            if hasattr(self, "response_serializer_class"):
-                return self.response_serializer_class
-            return ScanComplianceReportSerializer
-        elif self.action == "threatscore":
-            if hasattr(self, "response_serializer_class"):
-                return self.response_serializer_class
-        elif self.action == "ens":
-            if hasattr(self, "response_serializer_class"):
-                return self.response_serializer_class
-        elif self.action == "nis2":
-            if hasattr(self, "response_serializer_class"):
-                return self.response_serializer_class
-        elif self.action == "csa":
-            if hasattr(self, "response_serializer_class"):
-                return self.response_serializer_class
-        elif self.action == "cis":
+
+        action_defaults = {
+            "create": ScanCreateSerializer,
+            "report": ScanReportSerializer,
+            "compliance": ScanComplianceReportSerializer,
+            "compliance_ocsf": ScanComplianceReportSerializer,
+        }
+        response_only_actions = {"threatscore", "ens", "nis2", "csa", "cis"}
+
+        if self.action in action_defaults or self.action in response_only_actions:
             if hasattr(self, "response_serializer_class"):
                 return self.response_serializer_class
+            if self.action in action_defaults:
+                return action_defaults[self.action]
+
         return super().get_serializer_class()
 
     def partial_update(self, request, *args, **kwargs):
@@ -2059,12 +2103,17 @@ class ScanViewSet(BaseRLSViewSet):
         if scan_instance.state == StateChoices.EXECUTING and scan_instance.task:
             task = scan_instance.task
         else:
-            try:
-                task = Task.objects.get(
+            # A scan can have several `scan-report` tasks (e.g. re-runs); take the
+            # most recent one. `.first()` also avoids `MultipleObjectsReturned`.
+            task = (
+                Task.objects.filter(
                     task_runner_task__task_name="scan-report",
                     task_runner_task__task_kwargs__contains=str(scan_instance.id),
                 )
-            except Task.DoesNotExist:
+                .order_by("-inserted_at")
+                .first()
+            )
+            if task is None:
                 return None
 
         self.response_serializer_class = TaskSerializer
@@ -2139,27 +2188,32 @@ class ScanViewSet(BaseRLSViewSet):
                         status=status.HTTP_502_BAD_GATEWAY,
                     )
                 contents = resp.get("Contents", [])
-                keys = []
+                matches = []
                 for obj in contents:
                     key = obj["Key"]
                     key_basename = os.path.basename(key)
                     if any(ch in suffix for ch in ("*", "?", "[")):
                         if fnmatch.fnmatch(key_basename, suffix):
-                            keys.append(key)
+                            matches.append(obj)
                     elif key_basename == suffix:
-                        keys.append(key)
+                        matches.append(obj)
                     elif key.endswith(suffix):
                         # Backward compatibility if suffix already includes directories
-                        keys.append(key)
-                if not keys:
+                        matches.append(obj)
+                if not matches:
                     return Response(
                         {
                             "detail": f"No compliance file found for name '{os.path.splitext(suffix)[0]}'."
                         },
                         status=status.HTTP_404_NOT_FOUND,
                     )
-                # path_pattern here is prefix, but in compliance we build correct suffix check before
-                key = keys[0]
+                # Return the most recently modified match (latest report) when
+                # several files share the prefix/suffix. `list_objects_v2` always
+                # returns `LastModified`; the fallback keeps ordering deterministic
+                # if it is ever absent.
+                key = max(matches, key=lambda o: (o.get("LastModified", ""), o["Key"]))[
+                    "Key"
+                ]
             else:
                 # path_pattern is exact key; HEAD before presigning to preserve the 404 contract.
                 key = path_pattern
@@ -2209,7 +2263,9 @@ class ScanViewSet(BaseRLSViewSet):
                     },
                     status=status.HTTP_404_NOT_FOUND,
                 )
-            filepath = files[0]
+            # Return the most recently modified match (latest report) when the
+            # pattern resolves to several files.
+            filepath = max(files, key=os.path.getmtime)
             with open(filepath, "rb") as f:
                 content = f.read()
             filename = os.path.basename(filepath)
@@ -2257,20 +2313,16 @@ class ScanViewSet(BaseRLSViewSet):
         content, filename = loader
         return self._serve_file(content, filename, "application/x-zip-compressed")
 
-    @action(
-        detail=True,
-        methods=["get"],
-        url_path="compliance/(?P<name>[^/]+)",
-        url_name="compliance",
-    )
-    def compliance(self, request, pk=None, name=None):
-        scan = self.get_object()
-        if name not in get_compliance_frameworks(scan.provider.provider):
-            return Response(
-                {"detail": f"Compliance '{name}' not found."},
-                status=status.HTTP_404_NOT_FOUND,
-            )
+    def _serve_compliance_artifact(self, scan, name, file_extension, content_type):
+        """Resolve and serve a per-framework compliance artifact from disk/S3.
 
+        Shared by the CSV and OCSF compliance download actions. Both are
+        path-based (no query params) on purpose: ``get_object`` runs
+        ``filter_queryset``, which triggers JSON:API's
+        ``QueryParameterValidationFilter`` and 400s on any non-JSON:API
+        query param, so a ``?format=`` / ``?type=`` selector is not viable
+        here — the format is encoded in the route instead.
+        """
         running_resp = self._get_task_status(scan)
         if running_resp:
             return running_resp
@@ -2287,25 +2339,66 @@ class ScanViewSet(BaseRLSViewSet):
             bucket = env.str("DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET", "")
             key_prefix = scan.output_location.removeprefix(f"s3://{bucket}/")
             prefix = os.path.join(
-                os.path.dirname(key_prefix), "compliance", f"{name}.csv"
+                os.path.dirname(key_prefix), "compliance", f"{name}.{file_extension}"
             )
             loader = self._load_file(
                 prefix,
                 s3=True,
                 bucket=bucket,
                 list_objects=True,
-                content_type="text/csv",
+                content_type=content_type,
             )
         else:
             base = os.path.dirname(scan.output_location)
-            pattern = os.path.join(base, "compliance", f"*_{name}.csv")
+            pattern = os.path.join(base, "compliance", f"*_{name}.{file_extension}")
             loader = self._load_file(pattern, s3=False)
 
         if isinstance(loader, HttpResponseBase):
             return loader
 
         content, filename = loader
-        return self._serve_file(content, filename, "text/csv")
+        return self._serve_file(content, filename, content_type)
+
+    @action(
+        detail=True,
+        methods=["get"],
+        url_path="compliance/(?P<name>[^/]+)",
+        url_name="compliance",
+    )
+    def compliance(self, request, pk=None, name=None):
+        scan = self.get_object()
+        if name not in get_compliance_frameworks(scan.provider.provider):
+            return Response(
+                {"detail": f"Compliance '{name}' not found."},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+        return self._serve_compliance_artifact(scan, name, "csv", "text/csv")
+
+    @action(
+        detail=True,
+        methods=["get"],
+        url_path="compliance/(?P<name>[^/]+)/ocsf",
+        url_name="compliance-ocsf",
+    )
+    def compliance_ocsf(self, request, pk=None, name=None):
+        scan = self.get_object()
+        if name not in get_compliance_frameworks(scan.provider.provider):
+            return Response(
+                {"detail": f"Compliance '{name}' not found."},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+
+        universal_bulk = get_prowler_provider_compliance(scan.provider.provider)
+        framework_obj = universal_bulk.get(name)
+        if not (framework_obj and getattr(framework_obj, "outputs", None)):
+            return Response(
+                {"detail": f"Compliance '{name}' does not provide an OCSF export."},
+                status=status.HTTP_404_NOT_FOUND,
+            )
+
+        return self._serve_compliance_artifact(
+            scan, name, "ocsf.json", "application/json"
+        )
 
     @action(
         detail=True,
@@ -3749,6 +3842,16 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
             return queryset
         return super().filter_queryset(queryset)
 
+    def _optimize_tags_loading(self, queryset):
+        """Prefetch resource tags to avoid N+1 queries when serializing findings"""
+        return queryset.prefetch_related(
+            Prefetch(
+                "resources__tags",
+                queryset=ResourceTag.objects.filter(tenant_id=self.request.tenant_id),
+                to_attr="prefetched_tags",
+            )
+        )
+
     def list(self, request, *args, **kwargs):
         filtered_queryset = self.filter_queryset(self.get_queryset())
         return self.paginate_by_pk(
@@ -4459,15 +4562,19 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
 @extend_schema_view(
     list=extend_schema(
         tags=["Compliance Overview"],
-        summary="List compliance overviews for a scan",
-        description="Retrieve an overview of all the compliance in a given scan.",
+        summary="List compliance overviews",
+        description=(
+            "Retrieve compliance overview data for a scan. When provider filters "
+            "are provided, the endpoint uses the latest completed scan for each "
+            "matching provider."
+        ),
         parameters=[
             OpenApiParameter(
                 name="filter[scan_id]",
-                required=True,
+                required=False,
                 type=OpenApiTypes.UUID,
                 location=OpenApiParameter.QUERY,
-                description="Related scan ID.",
+                description="Related scan ID. Required unless a provider filter is provided.",
             ),
         ],
         responses={
@@ -4482,19 +4589,23 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
                 description="Compliance overviews generation task failed"
             ),
         },
+        filters=True,
     ),
     metadata=extend_schema(
         tags=["Compliance Overview"],
         summary="Retrieve metadata values from compliance overviews",
-        description="Fetch unique metadata values from a set of compliance overviews. This is useful for dynamic "
-        "filtering.",
+        description=(
+            "Fetch unique metadata values from compliance overviews. This is useful "
+            "for dynamic filtering. When provider filters are provided, metadata is "
+            "computed from the latest completed scan for each matching provider."
+        ),
         parameters=[
             OpenApiParameter(
                 name="filter[scan_id]",
-                required=True,
+                required=False,
                 type=OpenApiTypes.UUID,
                 location=OpenApiParameter.QUERY,
-                description="Related scan ID.",
+                description="Related scan ID. Required unless a provider filter is provided.",
             ),
         ],
         responses={
@@ -4509,19 +4620,24 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
                 description="Compliance overviews generation task failed"
             ),
         },
+        filters=True,
     ),
     requirements=extend_schema(
         tags=["Compliance Overview"],
-        summary="List compliance requirements overview for a scan",
-        description="Retrieve a detailed overview of compliance requirements in a given scan, grouped by compliance "
-        "framework. This endpoint provides requirement-level details and aggregates status across regions.",
+        summary="List compliance requirements overview",
+        description=(
+            "Retrieve a detailed overview of compliance requirements, grouped by "
+            "compliance framework. This endpoint provides requirement-level details "
+            "and aggregates status across regions. When provider filters are provided, "
+            "the endpoint uses the latest completed scan for each matching provider."
+        ),
         parameters=[
             OpenApiParameter(
                 name="filter[scan_id]",
-                required=True,
+                required=False,
                 type=OpenApiTypes.UUID,
                 location=OpenApiParameter.QUERY,
-                description="Related scan ID.",
+                description="Related scan ID. Required unless a provider filter is provided.",
             ),
             OpenApiParameter(
                 name="filter[compliance_id]",
@@ -4558,6 +4674,16 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
                 location=OpenApiParameter.QUERY,
                 description="Compliance framework ID to get attributes for.",
             ),
+            OpenApiParameter(
+                name="filter[scan_id]",
+                required=False,
+                type=OpenApiTypes.UUID,
+                location=OpenApiParameter.QUERY,
+                description="Scan ID used to resolve the provider for "
+                "multi-provider universal frameworks (e.g. CSA CCM), so "
+                "the returned check IDs match the scan's provider. When omitted, "
+                "the first provider that declares the framework is used.",
+            ),
         ],
         responses={
             200: OpenApiResponse(
@@ -4570,7 +4696,10 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
 @method_decorator(CACHE_DECORATOR, name="list")
 @method_decorator(CACHE_DECORATOR, name="requirements")
 @method_decorator(CACHE_DECORATOR, name="attributes")
-class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
+class ComplianceOverviewViewSet(
+    ProviderFilterParamsMixin, BaseRLSViewSet, TaskManagementMixin
+):
+    jsonapi_filter_replace_dots = True
     pagination_class = ComplianceOverviewPagination
     queryset = ComplianceRequirementOverview.objects.all()
     serializer_class = ComplianceOverviewSerializer
@@ -4584,28 +4713,22 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
     required_permissions = []
 
     def get_queryset(self):
+        if getattr(self, "swagger_fake_view", False):
+            return ComplianceRequirementOverview.objects.none()
+
         role = get_role(self.request.user, self.request.tenant_id)
         unlimited_visibility = getattr(
             role, Permissions.UNLIMITED_VISIBILITY.value, False
         )
 
-        if unlimited_visibility:
-            base_queryset = self.filter_queryset(
-                ComplianceRequirementOverview.objects.filter(
-                    tenant_id=self.request.tenant_id
-                )
-            )
-        else:
-            providers = Provider.objects.filter(
-                provider_groups__in=role.provider_groups.all()
-            ).distinct()
-            base_queryset = self.filter_queryset(
-                ComplianceRequirementOverview.objects.filter(
-                    tenant_id=self.request.tenant_id, scan__provider__in=providers
-                )
-            )
+        base_queryset = ComplianceRequirementOverview.objects.filter(
+            tenant_id=self.request.tenant_id
+        )
 
-        return base_queryset
+        if unlimited_visibility:
+            return base_queryset
+
+        return base_queryset.filter(scan__provider__in=get_providers(role))
 
     def get_serializer_class(self):
         if hasattr(self, "response_serializer_class"):
@@ -4643,6 +4766,72 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
         return summaries
 
+    def _validate_scan_selection(self, scan_id, has_provider_filters):
+        if scan_id and has_provider_filters:
+            raise ValidationError(
+                [
+                    {
+                        "detail": "Use either filter[scan_id] or provider filters.",
+                        "status": 400,
+                        "source": {"pointer": "filter[scan_id]"},
+                        "code": "invalid",
+                    }
+                ]
+            )
+
+        if scan_id:
+            self._validate_uuid_filter_values("scan_id", [scan_id])
+            return
+
+        if has_provider_filters:
+            return
+
+        raise ValidationError(
+            [
+                {
+                    "detail": "This query parameter is required unless a provider filter is provided.",
+                    "status": 400,
+                    "source": {"pointer": "filter[scan_id]"},
+                    "code": "required",
+                }
+            ]
+        )
+
+    def _latest_scan_ids_for_provider_filters(self):
+        role = get_role(self.request.user, self.request.tenant_id)
+        scans = Scan.all_objects.filter(
+            tenant_id=self.request.tenant_id,
+            state=StateChoices.COMPLETED,
+        )
+
+        if not getattr(role, Permissions.UNLIMITED_VISIBILITY.value, False):
+            scans = scans.filter(provider__in=get_providers(role))
+
+        provider_filters = self._extract_provider_filters_from_params(
+            validate_uuids=True,
+            include_dot_aliases=True,
+        )
+        if provider_filters:
+            scans = scans.filter(**provider_filters)
+
+        return list(
+            scans.order_by("provider_id", "-inserted_at")
+            .distinct("provider_id")
+            .values_list("id", flat=True)
+        )
+
+    def _filtered_queryset_for_latest_provider_scans(self, latest_scan_ids=None):
+        if latest_scan_ids is None:
+            latest_scan_ids = self._latest_scan_ids_for_provider_filters()
+        queryset = self.get_queryset().filter(scan_id__in=latest_scan_ids)
+        # Provider filters stay on the filterset for OpenAPI docs, but runtime
+        # filtering happens on Scan first so compliance queries use scan IDs.
+        return self._apply_filterset(
+            queryset,
+            self.filterset_class,
+            exclude_keys=self.PROVIDER_FILTER_KEYS | {"scan_id"},
+        )
+
     def _get_compliance_template(self, *, provider=None, scan_id=None):
         """Return the compliance template for the given provider or scan."""
         if provider is None and scan_id is not None:
@@ -4758,6 +4947,36 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
                 status=status.HTTP_500_INTERNAL_SERVER_ERROR,
             )
 
+    def _task_response_for_latest_provider_scans(self, latest_scan_ids):
+        for scan_id in latest_scan_ids:
+            task_response = self._task_response_if_running(str(scan_id))
+            if task_response:
+                return task_response
+        return None
+
+    def _latest_provider_scan_ids_without_data(self, latest_scan_ids):
+        data_presence_queryset = self.get_queryset().filter(scan_id__in=latest_scan_ids)
+        scan_ids_with_data = {
+            str(scan_id)
+            for scan_id in data_presence_queryset.values_list(
+                "scan_id", flat=True
+            ).distinct()
+        }
+        return [
+            scan_id
+            for scan_id in latest_scan_ids
+            if str(scan_id) not in scan_ids_with_data
+        ]
+
+    def _task_response_for_latest_provider_scans_without_data(
+        self,
+        latest_scan_ids,
+    ):
+        scan_ids_to_check = self._latest_provider_scan_ids_without_data(
+            latest_scan_ids,
+        )
+        return self._task_response_for_latest_provider_scans(scan_ids_to_check)
+
     def _list_with_region_filter(self, scan_id, region_filter):
         """
         Fall back to detailed ComplianceRequirementOverview query when region filter is applied.
@@ -4798,8 +5017,25 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
         return Response(data)
 
+    def _list_with_latest_provider_filters(self):
+        latest_scan_ids = self._latest_scan_ids_for_provider_filters()
+        queryset = self._filtered_queryset_for_latest_provider_scans(latest_scan_ids)
+        data = self._aggregate_compliance_overview(queryset)
+        task_response = self._task_response_for_latest_provider_scans_without_data(
+            latest_scan_ids,
+        )
+        if task_response:
+            return task_response
+
+        return Response(data)
+
     def list(self, request, *args, **kwargs):
         scan_id = request.query_params.get("filter[scan_id]")
+        has_provider_filters = self._has_provider_filters(include_dot_aliases=True)
+        self._validate_scan_selection(scan_id, has_provider_filters)
+
+        if has_provider_filters:
+            return self._list_with_latest_provider_filters()
 
         # Specific scan requested - use optimized summaries with region support
         region_filter = request.query_params.get(
@@ -4845,33 +5081,34 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
     @action(detail=False, methods=["get"], url_name="metadata")
     def metadata(self, request):
         scan_id = request.query_params.get("filter[scan_id]")
-        if not scan_id:
-            raise ValidationError(
-                [
-                    {
-                        "detail": "This query parameter is required.",
-                        "status": 400,
-                        "source": {"pointer": "filter[scan_id]"},
-                        "code": "required",
-                    }
-                ]
+        has_provider_filters = self._has_provider_filters(include_dot_aliases=True)
+        self._validate_scan_selection(scan_id, has_provider_filters)
+
+        latest_scan_ids = None
+        if has_provider_filters:
+            latest_scan_ids = self._latest_scan_ids_for_provider_filters()
+            queryset = self._filtered_queryset_for_latest_provider_scans(
+                latest_scan_ids
             )
+        else:
+            queryset = self._apply_filterset(self.get_queryset(), self.filterset_class)
+
         regions = list(
-            self.get_queryset()
-            .filter(scan_id=scan_id)
-            .values_list("region", flat=True)
-            .order_by("region")
-            .distinct()
+            queryset.values_list("region", flat=True).order_by("region").distinct()
         )
         result = {"regions": regions}
 
-        if regions:
-            serializer = self.get_serializer(data=result)
-            serializer.is_valid(raise_exception=True)
-            return Response(serializer.data, status=status.HTTP_200_OK)
+        task_response = None
+        if has_provider_filters:
+            task_response = self._task_response_for_latest_provider_scans_without_data(
+                latest_scan_ids,
+            )
+        elif not regions:
+            task_response = self._task_response_if_running(scan_id)
+            if task_response:
+                return task_response
 
-        task_response = self._task_response_if_running(scan_id)
-        if task_response:
+        if has_provider_filters and task_response:
             return task_response
 
         serializer = self.get_serializer(data=result)
@@ -4881,19 +5118,10 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
     @action(detail=False, methods=["get"], url_name="requirements")
     def requirements(self, request):
         scan_id = request.query_params.get("filter[scan_id]")
+        has_provider_filters = self._has_provider_filters(include_dot_aliases=True)
         compliance_id = request.query_params.get("filter[compliance_id]")
 
-        if not scan_id:
-            raise ValidationError(
-                [
-                    {
-                        "detail": "This query parameter is required.",
-                        "status": 400,
-                        "source": {"pointer": "filter[scan_id]"},
-                        "code": "required",
-                    }
-                ]
-            )
+        self._validate_scan_selection(scan_id, has_provider_filters)
 
         if not compliance_id:
             raise ValidationError(
@@ -4906,7 +5134,16 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
                     }
                 ]
             )
-        filtered_queryset = self.filter_queryset(self.get_queryset())
+        latest_scan_ids = None
+        if has_provider_filters:
+            latest_scan_ids = self._latest_scan_ids_for_provider_filters()
+            filtered_queryset = self._filtered_queryset_for_latest_provider_scans(
+                latest_scan_ids
+            )
+        else:
+            filtered_queryset = self._apply_filterset(
+                self.get_queryset(), self.filterset_class
+            )
 
         all_requirements = filtered_queryset.values(
             "requirement_id",
@@ -4965,17 +5202,33 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
                 requirements_summary, many=True
             )
 
+        task_response = None
+        if has_provider_filters:
+            task_response = self._task_response_for_latest_provider_scans_without_data(
+                latest_scan_ids,
+            )
+        elif not requirements_summary:
+            task_response = self._task_response_if_running(scan_id)
+            if task_response:
+                return task_response
+
+        if has_provider_filters and task_response:
+            return task_response
+
         if requirements_summary:
             return Response(serializer.data, status=status.HTTP_200_OK)
 
-        task_response = self._task_response_if_running(scan_id)
-        if task_response:
-            return task_response
-
         return Response(serializer.data, status=status.HTTP_200_OK)
 
     @action(detail=False, methods=["get"], url_name="attributes")
     def attributes(self, request):
+        # While the background warm-up is in progress, refuse immediately
+        # instead of falling through to the slow cold load on the request
+        # thread (which would trip the Gunicorn worker timeout). `is_set()` is
+        # a non-blocking flag read, so this never touches the loader.
+        if COMPLIANCE_WARMING_STARTED.is_set() and not COMPLIANCE_WARMED.is_set():
+            raise ComplianceWarmingError()
+
         compliance_id = request.query_params.get("filter[compliance_id]")
         if not compliance_id:
             raise ValidationError(
@@ -4991,7 +5244,51 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
         provider_type = None
 
-        # If we couldn't determine from database, try each provider type
+        # When a scan is provided, resolve the provider from it. Multi-provider
+        # universal frameworks (e.g. CSA CCM) share a single compliance_id
+        # across providers but expose different checks per provider, so the
+        # metadata (and therefore the check IDs the UI uses to fetch findings)
+        # must be returned for the scan's provider. Without this, the endpoint
+        # falls back to the first provider that declares the framework and
+        # returns its check IDs, leaving azure/gcp/... requirements with no
+        # matching findings.
+        scan_id = request.query_params.get("filter[scan_id]")
+        if "filter[scan_id]" in request.query_params:
+            # An explicit scan_id is authoritative: fail closed instead of
+            # falling back to another provider. Otherwise an invalid, empty
+            # (filter[scan_id]=) or inaccessible scan would silently return the
+            # first provider's check IDs, recreating the multi-provider mismatch
+            # this endpoint fixes.
+            if not scan_id:
+                raise NotFound(detail=f"Scan '{scan_id}' not found.")
+
+            # Tenant isolation is already enforced by Postgres RLS on the
+            # connection (see BaseRLSViewSet). Scope the lookup by provider
+            # group as well so a user with limited visibility can't resolve
+            # another provider's scan and read its compliance metadata, mirroring
+            # the RBAC scoping get_queryset() applies to the rest of the ViewSet.
+            role = get_role(request.user, request.tenant_id)
+            if getattr(role, Permissions.UNLIMITED_VISIBILITY.value, False):
+                scan_queryset = Scan.objects.filter(tenant_id=request.tenant_id)
+            else:
+                scan_queryset = Scan.objects.filter(provider__in=get_providers(role))
+
+            try:
+                scan = scan_queryset.select_related("provider").get(id=scan_id)
+            except (Scan.DoesNotExist, DjangoValidationError, ValueError):
+                raise NotFound(detail=f"Scan '{scan_id}' not found.")
+
+            provider_type = scan.provider.provider
+            if compliance_id not in get_compliance_frameworks(provider_type):
+                raise NotFound(
+                    detail=(
+                        f"Compliance framework '{compliance_id}' is not "
+                        f"available for scan '{scan_id}'."
+                    )
+                )
+
+        # Fall back to the first provider that declares the framework. Keeps the
+        # endpoint working for provider-agnostic callers that omit the scan.
         if not provider_type:
             for pt in Provider.ProviderChoices.values:
                 if compliance_id in get_compliance_frameworks(pt):
@@ -5159,7 +5456,7 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
     ),
 )
 @method_decorator(CACHE_DECORATOR, name="list")
-class OverviewViewSet(BaseRLSViewSet):
+class OverviewViewSet(ProviderFilterParamsMixin, BaseRLSViewSet):
     queryset = ScanSummary.objects.all()
     http_method_names = ["get"]
     ordering = ["-inserted_at"]
@@ -5276,18 +5573,6 @@ class OverviewViewSet(BaseRLSViewSet):
             tenant_id=tenant_id, scan_id__in=latest_scan_ids
         )
 
-    def _normalize_jsonapi_params(self, query_params, exclude_keys=None):
-        """Convert JSON:API filter params (filter[X]) to flat params (X)."""
-        exclude_keys = exclude_keys or set()
-        normalized = QueryDict(mutable=True)
-        for key, values in query_params.lists():
-            normalized_key = (
-                key[7:-1] if key.startswith("filter[") and key.endswith("]") else key
-            )
-            if normalized_key not in exclude_keys:
-                normalized.setlist(normalized_key, values)
-        return normalized
-
     def _ensure_allowed_providers(self):
         """Populate allowed providers for RBAC-aware queries once per request."""
         if getattr(self, "_providers_initialized", False):
@@ -5307,15 +5592,6 @@ class OverviewViewSet(BaseRLSViewSet):
             return queryset.filter(**provider_filter)
         return queryset
 
-    def _apply_filterset(self, queryset, filterset_class, exclude_keys=None):
-        normalized_params = self._normalize_jsonapi_params(
-            self.request.query_params, exclude_keys=set(exclude_keys or [])
-        )
-        filterset = filterset_class(normalized_params, queryset=queryset)
-        if not filterset.is_valid():
-            raise ValidationError(filterset.errors)
-        return filterset.qs
-
     def _latest_scan_ids_for_allowed_providers(self, tenant_id, provider_filters=None):
         provider_filter = self._get_provider_filter()
         queryset = Scan.all_objects.filter(
@@ -5329,40 +5605,6 @@ class OverviewViewSet(BaseRLSViewSet):
             .values_list("id", flat=True)
         )
 
-    def _extract_provider_filters_from_params(self):
-        """Extract and validate provider filters from query params."""
-        params = self.request.query_params
-        filters = {}
-        valid_provider_types = {c[0] for c in Provider.ProviderChoices.choices}
-
-        provider_id = params.get("filter[provider_id]")
-        if provider_id:
-            filters["provider_id"] = provider_id
-
-        provider_id_in = params.get("filter[provider_id__in]")
-        if provider_id_in:
-            filters["provider_id__in"] = provider_id_in.split(",")
-
-        provider_type = params.get("filter[provider_type]")
-        if provider_type:
-            if provider_type not in valid_provider_types:
-                raise ValidationError(
-                    {"provider_type": f"Invalid choice: {provider_type}"}
-                )
-            filters["provider__provider"] = provider_type
-
-        provider_type_in = params.get("filter[provider_type__in]")
-        if provider_type_in:
-            types = provider_type_in.split(",")
-            invalid = [t for t in types if t not in valid_provider_types]
-            if invalid:
-                raise ValidationError(
-                    {"provider_type__in": f"Invalid choices: {', '.join(invalid)}"}
-                )
-            filters["provider__provider__in"] = types
-
-        return filters
-
     @action(detail=False, methods=["get"], url_name="providers")
     def providers(self, request):
         tenant_id = self.request.tenant_id
@@ -5433,15 +5675,11 @@ class OverviewViewSet(BaseRLSViewSet):
         tenant_id = self.request.tenant_id
         providers_qs = Provider.objects.filter(tenant_id=tenant_id)
 
+        self._ensure_allowed_providers()
         if hasattr(self, "allowed_providers"):
-            allowed_ids = list(self.allowed_providers.values_list("id", flat=True))
-            if not allowed_ids:
-                overview = []
-                return Response(
-                    self.get_serializer(overview, many=True).data,
-                    status=status.HTTP_200_OK,
-                )
-            providers_qs = providers_qs.filter(id__in=allowed_ids)
+            providers_qs = providers_qs.filter(
+                id__in=self.allowed_providers.values("id")
+            )
 
         overview = (
             providers_qs.values("provider")
@@ -5657,29 +5895,41 @@ class OverviewViewSet(BaseRLSViewSet):
                 description="Retrieve a specific snapshot by ID. If not provided, returns latest snapshots.",
             ),
             OpenApiParameter(
-                name="provider_id",
+                name="filter[provider_id]",
                 type=OpenApiTypes.UUID,
                 location=OpenApiParameter.QUERY,
                 description="Filter by specific provider ID",
             ),
             OpenApiParameter(
-                name="provider_id__in",
+                name="filter[provider_id__in]",
                 type=OpenApiTypes.STR,
                 location=OpenApiParameter.QUERY,
                 description="Filter by multiple provider IDs (comma-separated UUIDs)",
             ),
             OpenApiParameter(
-                name="provider_type",
+                name="filter[provider_type]",
                 type=OpenApiTypes.STR,
                 location=OpenApiParameter.QUERY,
                 description="Filter by provider type (aws, azure, gcp, etc.)",
             ),
             OpenApiParameter(
-                name="provider_type__in",
+                name="filter[provider_type__in]",
                 type=OpenApiTypes.STR,
                 location=OpenApiParameter.QUERY,
                 description="Filter by multiple provider types (comma-separated)",
             ),
+            OpenApiParameter(
+                name="filter[provider_groups]",
+                type=OpenApiTypes.UUID,
+                location=OpenApiParameter.QUERY,
+                description="Filter by provider group ID",
+            ),
+            OpenApiParameter(
+                name="filter[provider_groups__in]",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                description="Filter by multiple provider group IDs (comma-separated UUIDs)",
+            ),
         ],
     )
     @action(detail=False, methods=["get"], url_name="threatscore")
@@ -6021,6 +6271,8 @@ class OverviewViewSet(BaseRLSViewSet):
             "provider_id__in",
             "provider_type",
             "provider_type__in",
+            "provider_groups",
+            "provider_groups__in",
         }
         filtered_queryset = self._apply_filterset(
             base_queryset, CategoryOverviewFilter, exclude_keys=provider_filter_keys
@@ -6090,6 +6342,8 @@ class OverviewViewSet(BaseRLSViewSet):
             "provider_id__in",
             "provider_type",
             "provider_type__in",
+            "provider_groups",
+            "provider_groups__in",
         }
         filtered_queryset = self._apply_filterset(
             base_queryset,
@@ -7140,7 +7394,7 @@ SEVERITY_ORDER_REVERSE = {v: k for k, v in SEVERITY_ORDER.items()}
     ),
     retrieve=extend_schema(exclude=True),
 )
-class FindingGroupViewSet(BaseRLSViewSet):
+class FindingGroupViewSet(JsonApiFilterMixin, BaseRLSViewSet):
     """
     ViewSet for Finding Groups - aggregates findings by check_id.
 
@@ -7156,6 +7410,7 @@ class FindingGroupViewSet(BaseRLSViewSet):
     queryset = FindingGroupDailySummary.objects.all()
     serializer_class = FindingGroupSerializer
     filterset_class = FindingGroupFilter
+    jsonapi_filter_replace_dots = True
     filter_backends = [
         jsonapi_filters.QueryParameterValidationFilter,
         jsonapi_filters.OrderingFilter,
@@ -7206,18 +7461,6 @@ class FindingGroupViewSet(BaseRLSViewSet):
 
         return queryset
 
-    def _normalize_jsonapi_params(self, query_params):
-        """Convert JSON:API filter params (filter[X]) to flat params (X)."""
-        normalized = QueryDict(mutable=True)
-        for key, values in query_params.lists():
-            normalized_key = (
-                key[7:-1] if key.startswith("filter[") and key.endswith("]") else key
-            )
-            # Convert JSON:API dot notation to Django double underscore
-            normalized_key = normalized_key.replace(".", "__")
-            normalized.setlist(normalized_key, values)
-        return normalized
-
     @extend_schema(exclude=True)
     def retrieve(self, request, *args, **kwargs):
         raise MethodNotAllowed(method="GET")
@@ -8336,9 +8579,10 @@ class FindingGroupViewSet(BaseRLSViewSet):
 
         This endpoint returns finding groups without requiring date filters,
         automatically using the latest available data per check_id.
-        All other filters (provider_id, provider_type, check_id) are still supported.
+        Provider, provider group, check, and computed filters are still supported.
         """,
         tags=["Finding Groups"],
+        filters=True,
     )
     @action(detail=False, methods=["get"], url_name="latest")
     def latest(self, request):
diff --git a/api/src/backend/config/celery.py b/api/src/backend/config/celery.py
index c46c8a426c..5d246395a5 100644
--- a/api/src/backend/config/celery.py
+++ b/api/src/backend/config/celery.py
@@ -26,6 +26,61 @@ celery_app.conf.result_backend_transport_options = {
 }
 celery_app.conf.visibility_timeout = BROKER_VISIBILITY_TIMEOUT
 
+# Durable delivery: keep the message until the task finishes, so a worker killed
+# mid-task (deploy/OOM/eviction) does not silently drop it. Reserve one task at a
+# time so a crash exposes at most one extra reserved message.
+celery_app.conf.task_acks_late = True
+celery_app.conf.task_reject_on_worker_lost = True
+celery_app.conf.worker_prefetch_multiplier = env.int(
+    "DJANGO_CELERY_WORKER_PREFETCH_MULTIPLIER", default=1
+)
+# On SIGTERM, give the worker time to finish or re-queue in-flight tasks before
+# it is forcefully killed (Celery 5.5+ soft shutdown).
+celery_app.conf.worker_soft_shutdown_timeout = env.int(
+    "DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT", default=60
+)
+# Bound execution so a blocked task cannot pin a worker forever. Connection
+# checks get a tight limit; scans and provider/tenant deletions can legitimately
+# run for more than a day on large tenants, so they get a much higher cap.
+# The default for every other task is set as the global limit, not as a "*"
+# annotation: Celery applies the "*" entry AFTER the per-task one, so a "*" in
+# task_annotations would silently overwrite every specific limit defined below.
+_TASK_HARD_LIMIT = env.int("DJANGO_CELERY_TASK_TIME_LIMIT", default=6 * 60 * 60)
+_TASK_SOFT_LIMIT = env.int(
+    "DJANGO_CELERY_TASK_SOFT_TIME_LIMIT", default=_TASK_HARD_LIMIT - 600
+)
+_LONG_TASK_HARD_LIMIT = env.int(
+    "DJANGO_CELERY_LONG_TASK_TIME_LIMIT", default=48 * 60 * 60
+)
+_LONG_TASK_SOFT_LIMIT = env.int(
+    "DJANGO_CELERY_LONG_TASK_SOFT_TIME_LIMIT", default=_LONG_TASK_HARD_LIMIT - 600
+)
+celery_app.conf.task_time_limit = _TASK_HARD_LIMIT
+celery_app.conf.task_soft_time_limit = _TASK_SOFT_LIMIT
+celery_app.conf.task_annotations = {
+    **{
+        name: {"soft_time_limit": 60, "time_limit": 120}
+        for name in (
+            "provider-connection-check",
+            "integration-connection-check",
+            "lighthouse-connection-check",
+            "lighthouse-provider-connection-check",
+        )
+    },
+    **{
+        name: {
+            "soft_time_limit": _LONG_TASK_SOFT_LIMIT,
+            "time_limit": _LONG_TASK_HARD_LIMIT,
+        }
+        for name in (
+            "scan-perform",
+            "scan-perform-scheduled",
+            "provider-deletion",
+            "tenant-deletion",
+        )
+    },
+}
+
 celery_app.autodiscover_tasks(["api"])
 
 
diff --git a/api/src/backend/config/django/base.py b/api/src/backend/config/django/base.py
index 317fe4fbfb..31a9537b5f 100644
--- a/api/src/backend/config/django/base.py
+++ b/api/src/backend/config/django/base.py
@@ -3,6 +3,7 @@ from datetime import timedelta
 from config.custom_logging import LOGGING  # noqa
 from config.env import BASE_DIR, env  # noqa
 from config.settings.celery import *  # noqa
+from config.settings.eventstream import *  # noqa
 from config.settings.partitions import *  # noqa
 from config.settings.sentry import *  # noqa
 from config.settings.social_login import *  # noqa
@@ -44,9 +45,11 @@ INSTALLED_APPS = [
     "dj_rest_auth.registration",
     "rest_framework.authtoken",
     "drf_simple_apikey",
+    "django_eventstream",
 ]
 
 MIDDLEWARE = [
+    "api.middleware.CloseDBConnectionsMiddleware",
     "django_guid.middleware.guid_middleware",
     "django.middleware.security.SecurityMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",
@@ -136,6 +139,7 @@ SPECTACULAR_SETTINGS = {
 }
 
 WSGI_APPLICATION = "config.wsgi.application"
+ASGI_APPLICATION = "config.asgi.application"
 
 DJANGO_GUID = {
     "GUID_HEADER_NAME": "Transaction-ID",
@@ -306,3 +310,32 @@ SESSION_COOKIE_SECURE = True
 ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES = env.int(
     "ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES", 2880
 )  # 48h
+
+# Orphan task recovery feature flags. The master switch is OFF by default, so task
+# recovery is opt-in; enable it with DJANGO_TASK_RECOVERY_ENABLED=true. The per-group
+# toggles default to enabled, so once the master is on every group recovers unless a
+# group is explicitly turned off.
+TASK_RECOVERY_ENABLED = env.bool("DJANGO_TASK_RECOVERY_ENABLED", False)
+TASK_RECOVERY_SUMMARIES_ENABLED = env.bool(
+    "DJANGO_TASK_RECOVERY_SUMMARIES_ENABLED", True
+)
+TASK_RECOVERY_DELETIONS_ENABLED = env.bool(
+    "DJANGO_TASK_RECOVERY_DELETIONS_ENABLED", True
+)
+
+
+def label_postgres_connections(databases):
+    """Tag each Postgres connection with ``application_name="<component>:<alias>"``
+    so connections are attributable by component in ``pg_stat_activity`` (and any
+    tooling that surfaces ``application_name``). The component (api / worker /
+    scan / ...) is injected per process by the container entrypoint via
+    ``DJANGO_APP_COMPONENT``; the alias distinguishes which pool inside the
+    process owns the connection. The neo4j entry is skipped (not a Postgres
+    backend). Postgres truncates ``application_name`` at 63 bytes.
+    """
+    component = env.str("DJANGO_APP_COMPONENT", default="api")
+    for alias, config in databases.items():
+        engine = config.get("ENGINE", "")
+        if engine.startswith("psqlextra") or "postgresql" in engine:
+            name = f"{component}:{alias}"[:63]
+            config.setdefault("OPTIONS", {})["application_name"] = name
diff --git a/api/src/backend/config/django/devel.py b/api/src/backend/config/django/devel.py
index 9c83557b77..6921790ca3 100644
--- a/api/src/backend/config/django/devel.py
+++ b/api/src/backend/config/django/devel.py
@@ -54,6 +54,8 @@ DATABASES = {
 
 DATABASES["default"] = DATABASES["prowler_user"]
 
+label_postgres_connections(DATABASES)  # noqa: F405
+
 REST_FRAMEWORK["DEFAULT_RENDERER_CLASSES"] = tuple(  # noqa: F405
     render_class
     for render_class in REST_FRAMEWORK["DEFAULT_RENDERER_CLASSES"]  # noqa: F405
diff --git a/api/src/backend/config/django/production.py b/api/src/backend/config/django/production.py
index 91bd50d0d1..cb651f6e76 100644
--- a/api/src/backend/config/django/production.py
+++ b/api/src/backend/config/django/production.py
@@ -58,3 +58,5 @@ DATABASES = {
 }
 
 DATABASES["default"] = DATABASES["prowler_user"]
+
+label_postgres_connections(DATABASES)  # noqa: F405
diff --git a/api/src/backend/config/django/testing.py b/api/src/backend/config/django/testing.py
index 75779f5a68..a1e5c29fb3 100644
--- a/api/src/backend/config/django/testing.py
+++ b/api/src/backend/config/django/testing.py
@@ -34,3 +34,8 @@ DRF_API_KEY = {
 # JWT
 
 SIMPLE_JWT["ALGORITHM"] = "HS256"  # noqa: F405
+# pyjwt >= 2.13.0 rejects an empty HMAC signing key, so HS256 tests need a real
+# key (>= 32 bytes also avoids the InsecureKeyLengthWarning). Production uses RS256.
+SIMPLE_JWT["SIGNING_KEY"] = env.str(  # noqa: F405
+    "DJANGO_TOKEN_SIGNING_KEY", "insecure-testing-jwt-signing-key-do-not-use-in-prod"
+)
diff --git a/api/src/backend/config/guniconf.py b/api/src/backend/config/guniconf.py
index 536fd97abb..63472feec8 100644
--- a/api/src/backend/config/guniconf.py
+++ b/api/src/backend/config/guniconf.py
@@ -1,6 +1,7 @@
 import logging
 import multiprocessing
 import os
+import threading
 
 from config.env import env
 
@@ -11,6 +12,7 @@ os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.django.production")
 import django  # noqa: E402
 
 django.setup()
+from api.compliance import warm_compliance_caches  # noqa: E402
 from config.django.production import LOGGING as DJANGO_LOGGERS, DEBUG  # noqa: E402
 from config.custom_logging import BackendLogger  # noqa: E402
 
@@ -23,6 +25,37 @@ bind = f"{BIND_ADDRESS}:{PORT}"
 workers = env.int("DJANGO_WORKERS", default=multiprocessing.cpu_count() * 2 + 1)
 reload = DEBUG
 
+# Native ASGI worker (gunicorn 24+). Required so SSE endpoints can keep the
+# event loop alive while waiting for events.
+worker_class = env("DJANGO_WORKER_CLASS", default="asgi")
+
+# Lifespan protocol. Django's ASGIHandler (config.asgi:application) serves only
+# HTTP scopes and raises "Django can only handle ASGI/HTTP connections, not
+# lifespan." gunicorn's default ("auto") probes the app with a lifespan scope
+# to detect support, which triggers that error. We use no lifespan startup or
+# shutdown hooks, so disable the protocol entirely.
+asgi_lifespan = env("DJANGO_ASGI_LIFESPAN", default="off")
+
+# Event loop for the ASGI worker. "auto" uses uvloop when it is installed and
+# falls back to the stdlib asyncio loop otherwise; uvloop gives the SSE event
+# loop more headroom under many concurrent open streams.
+asgi_loop = env("DJANGO_ASGI_LOOP", default="uvloop")
+
+# Max concurrent connections per ASGI worker. Each open SSE stream holds one
+# connection for its whole lifetime, so this caps simultaneous SSE clients per
+# worker (gunicorn's default is 1000). The sync-only `threads` option has no
+# effect on ASGI workers.
+worker_connections = env.int("DJANGO_WORKER_CONNECTIONS", default=1000)
+
+# Preload the application before forking workers in production: the app is
+# imported once in the master and workers fork from it. In development, disable
+# preload so the server restarts on code changes.
+preload_app = not DEBUG
+
+# Worker timeout in seconds. Increased from the default 30s to handle requests
+# that may take longer, such as complex API operations.
+timeout = env.int("GUNICORN_TIMEOUT", default=120)
+
 # Logging
 logconfig_dict = DJANGO_LOGGERS
 gunicorn_logger = logging.getLogger(BackendLogger.GUNICORN)
@@ -41,3 +74,26 @@ def on_reload(_):
 
 def when_ready(_):
     gunicorn_logger.info("Gunicorn server is ready")
+
+
+def _warm_compliance_caches_in_background():
+    """Warm compliance caches off the request path and log the outcome."""
+    failed = warm_compliance_caches()
+    if failed:
+        gunicorn_logger.warning("Compliance caches warmed (skipped: %s)", failed)
+    else:
+        gunicorn_logger.info("Compliance caches warmed")
+
+
+def post_fork(_server, worker):
+    """Warm compliance caches after each worker fork.
+
+    Warm compliance caches in a background thread so the worker becomes ready
+    immediately. A request for a not-yet-warmed provider lazily loads just that
+    provider, which stays well under the worker timeout.
+    """
+    threading.Thread(
+        target=_warm_compliance_caches_in_background,
+        name="warm-compliance-caches",
+        daemon=True,
+    ).start()
diff --git a/api/src/backend/config/settings/eventstream.py b/api/src/backend/config/settings/eventstream.py
new file mode 100644
index 0000000000..470062050b
--- /dev/null
+++ b/api/src/backend/config/settings/eventstream.py
@@ -0,0 +1,41 @@
+"""Server-Sent Events (SSE) configuration.
+
+Wires django-eventstream into the platform: Valkey Pub/Sub backend on a
+dedicated DB (separate from the Celery broker), the platform channel
+manager, and headers that match the existing CORS allowlist.
+"""
+
+from config.env import env
+from config.settings.celery import (
+    VALKEY_HOST,
+    VALKEY_PASSWORD,
+    VALKEY_PORT,
+    VALKEY_SCHEME,
+    VALKEY_USERNAME,
+)
+
+# Dedicated Valkey DB for the SSE Pub/Sub bus. Kept distinct from the
+# Celery broker DB so a noisy broker can't shoulder out streaming
+# traffic on the same keyspace.
+EVENTSTREAM_VALKEY_DB = env.int("EVENTSTREAM_VALKEY_DB", default=2)
+
+EVENTSTREAM_REDIS: dict = {
+    "host": VALKEY_HOST,
+    "port": int(VALKEY_PORT),
+    "db": EVENTSTREAM_VALKEY_DB,
+}
+if VALKEY_PASSWORD:
+    EVENTSTREAM_REDIS["password"] = VALKEY_PASSWORD
+if VALKEY_USERNAME:
+    EVENTSTREAM_REDIS["username"] = VALKEY_USERNAME
+if VALKEY_SCHEME == "rediss":
+    EVENTSTREAM_REDIS["ssl"] = True
+
+# Platform channel manager — performs the per-feature authorization and
+# rewrites the placeholder channel from the URL into the canonical
+# tenant-scoped channel name. See ``api.sse.channelmanager``.
+EVENTSTREAM_CHANNELMANAGER_CLASS = "api.sse.channelmanager.SSEChannelManager"
+
+# Headers a browser EventSource may legitimately send. Keep tight; the
+# stream itself reads no body, so no permissive defaults.
+EVENTSTREAM_ALLOW_HEADERS = "Cache-Control, Last-Event-ID"
diff --git a/api/src/backend/config/settings/sentry.py b/api/src/backend/config/settings/sentry.py
index 580821f7b2..1f449f782e 100644
--- a/api/src/backend/config/settings/sentry.py
+++ b/api/src/backend/config/settings/sentry.py
@@ -76,6 +76,8 @@ IGNORED_EXCEPTIONS = [
     # PowerShell Errors in User Authentication
     "Microsoft Teams User Auth connection failed: Please check your permissions and try again.",
     "Exchange Online User Auth connection failed: Please check your permissions and try again.",
+    # ASGI: Client disconnected before the response finished (health-check probes on /health/live)
+    "RequestAborted",
 ]
 
 
diff --git a/api/src/backend/tasks/jobs/attack_paths/cleanup.py b/api/src/backend/tasks/jobs/attack_paths/cleanup.py
index 65ba583a3e..fa7670afaa 100644
--- a/api/src/backend/tasks/jobs/attack_paths/cleanup.py
+++ b/api/src/backend/tasks/jobs/attack_paths/cleanup.py
@@ -1,12 +1,14 @@
 from datetime import datetime, timedelta, timezone
 
-from celery import current_app, states
+from celery import states
 from celery.utils.log import get_task_logger
 from config.django.base import ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES
 from tasks.jobs.attack_paths.db_utils import (
     _mark_scan_finished,
     recover_graph_data_ready,
 )
+from tasks.jobs.orphan_recovery import is_worker_alive as _is_worker_alive
+from tasks.jobs.orphan_recovery import revoke_task as _revoke_task
 
 from api.attack_paths import database as graph_database
 from api.db_router import MainRouter
@@ -150,32 +152,6 @@ def _cleanup_stale_scheduled_scans(cutoff: datetime) -> list[str]:
     return cleaned_up
 
 
-def _is_worker_alive(worker: str) -> bool:
-    """Ping a specific Celery worker. Returns `True` if it responds or on error."""
-    try:
-        response = current_app.control.inspect(destination=[worker], timeout=1.0).ping()
-        return response is not None and worker in response
-    except Exception:
-        logger.exception(f"Failed to ping worker {worker}, treating as alive")
-        return True
-
-
-def _revoke_task(task_result, terminate: bool = True) -> None:
-    """Revoke a Celery task. Non-fatal on failure.
-
-    `terminate=True` SIGTERMs the worker if the task is mid-execution; use
-    for EXECUTING cleanup. `terminate=False` only marks the task id revoked
-    across workers, so any worker pulling the queued message discards it;
-    use for SCHEDULED cleanup where the task hasn't run yet.
-    """
-    try:
-        kwargs = {"terminate": True, "signal": "SIGTERM"} if terminate else {}
-        current_app.control.revoke(task_result.task_id, **kwargs)
-        logger.info(f"Revoked task {task_result.task_id}")
-    except Exception:
-        logger.exception(f"Failed to revoke task {task_result.task_id}")
-
-
 def _cleanup_scan(scan, task_result, reason: str) -> bool:
     """
     Clean up a single stale `AttackPathsScan`:
diff --git a/api/src/backend/tasks/jobs/export.py b/api/src/backend/tasks/jobs/export.py
index 1b9295cc67..96bd03ee6c 100644
--- a/api/src/backend/tasks/jobs/export.py
+++ b/api/src/backend/tasks/jobs/export.py
@@ -39,11 +39,6 @@ from prowler.lib.outputs.compliance.cis.cis_oraclecloud import OracleCloudCIS
 from prowler.lib.outputs.compliance.cisa_scuba.cisa_scuba_googleworkspace import (
     GoogleWorkspaceCISASCuBA,
 )
-from prowler.lib.outputs.compliance.csa.csa_alibabacloud import AlibabaCloudCSA
-from prowler.lib.outputs.compliance.csa.csa_aws import AWSCSA
-from prowler.lib.outputs.compliance.csa.csa_azure import AzureCSA
-from prowler.lib.outputs.compliance.csa.csa_gcp import GCPCSA
-from prowler.lib.outputs.compliance.csa.csa_oraclecloud import OracleCloudCSA
 from prowler.lib.outputs.compliance.ens.ens_aws import AWSENS
 from prowler.lib.outputs.compliance.ens.ens_azure import AzureENS
 from prowler.lib.outputs.compliance.ens.ens_gcp import GCPENS
@@ -63,6 +58,9 @@ from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_azure import (
     AzureMitreAttack,
 )
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_gcp import GCPMitreAttack
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta import (
+    OktaIDaaSSTIG,
+)
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_alibaba import (
     ProwlerThreatScoreAlibaba,
 )
@@ -102,7 +100,6 @@ COMPLIANCE_CLASS_MAP = {
         (lambda name: name == "prowler_threatscore_aws", ProwlerThreatScoreAWS),
         (lambda name: name.startswith("ccc_"), CCC_AWS),
         (lambda name: name.startswith("c5_"), AWSC5),
-        (lambda name: name.startswith("csa_"), AWSCSA),
         (lambda name: name == "asd_essential_eight_aws", ASDEssentialEightAWS),
     ],
     "azure": [
@@ -113,7 +110,6 @@ COMPLIANCE_CLASS_MAP = {
         (lambda name: name.startswith("ccc_"), CCC_Azure),
         (lambda name: name == "prowler_threatscore_azure", ProwlerThreatScoreAzure),
         (lambda name: name == "c5_azure", AzureC5),
-        (lambda name: name.startswith("csa_"), AzureCSA),
     ],
     "gcp": [
         (lambda name: name.startswith("cis_"), GCPCIS),
@@ -123,7 +119,6 @@ COMPLIANCE_CLASS_MAP = {
         (lambda name: name == "prowler_threatscore_gcp", ProwlerThreatScoreGCP),
         (lambda name: name.startswith("ccc_"), CCC_GCP),
         (lambda name: name == "c5_gcp", GCPC5),
-        (lambda name: name.startswith("csa_"), GCPCSA),
     ],
     "kubernetes": [
         (lambda name: name.startswith("cis_"), KubernetesCIS),
@@ -152,16 +147,17 @@ COMPLIANCE_CLASS_MAP = {
     "image": [],
     "oraclecloud": [
         (lambda name: name.startswith("cis_"), OracleCloudCIS),
-        (lambda name: name.startswith("csa_"), OracleCloudCSA),
     ],
     "alibabacloud": [
         (lambda name: name.startswith("cis_"), AlibabaCloudCIS),
-        (lambda name: name.startswith("csa_"), AlibabaCloudCSA),
         (
             lambda name: name == "prowler_threatscore_alibabacloud",
             ProwlerThreatScoreAlibaba,
         ),
     ],
+    "okta": [
+        (lambda name: name.startswith("okta_idaas_stig"), OktaIDaaSSTIG),
+    ],
 }
 
 
diff --git a/api/src/backend/tasks/jobs/orphan_recovery.py b/api/src/backend/tasks/jobs/orphan_recovery.py
new file mode 100644
index 0000000000..1bf5c95df2
--- /dev/null
+++ b/api/src/backend/tasks/jobs/orphan_recovery.py
@@ -0,0 +1,341 @@
+"""Detect and recover orphaned Celery tasks.
+
+A task is "orphaned" when its result row is non-terminal (STARTED/RECEIVED) but the
+worker that was running it is gone (deploy, OOM, eviction). We tell a real orphan
+from a still-running task by pinging the worker recorded on its `TaskResult`:
+
+- worker responds  -> the task is in flight, leave it alone (never double-run);
+- worker is gone   -> real orphan: mark the stale result terminal (so pending/started
+  alerts clear), then re-enqueue the task from its stored name + kwargs.
+
+This recovers only allowlisted tasks with local, proven idempotency. Celery's
+`result_extended=True` gives us the stored `task_name`/`task_kwargs`/`worker` once
+the task starts, but external side-effect tasks are failed instead of blindly
+re-run. A small recovery cap stops a task that repeatedly kills its worker from
+looping forever.
+
+This is the shared engine behind both the periodic Beat watchdog and the
+`reconcile_orphan_tasks` management command.
+"""
+
+import ast
+import json
+from contextlib import contextmanager
+from datetime import datetime, timedelta, timezone
+from uuid import uuid4
+
+from celery import current_app, states
+from celery.utils.log import get_task_logger
+from django.db import connections
+
+logger = get_task_logger(__name__)
+
+# Arbitrary constant key for pg_try_advisory_lock so only one reconciliation
+# runs at a time across replicas / the watchdog / the command.
+ORPHAN_RECOVERY_LOCK_KEY = 0x70726F77  # "prow"
+
+# Non-terminal states that mean "a worker had this and may have died with it".
+IN_FLIGHT_STATES = (states.STARTED, states.RECEIVED)
+
+# Tasks with proven idempotency are eligible for auto re-enqueue, grouped so each
+# group can be toggled independently by a feature flag (see config.django.base).
+# Summaries clear and rewrite their own rows and deletions are idempotent. Tasks with
+# external side effects are never eligible: integration-jira would create duplicate
+# issues, integration-s3 rebuilds its upload from worker-local files that do not
+# survive a crash, and report/Security Hub recovery is out of scope.
+RECOVERY_TASK_GROUPS = {
+    "summaries": {
+        "scan-summary",
+        "scan-compliance-overviews",
+        "scan-provider-compliance-scores",
+        "scan-daily-severity",
+        "scan-finding-group-summaries",
+        "scan-reset-ephemeral-resources",
+    },
+    "deletions": {"provider-deletion", "tenant-deletion"},
+}
+
+
+def reenqueueable_tasks() -> set[str]:
+    """Task names eligible for auto re-enqueue, honoring the per-group feature flags.
+
+    A group whose flag is disabled is dropped, so its orphaned tasks are marked
+    terminal instead of re-enqueued.
+    """
+    from django.conf import settings
+
+    group_enabled = {
+        "summaries": settings.TASK_RECOVERY_SUMMARIES_ENABLED,
+        "deletions": settings.TASK_RECOVERY_DELETIONS_ENABLED,
+    }
+    return {
+        task
+        for group, tasks in RECOVERY_TASK_GROUPS.items()
+        if group_enabled[group]
+        for task in tasks
+    }
+
+
+# Tasks the watchdog ignores entirely (not even marked terminal): scan tasks are not
+# auto-recovered, since re-running a scan is not safe to do automatically; attack-paths
+# scans are handled by their own stale-cleanup (which also drops the temp Neo4j db);
+# and the maintenance tasks must not self-recover (they run again on their own schedule).
+_SKIP_RECOVERY = {
+    "scan-perform",
+    "scan-perform-scheduled",
+    "attack-paths-scan-perform",
+    "attack-paths-cleanup-stale-scans",
+    "reconcile-orphan-tasks",
+}
+
+
+@contextmanager
+def advisory_lock(key: int = ORPHAN_RECOVERY_LOCK_KEY, using: str = "default"):
+    """Yield True if this session won a Postgres advisory lock, else False.
+
+    Non-blocking: losers get False and should no-op. The lock is released on
+    exit (and implicitly if the session dies).
+    """
+    with connections[using].cursor() as cursor:
+        cursor.execute("SELECT pg_try_advisory_lock(%s)", [key])
+        acquired = bool(cursor.fetchone()[0])
+        try:
+            yield acquired
+        finally:
+            if acquired:
+                cursor.execute("SELECT pg_advisory_unlock(%s)", [key])
+
+
+def is_worker_alive(worker: str, timeout: float = 1.0) -> bool:
+    """Ping a specific Celery worker. Returns True if it responds, or on error.
+
+    Erring on the side of "alive" means an unreachable control bus never causes
+    a still-running task to be re-enqueued.
+    """
+    try:
+        response = current_app.control.inspect(
+            destination=[worker], timeout=timeout
+        ).ping()
+        return response is not None and worker in response
+    except Exception:
+        logger.exception(f"Failed to ping worker {worker}, treating as alive")
+        return True
+
+
+def revoke_task(task_result, terminate: bool = True) -> None:
+    """Revoke a Celery task by its TaskResult. Non-fatal on failure.
+
+    terminate=True SIGTERMs the worker if the task is mid-execution; terminate=False
+    only marks the id revoked so any worker pulling the queued message discards it
+    (use before re-enqueuing, so a later broker redelivery of the stale message is
+    dropped).
+    """
+    try:
+        kwargs = {"terminate": True, "signal": "SIGTERM"} if terminate else {}
+        current_app.control.revoke(task_result.task_id, **kwargs)
+        logger.info(f"Revoked task {task_result.task_id}")
+    except Exception:
+        logger.exception(f"Failed to revoke task {task_result.task_id}")
+
+
+def _decode_celery_field(value, default):
+    """Decode django-celery-results' stored task_args/task_kwargs to a Python object.
+
+    The backend stores them as a (sometimes double-encoded) repr/JSON string. An
+    empty or missing field returns ``default``; a non-empty value that cannot be
+    decoded raises ``ValueError`` so the caller can avoid re-enqueuing a task with
+    the wrong arguments.
+    """
+    obj = value
+    for _ in range(2):  # values can be double-encoded (a string holding a repr)
+        if not isinstance(obj, str):
+            break
+        text = obj.strip()
+        if not text:
+            return default
+        parsed = None
+        for parser in (ast.literal_eval, json.loads):
+            try:
+                parsed = parser(text)
+                break
+            except (ValueError, SyntaxError, TypeError):
+                continue
+        if parsed is None:
+            raise ValueError(f"undecodable celery field: {text[:120]!r}")
+        obj = parsed
+    return default if obj is None else obj
+
+
+def reconcile_orphans(
+    grace_minutes: int = 2,
+    max_attempts: int = 3,
+    window_hours: int = 6,
+    dry_run: bool = False,
+) -> dict:
+    """Run the full orphan sweep under a single-flight advisory lock.
+
+    Recovers any orphaned in-flight task and delegates attack-paths scans that
+    never reached a worker to their existing stale-cleanup. Returns a summary;
+    a no-op (lock not won) is reported too.
+    """
+    with advisory_lock() as acquired:
+        if not acquired:
+            logger.info("Orphan reconcile skipped: another run holds the lock")
+            return {"acquired": False}
+
+        from django.conf import settings
+
+        if settings.TASK_RECOVERY_ENABLED:
+            # Populate the task registry so we can re-enqueue any task by name.
+            import tasks.tasks  # noqa: F401
+
+            result = _reconcile_task_results(
+                grace_minutes=grace_minutes,
+                max_attempts=max_attempts,
+                window_hours=window_hours,
+                dry_run=dry_run,
+            )
+            result["enabled"] = True
+        else:
+            logger.info("Orphan task recovery disabled by feature flag")
+            result = {"recovered": [], "failed": [], "skipped": [], "enabled": False}
+
+        if not dry_run:
+            from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+
+            result["attack_paths"] = cleanup_stale_attack_paths_scans()
+
+        return {"acquired": True, **result}
+
+
+def _reconcile_task_results(
+    grace_minutes: int, max_attempts: int, window_hours: int, dry_run: bool
+) -> dict:
+    from django_celery_results.models import TaskResult
+
+    cutoff = datetime.now(tz=timezone.utc) - timedelta(minutes=grace_minutes)
+    candidates = list(
+        TaskResult.objects.filter(status__in=IN_FLIGHT_STATES, date_created__lt=cutoff)
+        .exclude(worker__isnull=True)
+        .exclude(worker="")
+        .exclude(task_name__in=_SKIP_RECOVERY)
+    )
+
+    # Ping each distinct worker at most once.
+    worker_alive = {w: is_worker_alive(w) for w in {tr.worker for tr in candidates}}
+
+    recovered, failed, skipped = [], [], []
+    for task_result in candidates:
+        if worker_alive.get(task_result.worker, True):
+            skipped.append(task_result.task_id)  # in flight, do not double-run
+            continue
+        if dry_run:
+            recovered.append(task_result.task_id)
+            continue
+        outcome = _recover_task(task_result, max_attempts, window_hours)
+        (recovered if outcome == "recovered" else failed).append(task_result.task_id)
+
+    logger.info(
+        "Orphan reconcile: recovered=%d failed=%d skipped(in-flight)=%d",
+        len(recovered),
+        len(failed),
+        len(skipped),
+    )
+    return {"recovered": recovered, "failed": failed, "skipped": skipped}
+
+
+def _recovery_attempt_count(name: str, kwargs_repr, window_hours: int) -> int:
+    """Increment and return the recovery count for this (task, kwargs) within the
+    window. Backed by Valkey so it survives result-row churn (a worker processing
+    the revoke can blank the TaskResult fields). Fail-open if Valkey is down (the
+    broker being unreachable means nothing is running anyway).
+    """
+    import hashlib
+
+    from django.conf import settings
+
+    try:
+        import redis
+
+        client = redis.from_url(settings.CELERY_BROKER_URL)
+        signature = f"{name}|{kwargs_repr}".encode()
+        key = (
+            "orphan-recovery:"
+            + hashlib.sha1(signature, usedforsecurity=False).hexdigest()
+        )
+        count = client.incr(key)
+        if count == 1:
+            client.expire(key, max(1, window_hours) * 3600)
+        return int(count)
+    except Exception:
+        logger.exception("Recovery-attempt counter unavailable; allowing recovery")
+        return 1
+
+
+def _recover_task(task_result, max_attempts: int, window_hours: int) -> str:
+    """Recover one orphaned task. Returns 'recovered' or 'failed'."""
+    # Capture name/args/kwargs now: revoking can let a worker blank the row.
+    name = task_result.task_name
+    args_repr = task_result.task_args
+    kwargs_repr = task_result.task_kwargs
+    now = datetime.now(tz=timezone.utc)
+
+    # Drop any future broker redelivery of the stale message.
+    revoke_task(task_result, terminate=False)
+
+    # Mark the stale result terminal so "pending/started forever" alerts clear.
+    task_result.status = states.REVOKED
+    task_result.date_done = now
+    task_result.save(update_fields=["status", "date_done"])
+
+    if name not in reenqueueable_tasks():
+        logger.warning(
+            "Orphan %s (%s) not re-enqueued: not allowlisted for auto recovery",
+            task_result.task_id,
+            name,
+        )
+        return "failed"
+
+    # Count the attempt only once the task is allowlisted, so a task sitting in a
+    # disabled group does not burn its recovery budget while the flag is off (and is
+    # not already over the cap the moment the group is re-enabled).
+    attempt = _recovery_attempt_count(name, kwargs_repr, window_hours)
+    if attempt > max_attempts:
+        logger.warning(
+            "Orphan %s (%s) not re-enqueued: recovery cap reached (%d/%d)",
+            task_result.task_id,
+            name,
+            attempt,
+            max_attempts,
+        )
+        return "failed"
+
+    task_obj = current_app.tasks.get(name)
+    if task_obj is None:
+        logger.error(
+            "Orphan %s: task %s not registered, cannot re-enqueue",
+            task_result.task_id,
+            name,
+        )
+        return "failed"
+
+    try:
+        args = _decode_celery_field(args_repr, [])
+        kwargs = _decode_celery_field(kwargs_repr, {})
+    except ValueError:
+        logger.error(
+            "Orphan %s (%s): could not decode stored args/kwargs, not re-enqueuing",
+            task_result.task_id,
+            name,
+        )
+        return "failed"
+    new_task_id = str(uuid4())
+    task_obj.apply_async(
+        args=list(args) if isinstance(args, (list, tuple)) else [],
+        kwargs=kwargs if isinstance(kwargs, dict) else {},
+        task_id=new_task_id,
+    )
+    logger.info(
+        "Re-enqueued orphan %s (%s) as %s", task_result.task_id, name, new_task_id
+    )
+    return "recovered"
diff --git a/api/src/backend/tasks/jobs/report.py b/api/src/backend/tasks/jobs/report.py
index 4cc3074bcd..36e47829c5 100644
--- a/api/src/backend/tasks/jobs/report.py
+++ b/api/src/backend/tasks/jobs/report.py
@@ -29,7 +29,10 @@ from api.db_router import READ_REPLICA_ALIAS, MainRouter
 from api.db_utils import rls_transaction
 from api.models import Provider, Scan, ScanSummary, StateChoices, ThreatScoreSnapshot
 from api.utils import initialize_prowler_provider
-from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.check.compliance_models import (
+    Compliance,
+    get_bulk_compliance_frameworks_universal,
+)
 from prowler.lib.outputs.finding import Finding as FindingOutput
 
 logger = get_task_logger(__name__)
@@ -571,7 +574,7 @@ def generate_csa_report(
     Args:
         tenant_id: The tenant ID for Row-Level Security context.
         scan_id: ID of the scan executed by Prowler.
-        compliance_id: ID of the compliance framework (e.g., "csa_ccm_4.0_aws").
+        compliance_id: ID of the compliance framework (e.g., "csa_ccm_4.0").
         output_path: Output PDF file path.
         provider_id: Provider ID for the scan.
         only_failed: If True, only include failed requirements in detailed section.
@@ -883,9 +886,11 @@ def generate_compliance_reports(
             frameworks_bulk.get(f"nis2_{provider_type}")
         )
     if generate_csa:
-        pending_checks_by_framework["csa"] = _get_compliance_check_ids(
-            frameworks_bulk.get(f"csa_ccm_4.0_{provider_type}")
-        )
+        # csa_ccm_4.0 lives at the top level, not under compliance/{provider}/.
+        csa_framework = frameworks_bulk.get(
+            "csa_ccm_4.0"
+        ) or get_bulk_compliance_frameworks_universal(provider_type).get("csa_ccm_4.0")
+        pending_checks_by_framework["csa"] = _get_compliance_check_ids(csa_framework)
     if generate_cis and latest_cis:
         pending_checks_by_framework["cis"] = _get_compliance_check_ids(
             frameworks_bulk.get(latest_cis)
@@ -1183,7 +1188,7 @@ def generate_compliance_reports(
     if generate_csa:
         generated_report_keys.append("csa")
         csa_path = output_paths["csa"]
-        compliance_id_csa = f"csa_ccm_4.0_{provider_type}"
+        compliance_id_csa = "csa_ccm_4.0"
         pdf_path_csa = f"{csa_path}_csa_report.pdf"
         logger.info("Generating CSA CCM report with compliance %s", compliance_id_csa)
 
diff --git a/api/src/backend/tasks/jobs/reports/base.py b/api/src/backend/tasks/jobs/reports/base.py
index 4180c847d8..27d1defff4 100644
--- a/api/src/backend/tasks/jobs/reports/base.py
+++ b/api/src/backend/tasks/jobs/reports/base.py
@@ -5,6 +5,7 @@ import time
 from abc import ABC, abstractmethod
 from contextlib import contextmanager
 from dataclasses import dataclass, field
+from types import SimpleNamespace
 from typing import Any
 
 from celery.utils.log import get_task_logger
@@ -26,7 +27,10 @@ from api.db_router import READ_REPLICA_ALIAS
 from api.db_utils import rls_transaction
 from api.models import Provider, StatusChoices
 from api.utils import initialize_prowler_provider
-from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.check.compliance_models import (
+    Compliance,
+    get_bulk_compliance_frameworks_universal,
+)
 from prowler.lib.outputs.finding import Finding as FindingOutput
 
 from .components import (
@@ -222,6 +226,46 @@ def get_requirement_metadata(
     return None
 
 
+def _universal_attributes_to_list(attributes) -> list:
+    """Flatten a universal requirement's ``attributes`` into a list of objects
+    with attribute access. MITRE wraps its list under ``_raw_attributes``."""
+    if isinstance(attributes, dict) and "_raw_attributes" in attributes:
+        entries = attributes.get("_raw_attributes") or []
+        return [
+            SimpleNamespace(**entry) for entry in entries if isinstance(entry, dict)
+        ]
+    if isinstance(attributes, dict):
+        return [SimpleNamespace(**attributes)] if attributes else []
+    return list(attributes or [])
+
+
+def _adapt_universal_to_legacy(framework, provider_type: str) -> SimpleNamespace:
+    """Expose a universal ``ComplianceFramework`` under the legacy ``Compliance``
+    attribute names used by the PDF pipeline."""
+    provider_key = (provider_type or "").lower()
+    requirements = []
+    for requirement in framework.requirements:
+        checks_by_provider = (
+            requirement.checks if isinstance(requirement.checks, dict) else {}
+        )
+        requirements.append(
+            SimpleNamespace(
+                Id=requirement.id,
+                Description=requirement.description or "",
+                Checks=list(checks_by_provider.get(provider_key, [])),
+                Attributes=_universal_attributes_to_list(requirement.attributes),
+            )
+        )
+    return SimpleNamespace(
+        Framework=framework.framework,
+        Name=framework.name,
+        Version=framework.version or "",
+        Description=framework.description or "",
+        Provider=framework.provider or provider_type,
+        Requirements=requirements,
+    )
+
+
 # =============================================================================
 # PDF Styles Cache
 # =============================================================================
@@ -869,9 +913,18 @@ class BaseComplianceReportGenerator(ABC):
                 prowler_provider = initialize_prowler_provider(provider_obj)
             provider_type = provider_obj.provider
 
-            # Load compliance framework
-            frameworks_bulk = Compliance.get_bulk(provider_type)
-            compliance_obj = frameworks_bulk.get(compliance_id)
+            # Load compliance framework — fall back to the universal loader
+            # for top-level JSONs (e.g. csa_ccm_4.0) that Compliance.get_bulk
+            # does not scan.
+            compliance_obj = Compliance.get_bulk(provider_type).get(compliance_id)
+            if not compliance_obj:
+                universal_framework = get_bulk_compliance_frameworks_universal(
+                    provider_type
+                ).get(compliance_id)
+                if universal_framework:
+                    compliance_obj = _adapt_universal_to_legacy(
+                        universal_framework, provider_type
+                    )
 
             if not compliance_obj:
                 raise ValueError(f"Compliance framework not found: {compliance_id}")
diff --git a/api/src/backend/tasks/jobs/scan.py b/api/src/backend/tasks/jobs/scan.py
index a772173a7f..f6ae3e6402 100644
--- a/api/src/backend/tasks/jobs/scan.py
+++ b/api/src/backend/tasks/jobs/scan.py
@@ -5,6 +5,7 @@ import re
 import time
 import uuid
 from collections import defaultdict
+from collections.abc import Iterable
 from datetime import datetime, timezone
 from typing import Any
 
@@ -22,7 +23,6 @@ from django.db.models import (
     Max,
     Min,
     OuterRef,
-    Prefetch,
     Q,
     Sum,
     When,
@@ -269,6 +269,7 @@ def _store_resources(
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
+                "name": finding.resource_name,
                 "region": finding.region,
                 "service": finding.service_name,
                 "type": finding.resource_type,
@@ -276,6 +277,7 @@ def _store_resources(
         )
 
         if not created:
+            resource_instance.name = finding.resource_name
             resource_instance.region = finding.region
             resource_instance.service = finding.service_name
             resource_instance.type = finding.resource_type
@@ -355,68 +357,71 @@ def _copy_compliance_requirement_rows(
 
 
 def _persist_compliance_requirement_rows(
-    tenant_id: str, rows: list[dict[str, Any]], batch_size: int = 10000
-) -> None:
+    tenant_id: str, rows: Iterable[dict[str, Any]], batch_size: int = 10000
+) -> int:
     """Persist compliance requirement rows using batched COPY with ORM fallback.
 
-    Splits large row sets into batches to reduce lock duration and improve concurrency.
+    ``rows`` is consumed lazily in batches, so peak memory stays at ~``batch_size``
+    rows instead of the full set. A batch that fails COPY falls back to an ORM
+    ``bulk_create`` of just that batch.
 
     Args:
         tenant_id: Target tenant UUID.
-        rows: Precomputed row dictionaries that reflect the compliance
-            overview state for a scan.
+        rows: Iterable of row dictionaries reflecting the compliance overview
+            state for a scan.
         batch_size: Number of rows per COPY batch (default: 10000).
+
+    Returns:
+        int: total number of rows persisted.
     """
-    if not rows:
-        return
-
-    total_rows = len(rows)
-    total_batches = (total_rows + batch_size - 1) // batch_size
-
-    try:
-        # Process rows in batches to reduce lock duration
-        for batch_num in range(total_batches):
-            start_idx = batch_num * batch_size
-            end_idx = min(start_idx + batch_size, total_rows)
-            batch = rows[start_idx:end_idx]
+    total_rows = 0
+    batch_num = 0
 
+    for batch, _is_last in batched(rows, batch_size):
+        if not batch:
+            continue
+        batch_num += 1
+        try:
             _copy_compliance_requirement_rows(tenant_id, batch)
+        except Exception as error:
+            logger.exception(
+                f"COPY bulk insert for compliance requirements batch {batch_num} "
+                "failed; falling back to ORM bulk_create for this batch",
+                exc_info=error,
+            )
+            fallback_objects = [
+                ComplianceRequirementOverview(
+                    id=row["id"],
+                    tenant_id=row["tenant_id"],
+                    inserted_at=row["inserted_at"],
+                    compliance_id=row["compliance_id"],
+                    framework=row["framework"],
+                    version=row["version"],
+                    description=row["description"],
+                    region=row["region"],
+                    requirement_id=row["requirement_id"],
+                    requirement_status=row["requirement_status"],
+                    passed_checks=row["passed_checks"],
+                    failed_checks=row["failed_checks"],
+                    total_checks=row["total_checks"],
+                    passed_findings=row.get("passed_findings", 0),
+                    total_findings=row.get("total_findings", 0),
+                    scan_id=row["scan_id"],
+                )
+                for row in batch
+            ]
+            with rls_transaction(tenant_id):
+                ComplianceRequirementOverview.objects.bulk_create(
+                    fallback_objects, batch_size=500
+                )
 
-            logger.info(
-                f"Compliance COPY batch {batch_num + 1}/{total_batches}: "
-                f"inserted {len(batch)} rows ({start_idx + len(batch)}/{total_rows} total)"
-            )
-    except Exception as error:
-        logger.exception(
-            "COPY bulk insert for compliance requirements failed; falling back to ORM bulk_create",
-            exc_info=error,
+        total_rows += len(batch)
+        logger.info(
+            f"Compliance COPY batch {batch_num}: inserted {len(batch)} rows "
+            f"({total_rows} total)"
         )
-        # Fallback: use ORM bulk_create for all remaining rows
-        fallback_objects = [
-            ComplianceRequirementOverview(
-                id=row["id"],
-                tenant_id=row["tenant_id"],
-                inserted_at=row["inserted_at"],
-                compliance_id=row["compliance_id"],
-                framework=row["framework"],
-                version=row["version"],
-                description=row["description"],
-                region=row["region"],
-                requirement_id=row["requirement_id"],
-                requirement_status=row["requirement_status"],
-                passed_checks=row["passed_checks"],
-                failed_checks=row["failed_checks"],
-                total_checks=row["total_checks"],
-                passed_findings=row.get("passed_findings", 0),
-                total_findings=row.get("total_findings", 0),
-                scan_id=row["scan_id"],
-            )
-            for row in rows
-        ]
-        with rls_transaction(tenant_id):
-            ComplianceRequirementOverview.objects.bulk_create(
-                fallback_objects, batch_size=500
-            )
+
+    return total_rows
 
 
 def _create_compliance_summaries(
@@ -476,9 +481,12 @@ def _create_compliance_summaries(
             )
         )
 
-    # Bulk insert summaries
-    if summary_objects:
-        with rls_transaction(tenant_id):
+    # Idempotent re-run: clear this scan's prior summaries before re-inserting, so a
+    # recovered scan-compliance-overviews run reflects its own re-derived rows instead
+    # of keeping a stale one (bulk_create ignore_conflicts alone would keep the old).
+    with rls_transaction(tenant_id):
+        ComplianceOverviewSummary.objects.filter(scan_id=scan_id).delete()
+        if summary_objects:
             ComplianceOverviewSummary.objects.bulk_create(
                 summary_objects, batch_size=500, ignore_conflicts=True
             )
@@ -701,6 +709,12 @@ def _process_finding_micro_batch(
                     if finding.region and resource_instance.region != finding.region:
                         resource_instance.region = finding.region
                         updated = True
+                    if (
+                        finding.resource_name
+                        and resource_instance.name != finding.resource_name
+                    ):
+                        resource_instance.name = finding.resource_name
+                        updated = True
                     if resource_instance.service != finding.service_name:
                         resource_instance.service = finding.service_name
                         updated = True
@@ -942,6 +956,7 @@ def _process_finding_micro_batch(
                         Resource.objects.bulk_update(
                             resources_to_bulk_update,
                             [
+                                "name",
                                 "metadata",
                                 "details",
                                 "partition",
@@ -1433,9 +1448,13 @@ def _aggregate_findings_by_region(
     tenant_id: str, scan_id: str, modeled_threatscore_compliance_id: str
 ) -> tuple[dict, dict]:
     """
-    Aggregate findings by region using optimized ORM queries.
+    Aggregate findings by region using streaming, column-scoped ORM reads.
 
-    Replaces nested Python loops with efficient queries and aggregation.
+    Reads only the consumed columns as tuples via ``values_list`` and streams
+    them with ``.iterator()``, using the denormalized ``resource_regions`` array
+    instead of ``prefetch_related("resources")``. ``resource_regions`` mirrors the
+    regions of a finding's related resources, so it yields the same per-region
+    tally without joining the resource table.
 
     Args:
         tenant_id: Tenant UUID
@@ -1447,12 +1466,12 @@ def _aggregate_findings_by_region(
             - check_status_by_region: {region: {check_id: status}}
             - findings_count_by_compliance: {region: {normalized_id: {requirement_id: {total, pass}}}}
     """
-    check_status_by_region = {}
-    findings_count_by_compliance = {}
+    check_status_by_region: dict = {}
+    findings_count_by_compliance: dict = {}
+
+    normalized_id = re.sub(r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower())
 
     with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
-        # Fetch only PASS/FAIL findings (optimized query reduces data transfer)
-        # Other statuses are not needed for check_status or ThreatScore calculation
         findings = (
             Finding.all_objects.filter(
                 tenant_id=tenant_id,
@@ -1460,42 +1479,28 @@ def _aggregate_findings_by_region(
                 muted=False,
                 status__in=["PASS", "FAIL"],
             )
-            .only("id", "check_id", "status", "compliance")
-            .prefetch_related(
-                Prefetch(
-                    "resources",
-                    queryset=Resource.objects.only("id", "region"),
-                    to_attr="small_resources",
-                )
+            .values_list("check_id", "status", "resource_regions", "compliance")
+            .iterator(chunk_size=DJANGO_FINDINGS_BATCH_SIZE)
+        )
+
+        for check_id, status, resource_regions, compliance in findings:
+            threatscore_requirements = (compliance or {}).get(
+                modeled_threatscore_compliance_id
             )
-        )
 
-        # Process findings in a single pass (more efficient than original nested loops)
-        normalized_id = re.sub(
-            r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
-        )
-
-        for finding in findings:
-            status = finding.status
-
-            for resource in finding.small_resources:
-                region = resource.region
-
-                # Aggregate check status by region
-                current_status = check_status_by_region.setdefault(region, {})
+            for region in resource_regions or ():
                 # Priority: FAIL > any other status
-                if current_status.get(finding.check_id) != "FAIL":
-                    current_status[finding.check_id] = status
+                current_status = check_status_by_region.setdefault(region, {})
+                if current_status.get(check_id) != "FAIL":
+                    current_status[check_id] = status
 
                 # Aggregate ThreatScore compliance counts
-                if modeled_threatscore_compliance_id in (finding.compliance or {}):
+                if threatscore_requirements:
                     compliance_key = findings_count_by_compliance.setdefault(
                         region, {}
                     ).setdefault(normalized_id, {})
 
-                    for requirement_id in finding.compliance[
-                        modeled_threatscore_compliance_id
-                    ]:
+                    for requirement_id in threatscore_requirements:
                         requirement_stats = compliance_key.setdefault(
                             requirement_id, {"total": 0, "pass": 0}
                         )
@@ -1542,8 +1547,8 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                         (compliance_id, requirement_id)
                     )
 
-        compliance_requirement_rows: list[dict[str, Any]] = []
         regions = []
+        requirements_created = 0
         requirement_statuses = defaultdict(
             lambda: {"fail_count": 0, "pass_count": 0, "total_count": 0}
         )
@@ -1583,44 +1588,93 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                         else:
                             requirement_stats["failed_checks"] += 1
 
-            # Prepare compliance requirement rows and compute summaries in single pass
             utc_datetime_now = datetime.now(tz=timezone.utc)
-
-            # Pre-compute shared strings (optimization: reduces string conversions)
             tenant_id_str = str(tenant_id)
             scan_id_str = str(scan_instance.id)
 
-            for region in regions:
-                region_stats = region_requirement_stats.get(region, {})
-                for compliance_id, compliance in compliance_template.items():
-                    modeled_compliance_id = _normalized_compliance_key(
-                        compliance["framework"], compliance["version"]
+            # Per-framework constants that don't depend on the region.
+            compliance_plan = []
+            for compliance_id, compliance in compliance_template.items():
+                modeled_compliance_id = _normalized_compliance_key(
+                    compliance["framework"], compliance["version"]
+                )
+                framework = compliance["framework"]
+                version = compliance["version"] or ""
+                requirements = [
+                    (
+                        requirement_id,
+                        requirement.get("description") or "",
+                        len(requirement["checks"]),
                     )
-                    compliance_stats = region_stats.get(compliance_id, {})
-                    # Create an overview record for each requirement within each compliance framework
                     for requirement_id, requirement in compliance[
                         "requirements"
-                    ].items():
-                        stats = compliance_stats.get(requirement_id)
-                        passed_checks = stats["passed_checks"] if stats else 0
-                        failed_checks = stats["failed_checks"] if stats else 0
-                        total_checks = len(requirement["checks"])
-                        if total_checks == 0:
-                            requirement_status = "MANUAL"
-                        elif failed_checks > 0:
-                            requirement_status = "FAIL"
-                        else:
-                            requirement_status = "PASS"
+                    ].items()
+                ]
+                compliance_plan.append(
+                    (
+                        compliance_id,
+                        framework,
+                        version,
+                        modeled_compliance_id,
+                        requirements,
+                    )
+                )
 
-                        compliance_requirement_rows.append(
-                            {
+            # Yield rows lazily (consumed batch-by-batch by COPY) so peak memory
+            # stays bounded; tally requirement_statuses in the same pass.
+            def _iter_compliance_requirement_rows():
+                for region in regions:
+                    region_stats = region_requirement_stats.get(region, {})
+                    region_findings = findings_count_by_compliance.get(region, {})
+                    for (
+                        compliance_id,
+                        framework,
+                        version,
+                        modeled_compliance_id,
+                        requirements,
+                    ) in compliance_plan:
+                        compliance_stats = region_stats.get(compliance_id, {})
+                        compliance_findings = region_findings.get(
+                            modeled_compliance_id, {}
+                        )
+                        for requirement_id, description, total_checks in requirements:
+                            stats = compliance_stats.get(requirement_id)
+                            if stats:
+                                passed_checks = stats["passed_checks"]
+                                failed_checks = stats["failed_checks"]
+                            else:
+                                passed_checks = 0
+                                failed_checks = 0
+                            if total_checks == 0:
+                                requirement_status = "MANUAL"
+                            elif failed_checks > 0:
+                                requirement_status = "FAIL"
+                            else:
+                                requirement_status = "PASS"
+
+                            finding_counts = compliance_findings.get(requirement_id)
+                            if finding_counts:
+                                passed_findings = finding_counts.get("pass", 0)
+                                total_findings = finding_counts.get("total", 0)
+                            else:
+                                passed_findings = 0
+                                total_findings = 0
+
+                            key = (compliance_id, requirement_id)
+                            requirement_statuses[key]["total_count"] += 1
+                            if requirement_status == "FAIL":
+                                requirement_statuses[key]["fail_count"] += 1
+                            elif requirement_status == "PASS":
+                                requirement_statuses[key]["pass_count"] += 1
+
+                            yield {
                                 "id": uuid.uuid4(),
                                 "tenant_id": tenant_id_str,
                                 "inserted_at": utc_datetime_now,
                                 "compliance_id": compliance_id,
-                                "framework": compliance["framework"],
-                                "version": compliance["version"] or "",
-                                "description": requirement.get("description") or "",
+                                "framework": framework,
+                                "version": version,
+                                "description": description,
                                 "region": region,
                                 "requirement_id": requirement_id,
                                 "requirement_status": requirement_status,
@@ -1628,37 +1682,23 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                                 "failed_checks": failed_checks,
                                 "total_checks": total_checks,
                                 "scan_id": scan_id_str,
-                                "passed_findings": findings_count_by_compliance.get(
-                                    region, {}
-                                )
-                                .get(modeled_compliance_id, {})
-                                .get(requirement_id, {})
-                                .get("pass", 0),
-                                "total_findings": findings_count_by_compliance.get(
-                                    region, {}
-                                )
-                                .get(modeled_compliance_id, {})
-                                .get(requirement_id, {})
-                                .get("total", 0),
+                                "passed_findings": passed_findings,
+                                "total_findings": total_findings,
                             }
-                        )
 
-                        # Update summary tracking (single-pass optimization)
-                        key = (compliance_id, requirement_id)
-                        requirement_statuses[key]["total_count"] += 1
-                        if requirement_status == "FAIL":
-                            requirement_statuses[key]["fail_count"] += 1
-                        elif requirement_status == "PASS":
-                            requirement_statuses[key]["pass_count"] += 1
+            # Idempotent re-run: clear this scan's rows before re-inserting.
+            with rls_transaction(tenant_id):
+                ComplianceRequirementOverview.objects.filter(scan_id=scan_id).delete()
 
-            # Bulk create requirement records using PostgreSQL COPY
-            _persist_compliance_requirement_rows(tenant_id, compliance_requirement_rows)
+            requirements_created = _persist_compliance_requirement_rows(
+                tenant_id, _iter_compliance_requirement_rows()
+            )
 
         # Create pre-aggregated summaries for fast compliance overview lookups
         _create_compliance_summaries(tenant_id, scan_id, requirement_statuses)
 
         return {
-            "requirements_created": len(compliance_requirement_rows),
+            "requirements_created": requirements_created,
             "regions_processed": list(regions),
             "compliance_frameworks": (
                 list(compliance_template.keys()) if regions else []
diff --git a/api/src/backend/tasks/jobs/threatscore_utils.py b/api/src/backend/tasks/jobs/threatscore_utils.py
index 7be32c6ade..35fb0faeb3 100644
--- a/api/src/backend/tasks/jobs/threatscore_utils.py
+++ b/api/src/backend/tasks/jobs/threatscore_utils.py
@@ -359,35 +359,40 @@ def _load_findings_for_requirement_checks(
 def _get_compliance_check_ids(compliance_obj) -> set[str]:
     """Return the union of all check_ids referenced by a compliance framework.
 
-    Used by the master report orchestrator to know which checks each
-    framework consumes from the shared ``findings_cache``, so that once a
-    framework finishes the entries no other pending framework needs can be
-    evicted from the cache (PROWLER-1733).
+    Used by the master report orchestrator to evict entries from
+    ``findings_cache`` once no pending framework needs them (PROWLER-1733).
 
-    Args:
-        compliance_obj: A loaded Compliance framework object exposing a
-            ``Requirements`` iterable, each requirement carrying ``Checks``.
-            ``None`` is treated as "no checks" rather than raising, so the
-            caller can pass ``frameworks_bulk.get(...)`` directly without
-            an extra existence check.
-
-    Returns:
-        Set of check_id strings (empty if ``compliance_obj`` is ``None``).
+    Accepts the legacy ``Compliance`` shape (``Requirements`` / ``Checks``
+    lists) and the universal ``ComplianceFramework`` shape (``requirements``
+    / ``checks`` dict keyed by provider). ``None`` returns an empty set so
+    callers can pass ``frameworks_bulk.get(...)`` directly.
     """
     if compliance_obj is None:
         return set()
-    checks: set[str] = set()
-    requirements = getattr(compliance_obj, "Requirements", None) or []
+
+    requirements = getattr(compliance_obj, "Requirements", None) or getattr(
+        compliance_obj, "requirements", None
+    )
+    if not requirements:
+        return set()
+
+    check_ids: set[str] = set()
     try:
-        # Defensive: Mock objects (used in unit tests) return another Mock
-        # for any attribute access, which is truthy but not iterable. Treat
-        # any non-iterable Requirements value as "no checks".
-        for req in requirements:
-            req_checks = getattr(req, "Checks", None) or []
+        # Mock objects in unit tests return another Mock for any attribute
+        # access — truthy but not iterable. Treat that as "no checks".
+        for requirement in requirements:
+            requirement_checks = getattr(requirement, "Checks", None)
+            if requirement_checks is None:
+                checks_by_provider = getattr(requirement, "checks", None) or {}
+                requirement_checks = [
+                    check_id
+                    for check_ids_list in checks_by_provider.values()
+                    for check_id in check_ids_list
+                ]
             try:
-                checks.update(req_checks)
+                check_ids.update(requirement_checks)
             except TypeError:
                 continue
     except TypeError:
         return set()
-    return checks
+    return check_ids
diff --git a/api/src/backend/tasks/tasks.py b/api/src/backend/tasks/tasks.py
index 0fda2999a9..e1e7100ae6 100644
--- a/api/src/backend/tasks/tasks.py
+++ b/api/src/backend/tasks/tasks.py
@@ -46,6 +46,7 @@ from tasks.jobs.lighthouse_providers import (
     refresh_lighthouse_provider_models,
 )
 from tasks.jobs.muting import mute_historical_findings
+from tasks.jobs.orphan_recovery import reconcile_orphans
 from tasks.jobs.report import (
     STALE_TMP_OUTPUT_MAX_AGE_HOURS,
     _cleanup_stale_tmp_output_directories,
@@ -67,7 +68,10 @@ from tasks.utils import (
     get_next_execution_datetime,
 )
 
-from api.compliance import get_compliance_frameworks
+from api.compliance import (
+    get_compliance_frameworks,
+    get_prowler_provider_compliance,
+)
 from api.db_router import READ_REPLICA_ALIAS
 from api.db_utils import delete_related_daily_task, rls_transaction
 from api.decorators import handle_provider_deletion, set_tenant
@@ -75,6 +79,9 @@ from api.models import Finding, Integration, Provider, Scan, ScanSummary, StateC
 from api.utils import initialize_prowler_provider
 from api.v1.serializers import ScanTaskSerializer
 from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.outputs.compliance.compliance import (
+    process_universal_compliance_frameworks,
+)
 from prowler.lib.outputs.compliance.generic.generic import GenericCompliance
 from prowler.lib.outputs.finding import Finding as FindingOutput
 
@@ -253,7 +260,9 @@ def delete_provider_task(provider_id: str, tenant_id: str):
     return delete_provider(tenant_id=tenant_id, pk=provider_id)
 
 
-@shared_task(base=RLSTask, name="scan-perform", queue="scans")
+# acks_late=False: a re-run would duplicate findings and the task is not auto-recovered,
+# so a crashed scan is dropped rather than redelivered by the broker (as before #11416).
+@shared_task(base=RLSTask, name="scan-perform", queue="scans", acks_late=False)
 @handle_provider_deletion
 def perform_scan_task(
     tenant_id: str, scan_id: str, provider_id: str, checks_to_execute: list[str] = None
@@ -297,7 +306,14 @@ def perform_scan_task(
     return result
 
 
-@shared_task(base=RLSTask, bind=True, name="scan-perform-scheduled", queue="scans")
+# acks_late=False: like scan-perform; a dropped run is re-fired by Beat on the next tick.
+@shared_task(
+    base=RLSTask,
+    bind=True,
+    name="scan-perform-scheduled",
+    queue="scans",
+    acks_late=False,
+)
 @handle_provider_deletion
 def perform_scheduled_scan_task(self, tenant_id: str, provider_id: str):
     """
@@ -462,13 +478,42 @@ def cleanup_stale_attack_paths_scans_task():
     return cleanup_stale_attack_paths_scans()
 
 
+@shared_task(name="reconcile-orphan-tasks", queue="celery")
+def reconcile_orphan_tasks_task():
+    """Periodic watchdog: recover tasks whose worker is gone (deploys, crashes)."""
+    return reconcile_orphans()
+
+
 @shared_task(name="tenant-deletion", queue="deletion", autoretry_for=(Exception,))
 def delete_tenant_task(tenant_id: str):
     return delete_tenant(pk=tenant_id)
 
 
+def _scan_tmp_output_directory(tenant_id: str, scan_id: str) -> Path:
+    """Root tmp output directory for a scan ({tmp}/{tenant_id}/{scan_id})."""
+    return Path(DJANGO_TMP_OUTPUT_DIRECTORY) / str(tenant_id) / str(scan_id)
+
+
+class ScanReportRLSTask(RLSTask):
+    """
+    RLS task that removes the scan's tmp output directory when the task fails.
+
+    Covers failures both inside and outside the task body (e.g. ENOSPC mid-write,
+    or setup errors) so partial artifacts do not accumulate on the worker disk.
+    """
+
+    def on_failure(self, exc, task_id, args, kwargs, _einfo):  # noqa: ARG002
+        del args  # Required by Celery's Task.on_failure signature; not used.
+        tenant_id = kwargs.get("tenant_id")
+        scan_id = kwargs.get("scan_id")
+
+        if tenant_id and scan_id:
+            logger.error(f"Scan report task {task_id} failed: {exc}")
+            rmtree(_scan_tmp_output_directory(tenant_id, scan_id), ignore_errors=True)
+
+
 @shared_task(
-    base=RLSTask,
+    base=ScanReportRLSTask,
     name="scan-report",
     queue="scan-reports",
 )
@@ -513,11 +558,23 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
     provider_uid = provider_obj.uid
     provider_type = provider_obj.provider
 
+    # Per-framework exporters in `COMPLIANCE_CLASS_MAP` consume the legacy bulk.
     frameworks_bulk = Compliance.get_bulk(provider_type)
+    # Universal-only frameworks (top-level JSONs like `dora_2022_2554.json`) are emitted
+    # via `process_universal_compliance_frameworks` below.
+    universal_bulk = get_prowler_provider_compliance(provider_type)
+    universal_only_names = {
+        name
+        for name in universal_bulk
+        if name not in frameworks_bulk and universal_bulk[name].outputs
+    }
     frameworks_avail = get_compliance_frameworks(provider_type)
     out_dir, comp_dir = _generate_output_directory(
         DJANGO_TMP_OUTPUT_DIRECTORY, provider_uid, tenant_id, scan_id
     )
+    # Removed on success here and on failure by ScanReportRLSTask.on_failure,
+    # so partial artifacts do not accumulate and fill the disk (ENOSPC).
+    scan_tmp_dir = _scan_tmp_output_directory(tenant_id, scan_id)
 
     def get_writer(writer_map, name, factory, is_last):
         """
@@ -535,6 +592,10 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
 
     output_writers = {}
     compliance_writers = {}
+    # Shared across batches so universal writers are created once and reused.
+    universal_compliance_state: dict[str, list] = {"compliance": []}
+    universal_base_dir = os.path.dirname(out_dir)
+    universal_output_filename = os.path.basename(out_dir)
 
     scan_summary = FindingOutput._transform_findings_stats(
         ScanSummary.objects.filter(scan_id=scan_id)
@@ -589,8 +650,30 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
                 writer.batch_write_data_to_file(**extra)
                 writer._data.clear()
 
-            # Compliance CSVs
+            # Universal-only frameworks (e.g. `dora_2022_2554.json`).
+            if universal_only_names:
+                process_universal_compliance_frameworks(
+                    input_compliance_frameworks=universal_only_names,
+                    universal_frameworks=universal_bulk,
+                    finding_outputs=fos,
+                    output_directory=universal_base_dir,
+                    output_filename=universal_output_filename,
+                    provider=provider_type,
+                    generated_outputs=universal_compliance_state,
+                    from_cli=False,
+                    is_last=is_last,
+                )
+
+            # Compliance CSVs (per-framework exporters).
             for name in frameworks_avail:
+                if name in universal_only_names:
+                    continue
+                if name not in frameworks_bulk:
+                    logger.warning(
+                        "Compliance framework '%s' missing from bulk; skipping CSV export",
+                        name,
+                    )
+                    continue
                 compliance_obj = frameworks_bulk[name]
 
                 klass = GenericCompliance
@@ -666,7 +749,7 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
         # TODO: We need to create a new periodic task to delete the output files
         # This task shouldn't be responsible for deleting the output files
         try:
-            rmtree(Path(compressed).parent, ignore_errors=True)
+            rmtree(scan_tmp_dir, ignore_errors=True)
         except Exception as e:
             logger.error(f"Error deleting output files: {e}")
         final_location, did_upload = upload_uri, True
@@ -1077,10 +1160,13 @@ def security_hub_integration_task(
     return upload_security_hub_integration(tenant_id, provider_id, scan_id)
 
 
+# acks_late=False: Jira sends are not deduplicated and the task is not auto-recovered,
+# so a crashed send is dropped rather than redelivered (avoids duplicate Jira issues).
 @shared_task(
     base=RLSTask,
     name="integration-jira",
     queue="integrations",
+    acks_late=False,
 )
 def jira_integration_task(
     tenant_id: str,
diff --git a/api/src/backend/tasks/tests/test_orphan_recovery.py b/api/src/backend/tasks/tests/test_orphan_recovery.py
new file mode 100644
index 0000000000..abfa920b8e
--- /dev/null
+++ b/api/src/backend/tasks/tests/test_orphan_recovery.py
@@ -0,0 +1,408 @@
+from datetime import datetime, timedelta, timezone
+from unittest.mock import MagicMock, patch
+from uuid import uuid4
+
+import pytest
+from celery import states
+from django.test import override_settings
+from django_celery_results.models import TaskResult
+
+from tasks.jobs.orphan_recovery import (
+    _decode_celery_field,
+    _reconcile_task_results,
+    _recovery_attempt_count,
+    advisory_lock,
+    is_worker_alive,
+    reconcile_orphans,
+    reenqueueable_tasks,
+)
+
+
+def _orphan_result(*, name, kwargs, worker, created_minutes_ago, status=states.STARTED):
+    """Create a TaskResult mimicking an in-flight task, backdated past the grace."""
+    tr = TaskResult.objects.create(
+        task_id=str(uuid4()),
+        status=status,
+        task_name=name,
+        worker=worker,
+        task_kwargs=repr(kwargs),
+        task_args=repr([]),
+    )
+    TaskResult.objects.filter(pk=tr.pk).update(
+        date_created=datetime.now(tz=timezone.utc)
+        - timedelta(minutes=created_minutes_ago)
+    )
+    tr.refresh_from_db()
+    return tr
+
+
+@pytest.mark.django_db
+class TestDecodeCeleryField:
+    def test_decodes_single_encoded_repr(self):
+        assert _decode_celery_field("{'tenant_id': 'abc'}", {}) == {"tenant_id": "abc"}
+
+    def test_decodes_double_encoded(self):
+        import json
+
+        stored = json.dumps(repr({"tenant_id": "abc", "scan_id": "s1"}))
+        assert _decode_celery_field(stored, {}) == {"tenant_id": "abc", "scan_id": "s1"}
+
+    def test_empty_returns_default(self):
+        assert _decode_celery_field(None, {}) == {}
+        assert _decode_celery_field("", []) == []
+
+    def test_unparseable_raises(self):
+        with pytest.raises(ValueError):
+            _decode_celery_field("<<not a literal>>", {})
+
+
+@pytest.mark.django_db
+class TestReconcileTaskResults:
+    def _patches(self, alive):
+        """Patch worker liveness, revoke, and the task registry for re-enqueue."""
+        mock_app = MagicMock()
+        mock_task = MagicMock()
+        mock_app.tasks.get.return_value = mock_task
+        return (
+            patch("tasks.jobs.orphan_recovery.is_worker_alive", return_value=alive),
+            patch("tasks.jobs.orphan_recovery.revoke_task"),
+            patch("tasks.jobs.orphan_recovery.current_app", mock_app),
+            mock_task,
+        )
+
+    def test_recovers_non_scan_task(self, tenants_fixture):
+        """A NON-scan task (tenant-deletion) left orphaned is re-enqueued too."""
+        tenant = tenants_fixture[0]
+        tr = _orphan_result(
+            name="tenant-deletion",
+            kwargs={"tenant_id": str(tenant.id)},
+            worker="dead@gone",
+            created_minutes_ago=60,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
+        with (
+            p_alive,
+            p_revoke,
+            p_app,
+            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
+        ):
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        assert tr.task_id in result["recovered"]
+        tr.refresh_from_db()
+        assert tr.status == states.REVOKED  # stale result cleared (no pending alert)
+        mock_task.apply_async.assert_called_once()
+        call = mock_task.apply_async.call_args.kwargs
+        assert call["kwargs"] == {"tenant_id": str(tenant.id)}
+        assert call["task_id"] != tr.task_id  # fresh task id
+
+    def test_external_integration_task_is_not_reenqueued_by_default(
+        self, tenants_fixture
+    ):
+        """External side-effect tasks without proven idempotency stay terminal.
+
+        integration-s3 rebuilds its upload from worker-local files that do not
+        survive the crash, so re-enqueuing it would upload nothing.
+        """
+        tr = _orphan_result(
+            name="integration-s3",
+            kwargs={
+                "tenant_id": str(tenants_fixture[0].id),
+                "provider_id": str(uuid4()),
+                "output_directory": "/tmp/gone",
+            },
+            worker="dead@gone",
+            created_minutes_ago=60,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
+        with (
+            p_alive,
+            p_revoke,
+            p_app,
+            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
+        ):
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        assert tr.task_id in result["failed"]
+        mock_task.apply_async.assert_not_called()
+
+    @override_settings(TASK_RECOVERY_SUMMARIES_ENABLED=False)
+    def test_disabled_group_task_is_not_reenqueued(self, tenants_fixture):
+        """A task whose group feature flag is off stays terminal, not re-enqueued."""
+        tr = _orphan_result(
+            name="scan-summary",
+            kwargs={
+                "tenant_id": str(tenants_fixture[0].id),
+                "scan_id": str(uuid4()),
+            },
+            worker="dead@gone",
+            created_minutes_ago=60,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
+        with (
+            p_alive,
+            p_revoke,
+            p_app,
+            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
+        ):
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        assert tr.task_id in result["failed"]
+        mock_task.apply_async.assert_not_called()
+
+    @override_settings(TASK_RECOVERY_SUMMARIES_ENABLED=False)
+    def test_disabled_group_task_does_not_consume_recovery_attempt(
+        self, tenants_fixture
+    ):
+        """A disabled-group task is failed without incrementing its Valkey attempt
+        counter, so re-enabling the group does not start it at the cap."""
+        tr = _orphan_result(
+            name="scan-summary",
+            kwargs={"tenant_id": str(tenants_fixture[0].id), "scan_id": str(uuid4())},
+            worker="dead@gone",
+            created_minutes_ago=60,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
+        with (
+            p_alive,
+            p_revoke,
+            p_app,
+            patch("tasks.jobs.orphan_recovery._recovery_attempt_count") as mock_count,
+        ):
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        assert tr.task_id in result["failed"]
+        mock_count.assert_not_called()
+
+    def test_scan_task_is_skipped_entirely(self, tenants_fixture):
+        """Scan tasks are excluded from recovery: the watchdog never touches them."""
+        tr = _orphan_result(
+            name="scan-perform",
+            kwargs={
+                "tenant_id": str(tenants_fixture[0].id),
+                "scan_id": str(uuid4()),
+            },
+            worker="dead@gone",
+            created_minutes_ago=60,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
+        with p_alive, p_revoke, p_app:
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        assert tr.task_id not in result["recovered"]
+        assert tr.task_id not in result["failed"]
+        assert tr.task_id not in result["skipped"]
+        mock_task.apply_async.assert_not_called()
+
+    def test_jira_integration_task_is_not_reenqueued(self, tenants_fixture):
+        """integration-jira stays terminal: re-running it would create duplicate Jira
+        issues, so an orphaned send is failed instead of re-enqueued."""
+        tenant = tenants_fixture[0]
+        kwargs = {
+            "tenant_id": str(tenant.id),
+            "integration_id": str(uuid4()),
+            "project_key": "PROWLER",
+            "issue_type": "Task",
+            "finding_ids": [str(uuid4()), str(uuid4())],
+        }
+        tr = _orphan_result(
+            name="integration-jira",
+            kwargs=kwargs,
+            worker="dead@gone",
+            created_minutes_ago=60,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
+        with (
+            p_alive,
+            p_revoke,
+            p_app,
+            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
+        ):
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        assert tr.task_id in result["failed"]
+        tr.refresh_from_db()
+        assert tr.status == states.REVOKED  # stale result cleared (no pending alert)
+        mock_task.apply_async.assert_not_called()
+
+    def test_skips_live_worker(self, tenants_fixture):
+        tr = _orphan_result(
+            name="tenant-deletion",
+            kwargs={"tenant_id": str(tenants_fixture[0].id)},
+            worker="alive@host",
+            created_minutes_ago=60,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=True)
+        with p_alive, p_revoke, p_app:
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        assert tr.task_id in result["skipped"]
+        mock_task.apply_async.assert_not_called()
+
+    def test_skips_recently_created(self, tenants_fixture):
+        tr = _orphan_result(
+            name="tenant-deletion",
+            kwargs={"tenant_id": str(tenants_fixture[0].id)},
+            worker="dead@gone",
+            created_minutes_ago=0,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
+        with p_alive, p_revoke, p_app:
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        # too recent: excluded by the grace window (not even a candidate)
+        assert tr.task_id not in result["recovered"]
+        mock_task.apply_async.assert_not_called()
+
+    def test_denylisted_task_failed_not_reenqueued(self, tenants_fixture):
+        """A non-allowlisted task is failed, never blind re-run."""
+        tr = _orphan_result(
+            name="some-non-idempotent-task",
+            kwargs={"tenant_id": str(tenants_fixture[0].id)},
+            worker="dead@gone",
+            created_minutes_ago=60,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
+        with (
+            p_alive,
+            p_revoke,
+            p_app,
+            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
+        ):
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        assert tr.task_id in result["failed"]
+        tr.refresh_from_db()
+        assert tr.status == states.REVOKED
+        mock_task.apply_async.assert_not_called()
+
+    def test_recovery_cap_marks_failed(self, tenants_fixture):
+        """When the recovery counter exceeds the cap, the task is failed not re-run."""
+        tr = _orphan_result(
+            name="tenant-deletion",
+            kwargs={"tenant_id": str(tenants_fixture[0].id)},
+            worker="dead@gone",
+            created_minutes_ago=60,
+        )
+        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
+        with (
+            p_alive,
+            p_revoke,
+            p_app,
+            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=4),
+        ):
+            result = _reconcile_task_results(
+                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
+            )
+
+        assert tr.task_id in result["failed"]
+        mock_task.apply_async.assert_not_called()
+
+
+@pytest.mark.django_db
+class TestOrphanRecoveryHelpers:
+    def test_advisory_lock_acquires_and_releases(self):
+        with advisory_lock() as acquired:
+            assert acquired is True
+
+    def test_is_worker_alive_true_when_responds(self):
+        inspect = MagicMock()
+        inspect.ping.return_value = {"w@h": {"ok": "pong"}}
+        with patch(
+            "tasks.jobs.orphan_recovery.current_app.control.inspect",
+            return_value=inspect,
+        ):
+            assert is_worker_alive("w@h") is True
+
+    def test_is_worker_alive_false_when_silent(self):
+        inspect = MagicMock()
+        inspect.ping.return_value = None
+        with patch(
+            "tasks.jobs.orphan_recovery.current_app.control.inspect",
+            return_value=inspect,
+        ):
+            assert is_worker_alive("w@h") is False
+
+    def test_recovery_attempt_count_increments(self):
+        # Unique signature so the Valkey counter starts fresh for this test.
+        kwargs_repr = repr({"probe": str(uuid4())})
+        redis_client = MagicMock()
+        redis_client.incr.side_effect = [1, 2]
+        with patch("redis.from_url", return_value=redis_client):
+            assert _recovery_attempt_count("probe-task", kwargs_repr, 6) == 1
+            assert _recovery_attempt_count("probe-task", kwargs_repr, 6) == 2
+
+
+class TestRecoveryFeatureFlags:
+    def test_all_groups_enabled_by_default(self):
+        tasks = reenqueueable_tasks()
+        assert "scan-summary" in tasks
+        assert {"provider-deletion", "tenant-deletion"} <= tasks
+
+    @override_settings(TASK_RECOVERY_SUMMARIES_ENABLED=False)
+    def test_summaries_group_flag_excludes_summary_tasks(self):
+        tasks = reenqueueable_tasks()
+        assert "scan-summary" not in tasks
+        assert "scan-compliance-overviews" not in tasks
+        assert "provider-deletion" in tasks
+
+    @override_settings(TASK_RECOVERY_DELETIONS_ENABLED=False)
+    def test_deletions_group_flag_excludes_deletion_tasks(self):
+        tasks = reenqueueable_tasks()
+        assert "provider-deletion" not in tasks
+        assert "tenant-deletion" not in tasks
+        assert "scan-summary" in tasks
+
+
+@pytest.mark.django_db
+class TestRecoveryMasterFlag:
+    @override_settings(TASK_RECOVERY_ENABLED=False)
+    def test_master_flag_disables_task_recovery(self):
+        with (
+            patch(
+                "tasks.jobs.orphan_recovery._reconcile_task_results"
+            ) as mock_reconcile,
+            patch(
+                "tasks.jobs.attack_paths.cleanup.cleanup_stale_attack_paths_scans",
+                return_value={},
+            ),
+        ):
+            result = reconcile_orphans(grace_minutes=2, max_attempts=3, dry_run=False)
+
+        mock_reconcile.assert_not_called()
+        assert result["acquired"] is True
+        assert result["enabled"] is False
+
+    @override_settings(TASK_RECOVERY_ENABLED=True)
+    def test_master_flag_enabled_runs_task_recovery(self):
+        with (
+            patch(
+                "tasks.jobs.orphan_recovery._reconcile_task_results",
+                return_value={"recovered": [], "failed": [], "skipped": []},
+            ) as mock_reconcile,
+            patch(
+                "tasks.jobs.attack_paths.cleanup.cleanup_stale_attack_paths_scans",
+                return_value={},
+            ),
+        ):
+            reconcile_orphans(grace_minutes=2, max_attempts=3, dry_run=False)
+
+        mock_reconcile.assert_called_once()
diff --git a/api/src/backend/tasks/tests/test_reports_csa.py b/api/src/backend/tasks/tests/test_reports_csa.py
index 602b9bb28e..2e61e9ef84 100644
--- a/api/src/backend/tasks/tests/test_reports_csa.py
+++ b/api/src/backend/tasks/tests/test_reports_csa.py
@@ -80,7 +80,7 @@ def basic_csa_compliance_data():
         tenant_id="tenant-123",
         scan_id="scan-456",
         provider_id="provider-789",
-        compliance_id="csa_ccm_4.0_aws",
+        compliance_id="csa_ccm_4.0",
         framework="CSA-CCM",
         name="CSA Cloud Controls Matrix v4.0",
         version="4.0",
diff --git a/api/src/backend/tasks/tests/test_scan.py b/api/src/backend/tasks/tests/test_scan.py
index 0a7193cd4d..130d8ae118 100644
--- a/api/src/backend/tasks/tests/test_scan.py
+++ b/api/src/backend/tasks/tests/test_scan.py
@@ -315,6 +315,7 @@ class TestPerformScan:
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
+                "name": finding.resource_name,
                 "region": finding.region,
                 "service": finding.service_name,
                 "type": finding.resource_type,
@@ -348,6 +349,7 @@ class TestPerformScan:
 
         resource_instance = MagicMock()
         resource_instance.uid = finding.resource_uid
+        resource_instance.name = "old_name"
         resource_instance.region = "us-west-1"
         resource_instance.service = "old_service"
         resource_instance.type = "old_type"
@@ -366,6 +368,7 @@ class TestPerformScan:
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
+                "name": finding.resource_name,
                 "region": finding.region,
                 "service": finding.service_name,
                 "type": finding.resource_type,
@@ -373,6 +376,7 @@ class TestPerformScan:
         )
 
         # Check that resource fields were updated
+        assert resource_instance.name == finding.resource_name
         assert resource_instance.region == finding.region
         assert resource_instance.service == finding.service_name
         assert resource_instance.type == finding.resource_type
@@ -1565,6 +1569,75 @@ class TestProcessFindingMicroBatch:
         assert resource_cache[finding.resource_uid].service == finding.service_name
         assert tag_cache.keys() == {("team", "devsec")}
 
+    def test_process_finding_micro_batch_refreshes_empty_resource_name(
+        self, tenants_fixture, scans_fixture
+    ):
+        tenant = tenants_fixture[0]
+        scan = scans_fixture[0]
+        provider = scan.provider
+
+        # Old resource stored before names were persisted: empty name.
+        existing_resource = Resource.objects.create(
+            tenant_id=tenant.id,
+            provider=provider,
+            uid="arn:aws:s3:::my-bucket",
+            name="",
+            region="us-east-1",
+            service="s3",
+            type="bucket",
+        )
+
+        finding = FakeFinding(
+            uid="finding-empty-name",
+            status=StatusChoices.PASS,
+            status_extended="passing",
+            severity=Severity.low,
+            check_id="s3_bucket_public_access",
+            resource_uid=existing_resource.uid,
+            resource_name="my-bucket",
+            region="us-east-1",
+            service_name="s3",
+            resource_type="bucket",
+            partition="aws",
+            raw={"status": "PASS"},
+            metadata={"source": "prowler"},
+        )
+
+        resource_cache = {existing_resource.uid: existing_resource}
+        tag_cache = {}
+        last_status_cache = {}
+        resource_failed_findings_cache = {existing_resource.uid: 0}
+        unique_resources: set[tuple[str, str]] = set()
+        scan_resource_cache: set[tuple[str, str, str, str]] = set()
+        mute_rules_cache = {}
+        scan_categories_cache: dict[tuple[str, str], dict[str, int]] = {}
+        scan_resource_groups_cache: dict[tuple[str, str], dict[str, int]] = {}
+        group_resources_cache: dict[str, set] = {}
+
+        with (
+            patch("tasks.jobs.scan.rls_transaction", new=noop_rls_transaction),
+            patch("api.db_utils.rls_transaction", new=noop_rls_transaction),
+        ):
+            _process_finding_micro_batch(
+                str(tenant.id),
+                [finding],
+                scan,
+                provider,
+                resource_cache,
+                tag_cache,
+                last_status_cache,
+                resource_failed_findings_cache,
+                unique_resources,
+                scan_resource_cache,
+                mute_rules_cache,
+                scan_categories_cache,
+                scan_resource_groups_cache,
+                group_resources_cache,
+            )
+
+        existing_resource.refresh_from_db()
+        assert existing_resource.name == finding.resource_name
+
     def test_process_finding_micro_batch_skips_long_uid(
         self, tenants_fixture, scans_fixture
     ):
@@ -1880,6 +1953,62 @@ class TestCreateComplianceRequirements:
 
             assert "requirements_created" in result
 
+    @pytest.mark.django_db(transaction=True)
+    def test_create_compliance_requirements_idempotent_on_rerun(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+        findings_fixture,
+    ):
+        """Re-running compliance materialization must not raise nor duplicate rows.
+
+        Uses transaction=True because the COPY path commits on its own connection,
+        so the test must use real commits (mirroring production) rather than the
+        default rollback wrapper.
+        """
+        from api.models import ComplianceRequirementOverview
+
+        with patch(
+            "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+        ) as mock_compliance_template:
+            tenant_id = str(tenants_fixture[0].id)
+            scan_id = str(scans_fixture[0].id)
+
+            mock_compliance_template.__getitem__.return_value = {
+                "test_compliance": {
+                    "framework": "Test Framework",
+                    "version": "1.0",
+                    "requirements": {
+                        "req_1": {
+                            "description": "Test Requirement 1",
+                            "checks": {"test_check_id": None},
+                            "checks_status": {
+                                "pass": 2,
+                                "fail": 1,
+                                "manual": 0,
+                                "total": 3,
+                            },
+                            "status": "FAIL",
+                        },
+                    },
+                }
+            }
+
+            create_compliance_requirements(tenant_id, scan_id)
+            count_after_first = ComplianceRequirementOverview.objects.filter(
+                scan_id=scan_id
+            ).count()
+
+            # Second run must not raise and must not duplicate rows.
+            create_compliance_requirements(tenant_id, scan_id)
+            count_after_second = ComplianceRequirementOverview.objects.filter(
+                scan_id=scan_id
+            ).count()
+
+        assert count_after_first > 0
+        assert count_after_second == count_after_first
+
     def test_create_compliance_requirements_kubernetes_provider(
         self,
         tenants_fixture,
@@ -3545,19 +3674,19 @@ class TestAggregateFindingsByRegion:
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        # Mock findings with resources
-        mock_finding1 = MagicMock()
-        mock_finding1.check_id = "check1"
-        mock_finding1.status = "FAIL"
-        mock_finding1.compliance = {modeled_threatscore_compliance_id: ["req1", "req2"]}
-
-        mock_resource1 = MagicMock()
-        mock_resource1.region = "us-east-1"
-        mock_finding1.small_resources = [mock_resource1]
+        # (check_id, status, resource_regions, compliance) tuples
+        finding_rows = [
+            (
+                "check1",
+                "FAIL",
+                ["us-east-1"],
+                {modeled_threatscore_compliance_id: ["req1", "req2"]},
+            )
+        ]
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = [mock_finding1]
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3571,6 +3700,12 @@ class TestAggregateFindingsByRegion:
             )
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # Verify structure of check_status_by_region
         assert isinstance(check_status_by_region, dict)
         assert "us-east-1" in check_status_by_region
@@ -3590,27 +3725,15 @@ class TestAggregateFindingsByRegion:
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        # First finding with PASS status
-        mock_finding1 = MagicMock()
-        mock_finding1.check_id = "check1"
-        mock_finding1.status = "PASS"
-        mock_finding1.compliance = {}
-        mock_resource1 = MagicMock()
-        mock_resource1.region = "us-east-1"
-        mock_finding1.small_resources = [mock_resource1]
-
-        # Second finding with FAIL status for same check/region
-        mock_finding2 = MagicMock()
-        mock_finding2.check_id = "check1"
-        mock_finding2.status = "FAIL"
-        mock_finding2.compliance = {}
-        mock_resource2 = MagicMock()
-        mock_resource2.region = "us-east-1"
-        mock_finding2.small_resources = [mock_resource2]
+        # Same check/region: PASS first, then FAIL — FAIL must win
+        finding_rows = [
+            ("check1", "PASS", ["us-east-1"], {}),
+            ("check1", "FAIL", ["us-east-1"], {}),
+        ]
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = [mock_finding1, mock_finding2]
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3622,6 +3745,12 @@ class TestAggregateFindingsByRegion:
             tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # FAIL should override PASS
         assert check_status_by_region["us-east-1"]["check1"] == "FAIL"
 
@@ -3636,8 +3765,8 @@ class TestAggregateFindingsByRegion:
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = []
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = []
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3649,6 +3778,12 @@ class TestAggregateFindingsByRegion:
             tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # Verify filter was called with muted=False
         mock_findings_filter.assert_called_once_with(
             tenant_id=tenant_id,
@@ -3667,27 +3802,25 @@ class TestAggregateFindingsByRegion:
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        # Finding with PASS status
-        mock_finding1 = MagicMock()
-        mock_finding1.check_id = "check1"
-        mock_finding1.status = "PASS"
-        mock_finding1.compliance = {modeled_threatscore_compliance_id: ["req1"]}
-        mock_resource1 = MagicMock()
-        mock_resource1.region = "us-east-1"
-        mock_finding1.small_resources = [mock_resource1]
-
-        # Finding with FAIL status
-        mock_finding2 = MagicMock()
-        mock_finding2.check_id = "check2"
-        mock_finding2.status = "FAIL"
-        mock_finding2.compliance = {modeled_threatscore_compliance_id: ["req1"]}
-        mock_resource2 = MagicMock()
-        mock_resource2.region = "us-east-1"
-        mock_finding2.small_resources = [mock_resource2]
+        # PASS and FAIL findings mapped to the same ThreatScore requirement
+        finding_rows = [
+            (
+                "check1",
+                "PASS",
+                ["us-east-1"],
+                {modeled_threatscore_compliance_id: ["req1"]},
+            ),
+            (
+                "check2",
+                "FAIL",
+                ["us-east-1"],
+                {modeled_threatscore_compliance_id: ["req1"]},
+            ),
+        ]
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = [mock_finding1, mock_finding2]
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3699,6 +3832,12 @@ class TestAggregateFindingsByRegion:
             tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # Verify compliance counts
         normalized_id = re.sub(
             r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
@@ -3721,27 +3860,15 @@ class TestAggregateFindingsByRegion:
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        # Finding in us-east-1
-        mock_finding1 = MagicMock()
-        mock_finding1.check_id = "check1"
-        mock_finding1.status = "FAIL"
-        mock_finding1.compliance = {}
-        mock_resource1 = MagicMock()
-        mock_resource1.region = "us-east-1"
-        mock_finding1.small_resources = [mock_resource1]
-
-        # Finding in us-west-2
-        mock_finding2 = MagicMock()
-        mock_finding2.check_id = "check1"
-        mock_finding2.status = "PASS"
-        mock_finding2.compliance = {}
-        mock_resource2 = MagicMock()
-        mock_resource2.region = "us-west-2"
-        mock_finding2.small_resources = [mock_resource2]
+        # One finding per region
+        finding_rows = [
+            ("check1", "FAIL", ["us-east-1"], {}),
+            ("check1", "PASS", ["us-west-2"], {}),
+        ]
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = [mock_finding1, mock_finding2]
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3753,6 +3880,12 @@ class TestAggregateFindingsByRegion:
             tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # Verify both regions are present with correct statuses
         assert "us-east-1" in check_status_by_region
         assert "us-west-2" in check_status_by_region
@@ -3761,17 +3894,26 @@ class TestAggregateFindingsByRegion:
 
     @patch("tasks.jobs.scan.Finding.all_objects.filter")
     @patch("tasks.jobs.scan.rls_transaction")
-    def test_aggregate_findings_by_region_empty_findings(
+    def test_aggregate_findings_by_region_multi_region_finding(
         self, mock_rls_transaction, mock_findings_filter
     ):
-        """Test with no findings - should return empty dicts."""
+        """A finding with multiple resource_regions is tallied in every region."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
+        finding_rows = [
+            (
+                "check1",
+                "FAIL",
+                ["us-east-1", "eu-west-1"],
+                {modeled_threatscore_compliance_id: ["req1"]},
+            )
+        ]
+
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = []
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3785,6 +3927,92 @@ class TestAggregateFindingsByRegion:
             )
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
+        normalized_id = re.sub(
+            r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
+        )
+        for region in ("us-east-1", "eu-west-1"):
+            assert check_status_by_region[region]["check1"] == "FAIL"
+            req_stats = findings_count_by_compliance[region][normalized_id]["req1"]
+            assert req_stats == {"total": 1, "pass": 0}
+
+    @patch("tasks.jobs.scan.Finding.all_objects.filter")
+    @patch("tasks.jobs.scan.rls_transaction")
+    def test_aggregate_findings_by_region_skips_empty_regions(
+        self, mock_rls_transaction, mock_findings_filter
+    ):
+        """A finding with no denormalized regions contributes nothing."""
+        tenant_id = str(uuid.uuid4())
+        scan_id = str(uuid.uuid4())
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+
+        finding_rows = [
+            ("check1", "FAIL", [], {modeled_threatscore_compliance_id: ["req1"]}),
+            ("check2", "PASS", None, {}),
+        ]
+
+        mock_queryset = MagicMock()
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
+
+        ctx = MagicMock()
+        ctx.__enter__.return_value = None
+        ctx.__exit__.return_value = False
+        mock_rls_transaction.return_value = ctx
+        mock_findings_filter.return_value = mock_queryset
+
+        check_status_by_region, findings_count_by_compliance = (
+            _aggregate_findings_by_region(
+                tenant_id, scan_id, modeled_threatscore_compliance_id
+            )
+        )
+
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
+        assert check_status_by_region == {}
+        assert findings_count_by_compliance == {}
+
+    @patch("tasks.jobs.scan.Finding.all_objects.filter")
+    @patch("tasks.jobs.scan.rls_transaction")
+    def test_aggregate_findings_by_region_empty_findings(
+        self, mock_rls_transaction, mock_findings_filter
+    ):
+        """Test with no findings - should return empty dicts."""
+        tenant_id = str(uuid.uuid4())
+        scan_id = str(uuid.uuid4())
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+
+        mock_queryset = MagicMock()
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = []
+
+        ctx = MagicMock()
+        ctx.__enter__.return_value = None
+        ctx.__exit__.return_value = False
+        mock_rls_transaction.return_value = ctx
+        mock_findings_filter.return_value = mock_queryset
+
+        check_status_by_region, findings_count_by_compliance = (
+            _aggregate_findings_by_region(
+                tenant_id, scan_id, modeled_threatscore_compliance_id
+            )
+        )
+
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         assert check_status_by_region == {}
         assert findings_count_by_compliance == {}
 
diff --git a/api/src/backend/tasks/tests/test_tasks.py b/api/src/backend/tasks/tests/test_tasks.py
index f15bdf7192..67d2c64555 100644
--- a/api/src/backend/tasks/tests/test_tasks.py
+++ b/api/src/backend/tasks/tests/test_tasks.py
@@ -15,8 +15,10 @@ from tasks.jobs.lighthouse_providers import (
 from tasks.tasks import (
     DJANGO_TMP_OUTPUT_DIRECTORY,
     STALE_TMP_OUTPUT_MAX_AGE_HOURS,
+    ScanReportRLSTask,
     _cleanup_orphan_scheduled_scans,
     _perform_scan_complete_tasks,
+    _scan_tmp_output_directory,
     check_integrations_task,
     check_lighthouse_provider_connection_task,
     generate_outputs_task,
@@ -321,6 +323,7 @@ class TestGenerateOutputs:
 
         mock_transformed_stats = {"some": "stats"}
         with (
+            patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
             patch(
                 "tasks.tasks.FindingOutput._transform_findings_stats",
                 return_value=mock_transformed_stats,
@@ -439,6 +442,7 @@ class TestGenerateOutputs:
         mock_provider.uid = "test-provider-uid"
 
         with (
+            patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
             patch("tasks.tasks.ScanSummary.objects.filter") as mock_filter,
             patch("tasks.tasks.Provider.objects.get", return_value=mock_provider),
             patch("tasks.tasks.initialize_prowler_provider"),
@@ -594,6 +598,7 @@ class TestGenerateOutputs:
         ]
 
         with (
+            patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
             patch("tasks.tasks.ScanSummary.objects.filter") as mock_summary,
             patch(
                 "tasks.tasks.Provider.objects.get",
@@ -668,6 +673,7 @@ class TestGenerateOutputs:
         mock_provider.uid = "test-provider-uid"
 
         with (
+            patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
             patch("tasks.tasks.ScanSummary.objects.filter") as mock_filter,
             patch("tasks.tasks.Provider.objects.get", return_value=mock_provider),
             patch("tasks.tasks.initialize_prowler_provider"),
@@ -771,6 +777,38 @@ class TestGenerateOutputs:
             mock_s3_task.assert_called_once()
 
 
+class TestScanReportRLSTaskOnFailure:
+    def test_on_failure_removes_scan_tmp_directory(self):
+        task = ScanReportRLSTask()
+
+        with patch("tasks.tasks.rmtree") as mock_rmtree:
+            task.on_failure(
+                exc=OSError("No space left on device"),
+                task_id="task-abc",
+                args=(),
+                kwargs={"tenant_id": "t-1", "scan_id": "s-1"},
+                _einfo=None,
+            )
+
+        mock_rmtree.assert_called_once_with(
+            _scan_tmp_output_directory("t-1", "s-1"), ignore_errors=True
+        )
+
+    def test_on_failure_skips_when_missing_kwargs(self):
+        task = ScanReportRLSTask()
+
+        with patch("tasks.tasks.rmtree") as mock_rmtree:
+            task.on_failure(
+                exc=OSError("No space left on device"),
+                task_id="task-abc",
+                args=(),
+                kwargs={},
+                _einfo=None,
+            )
+
+        mock_rmtree.assert_not_called()
+
+
 class TestScanCompleteTasks:
     @patch("tasks.tasks.aggregate_attack_surface_task.apply_async")
     @patch("tasks.tasks.chain")
@@ -1079,6 +1117,7 @@ class TestCheckIntegrationsTask:
             enabled=True,
         )
 
+    @patch("tasks.tasks.get_prowler_provider_compliance", return_value={})
     @patch("tasks.tasks.s3_integration_task")
     @patch("tasks.tasks.Integration.objects.filter")
     @patch("tasks.tasks.ScanSummary.objects.filter")
@@ -1111,6 +1150,7 @@ class TestCheckIntegrationsTask:
         mock_scan_summary,
         mock_integration_filter,
         mock_s3_task,
+        mock_get_prowler_compliance,
     ):
         """Test that ASFF output is generated for AWS providers with SecurityHub integration."""
         # Setup
@@ -1207,6 +1247,7 @@ class TestCheckIntegrationsTask:
 
             assert result == {"upload": True}
 
+    @patch("tasks.tasks.get_prowler_provider_compliance", return_value={})
     @patch("tasks.tasks.s3_integration_task")
     @patch("tasks.tasks.Integration.objects.filter")
     @patch("tasks.tasks.ScanSummary.objects.filter")
@@ -1239,6 +1280,7 @@ class TestCheckIntegrationsTask:
         mock_scan_summary,
         mock_integration_filter,
         mock_s3_task,
+        mock_get_prowler_compliance,
     ):
         """Test that ASFF output is NOT generated for AWS providers without SecurityHub integration."""
         # Setup
@@ -1332,6 +1374,7 @@ class TestCheckIntegrationsTask:
 
             assert result == {"upload": True}
 
+    @patch("tasks.tasks.get_prowler_provider_compliance", return_value={})
     @patch("tasks.tasks.ScanSummary.objects.filter")
     @patch("tasks.tasks.Provider.objects.get")
     @patch("tasks.tasks.initialize_prowler_provider")
@@ -1360,6 +1403,7 @@ class TestCheckIntegrationsTask:
         mock_initialize_provider,
         mock_provider_get,
         mock_scan_summary,
+        mock_get_prowler_compliance,
     ):
         """Test that ASFF output is NOT generated for non-AWS providers (e.g., Azure, GCP)."""
         # Setup
@@ -2672,3 +2716,36 @@ class TestReaggregateAllFindingGroupSummaries:
         assert result == {"scans_reaggregated": 0}
         mock_group.assert_not_called()
         mock_chain.assert_not_called()
+
+
+class TestTaskTimeLimits:
+    """The per-task limits in task_annotations must actually take effect.
+
+    Celery applies a "*" annotation after the per-task one, so a "*" entry would
+    silently overwrite every specific limit and cap long scans at the default. The
+    default is set as the global limit instead, and these per-task limits must win.
+    """
+
+    def test_long_running_tasks_exceed_the_default_limit(self):
+        from config.celery import celery_app
+
+        default = celery_app.conf.task_time_limit
+        for name in (
+            "scan-perform",
+            "scan-perform-scheduled",
+            "provider-deletion",
+            "tenant-deletion",
+        ):
+            assert celery_app.tasks[name].time_limit > default
+
+    def test_connection_checks_stay_below_the_default_limit(self):
+        from config.celery import celery_app
+
+        default = celery_app.conf.task_time_limit
+        for name in (
+            "provider-connection-check",
+            "integration-connection-check",
+            "lighthouse-connection-check",
+            "lighthouse-provider-connection-check",
+        ):
+            assert celery_app.tasks[name].time_limit < default
diff --git a/api/uv.lock b/api/uv.lock
index d90eff5fdf..f96318c1f4 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -16,7 +16,7 @@ constraints = [
     { name = "aiobotocore", specifier = "==2.25.1" },
     { name = "aiofiles", specifier = "==24.1.0" },
     { name = "aiohappyeyeballs", specifier = "==2.6.1" },
-    { name = "aiohttp", specifier = "==3.13.5" },
+    { name = "aiohttp", specifier = "==3.14.0" },
     { name = "aioitertools", specifier = "==0.13.0" },
     { name = "aiosignal", specifier = "==1.4.0" },
     { name = "alibabacloud-actiontrail20200706", specifier = "==2.4.1" },
@@ -61,9 +61,8 @@ constraints = [
     { name = "astroid", specifier = "==3.2.4" },
     { name = "async-timeout", specifier = "==5.0.1" },
     { name = "attrs", specifier = "==25.4.0" },
-    { name = "authlib", specifier = "==1.6.9" },
+    { name = "authlib", specifier = "==1.6.12" },
     { name = "autopep8", specifier = "==2.3.2" },
-    { name = "awsipranges", specifier = "==0.3.3" },
     { name = "azure-cli-core", specifier = "==2.83.0" },
     { name = "azure-cli-telemetry", specifier = "==1.1.0" },
     { name = "azure-common", specifier = "==1.1.28" },
@@ -146,6 +145,7 @@ constraints = [
     { name = "django-celery-results", specifier = "==2.6.0" },
     { name = "django-cors-headers", specifier = "==4.4.0" },
     { name = "django-environ", specifier = "==0.11.2" },
+    { name = "django-eventstream", specifier = "==5.3.3" },
     { name = "django-filter", specifier = "==24.3" },
     { name = "django-guid", specifier = "==3.5.0" },
     { name = "django-postgres-extra", specifier = "==2.0.9" },
@@ -163,7 +163,7 @@ constraints = [
     { name = "drf-simple-apikey", specifier = "==2.2.1" },
     { name = "drf-spectacular", specifier = "==0.27.2" },
     { name = "drf-spectacular-jsonapi", specifier = "==0.5.1" },
-    { name = "dulwich", specifier = "==0.23.0" },
+    { name = "dulwich", specifier = "==1.2.5" },
     { name = "duo-client", specifier = "==5.5.0" },
     { name = "durationpy", specifier = "==0.10" },
     { name = "email-validator", specifier = "==2.2.0" },
@@ -190,7 +190,7 @@ constraints = [
     { name = "grpc-google-iam-v1", specifier = "==0.14.3" },
     { name = "grpcio", specifier = "==1.76.0" },
     { name = "grpcio-status", specifier = "==1.76.0" },
-    { name = "gunicorn", specifier = "==23.0.0" },
+    { name = "gunicorn", specifier = "==26.0.0" },
     { name = "h11", specifier = "==0.16.0" },
     { name = "h2", specifier = "==4.3.0" },
     { name = "hpack", specifier = "==4.1.0" },
@@ -199,8 +199,8 @@ constraints = [
     { name = "httpx", specifier = "==0.28.1" },
     { name = "humanfriendly", specifier = "==10.0" },
     { name = "hyperframe", specifier = "==6.1.0" },
-    { name = "iamdata", specifier = "==0.1.202602021" },
-    { name = "idna", specifier = "==3.11" },
+    { name = "iamdata", specifier = "==0.1.202605131" },
+    { name = "idna", specifier = "==3.15" },
     { name = "importlib-metadata", specifier = "==8.7.1" },
     { name = "inflection", specifier = "==0.5.1" },
     { name = "iniconfig", specifier = "==2.3.0" },
@@ -252,7 +252,7 @@ constraints = [
     { name = "neo4j", specifier = "==6.1.0" },
     { name = "nest-asyncio", specifier = "==1.6.0" },
     { name = "nltk", specifier = "==3.9.4" },
-    { name = "numpy", specifier = "==2.0.2" },
+    { name = "numpy", specifier = "==2.2.6" },
     { name = "oauthlib", specifier = "==3.3.1" },
     { name = "oci", specifier = "==2.169.0" },
     { name = "openai", specifier = "==1.109.1" },
@@ -281,7 +281,7 @@ constraints = [
     { name = "psutil", specifier = "==7.2.2" },
     { name = "psycopg2-binary", specifier = "==2.9.9" },
     { name = "py-deviceid", specifier = "==0.1.1" },
-    { name = "py-iam-expand", specifier = "==0.1.0" },
+    { name = "py-iam-expand", specifier = "==0.3.0" },
     { name = "py-ocsf-models", specifier = "==0.8.1" },
     { name = "pyasn1", specifier = "==0.6.3" },
     { name = "pyasn1-modules", specifier = "==0.4.2" },
@@ -291,7 +291,7 @@ constraints = [
     { name = "pydantic-core", specifier = "==2.41.5" },
     { name = "pygithub", specifier = "==2.8.0" },
     { name = "pygments", specifier = "==2.20.0" },
-    { name = "pyjwt", specifier = "==2.12.1" },
+    { name = "pyjwt", specifier = "==2.13.0" },
     { name = "pylint", specifier = "==3.2.5" },
     { name = "pymsalruntime", specifier = "==0.18.1" },
     { name = "pynacl", specifier = "==1.6.2" },
@@ -357,6 +357,7 @@ constraints = [
     { name = "uritemplate", specifier = "==4.2.0" },
     { name = "urllib3", specifier = "==2.7.0" },
     { name = "uuid6", specifier = "==2024.7.10" },
+    { name = "uvloop", specifier = "==0.22.1" },
     { name = "vine", specifier = "==5.1.0" },
     { name = "vulture", specifier = "==2.14" },
     { name = "wcwidth", specifier = "==0.5.3" },
@@ -374,8 +375,10 @@ constraints = [
     { name = "zstd", specifier = "==1.5.7.3" },
 ]
 overrides = [
+    { name = "dulwich", specifier = "==1.2.5" },
     { name = "microsoft-kiota-abstractions", specifier = "==1.9.9" },
     { name = "okta", specifier = "==3.4.2" },
+    { name = "pyjwt", extras = ["crypto"], specifier = "==2.13.0" },
 ]
 
 [[package]]
@@ -393,7 +396,7 @@ version = "1.2.7"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
-    { name = "pyjwt" },
+    { name = "pyjwt", extra = ["crypto"] },
     { name = "python-dateutil" },
     { name = "requests" },
 ]
@@ -467,7 +470,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.13.5"
+version = "3.14.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -476,44 +479,47 @@ dependencies = [
     { name = "frozenlist" },
     { name = "multidict" },
     { name = "propcache" },
+    { name = "typing-extensions" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/77/9a/152096d4808df8e4268befa55fba462f440f14beab85e8ad9bf990516918/aiohttp-3.13.5.tar.gz", hash = "sha256:9d98cc980ecc96be6eb4c1994ce35d28d8b1f5e5208a23b421187d1209dbb7d1", size = 7858271, upload-time = "2026-03-31T22:01:03.343Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/ab/93ce242f899b68c51b0578c027aafa791ab3614cb9345fa5d37b5f5c8e3e/aiohttp-3.14.0.tar.gz", hash = "sha256:2882de819734c715fd1b9c11c97e09fa020d14438203d1d354d8ed1702791c9b", size = 7940674, upload-time = "2026-06-01T19:41:02.763Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d6/f5/a20c4ac64aeaef1679e25c9983573618ff765d7aa829fa2b84ae7573169e/aiohttp-3.13.5-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7ab7229b6f9b5c1ba4910d6c41a9eb11f543eadb3f384df1b4c293f4e73d44d6", size = 757513, upload-time = "2026-03-31T21:57:02.146Z" },
-    { url = "https://files.pythonhosted.org/packages/75/0a/39fa6c6b179b53fcb3e4b3d2b6d6cad0180854eda17060c7218540102bef/aiohttp-3.13.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:8f14c50708bb156b3a3ca7230b3d820199d56a48e3af76fa21c2d6087190fe3d", size = 506748, upload-time = "2026-03-31T21:57:04.275Z" },
-    { url = "https://files.pythonhosted.org/packages/87/ec/e38ce072e724fd7add6243613f8d1810da084f54175353d25ccf9f9c7e5a/aiohttp-3.13.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e7d2f8616f0ff60bd332022279011776c3ac0faa0f1b463f7bb12326fbc97a1c", size = 501673, upload-time = "2026-03-31T21:57:06.208Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/ba/3bc7525d7e2beaa11b309a70d48b0d3cfc3c2089ec6a7d0820d59c657053/aiohttp-3.13.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a2567b72e1ffc3ab25510db43f355b29eeada56c0a622e58dcdb19530eb0a3cb", size = 1763757, upload-time = "2026-03-31T21:57:07.882Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/ab/e87744cf18f1bd78263aba24924d4953b41086bd3a31d22452378e9028a0/aiohttp-3.13.5-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:fb0540c854ac9c0c5ad495908fdfd3e332d553ec731698c0e29b1877ba0d2ec6", size = 1720152, upload-time = "2026-03-31T21:57:09.946Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/f3/ed17a6f2d742af17b50bae2d152315ed1b164b07a5fd5cc1754d99e4dfa5/aiohttp-3.13.5-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c9883051c6972f58bfc4ebb2116345ee2aa151178e99c3f2b2bbe2af712abd13", size = 1818010, upload-time = "2026-03-31T21:57:12.157Z" },
-    { url = "https://files.pythonhosted.org/packages/53/06/ecbc63dc937192e2a5cb46df4d3edb21deb8225535818802f210a6ea5816/aiohttp-3.13.5-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2294172ce08a82fb7c7273485895de1fa1186cc8294cfeb6aef4af42ad261174", size = 1907251, upload-time = "2026-03-31T21:57:14.023Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/a5/0521aa32c1ddf3aa1e71dcc466be0b7db2771907a13f18cddaa45967d97b/aiohttp-3.13.5-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3a807cabd5115fb55af198b98178997a5e0e57dead43eb74a93d9c07d6d4a7dc", size = 1759969, upload-time = "2026-03-31T21:57:16.146Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/78/a38f8c9105199dd3b9706745865a8a59d0041b6be0ca0cc4b2ccf1bab374/aiohttp-3.13.5-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:aa6d0d932e0f39c02b80744273cd5c388a2d9bc07760a03164f229c8e02662f6", size = 1616871, upload-time = "2026-03-31T21:57:17.856Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/41/27392a61ead8ab38072105c71aa44ff891e71653fe53d576a7067da2b4e8/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:60869c7ac4aaabe7110f26499f3e6e5696eae98144735b12a9c3d9eae2b51a49", size = 1739844, upload-time = "2026-03-31T21:57:19.679Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/55/5564e7ae26d94f3214250009a0b1c65a0c6af4bf88924ccb6fdab901de28/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:26d2f8546f1dfa75efa50c3488215a903c0168d253b75fba4210f57ab77a0fb8", size = 1731969, upload-time = "2026-03-31T21:57:22.006Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/c5/705a3929149865fc941bcbdd1047b238e4a72bcb215a9b16b9d7a2e8d992/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:f1162a1492032c82f14271e831c8f4b49f2b6078f4f5fc74de2c912fa225d51d", size = 1795193, upload-time = "2026-03-31T21:57:24.256Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/19/edabed62f718d02cff7231ca0db4ef1c72504235bc467f7b67adb1679f48/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:8b14eb3262fad0dc2f89c1a43b13727e709504972186ff6a99a3ecaa77102b6c", size = 1606477, upload-time = "2026-03-31T21:57:26.364Z" },
-    { url = "https://files.pythonhosted.org/packages/de/fc/76f80ef008675637d88d0b21584596dc27410a990b0918cb1e5776545b5b/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:ca9ac61ac6db4eb6c2a0cd1d0f7e1357647b638ccc92f7e9d8d133e71ed3c6ac", size = 1813198, upload-time = "2026-03-31T21:57:28.316Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/67/5b3ac26b80adb20ea541c487f73730dc8fa107d632c998f25bbbab98fcda/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:7996023b2ed59489ae4762256c8516df9820f751cf2c5da8ed2fb20ee50abab3", size = 1752321, upload-time = "2026-03-31T21:57:30.549Z" },
-    { url = "https://files.pythonhosted.org/packages/88/06/e4a2e49255ea23fa4feeb5ab092d90240d927c15e47b5b5c48dff5a9ce29/aiohttp-3.13.5-cp311-cp311-win32.whl", hash = "sha256:77dfa48c9f8013271011e51c00f8ada19851f013cde2c48fca1ba5e0caf5bb06", size = 439069, upload-time = "2026-03-31T21:57:32.388Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/43/8c7163a596dab4f8be12c190cf467a1e07e4734cf90eebb39f7f5d53fc6a/aiohttp-3.13.5-cp311-cp311-win_amd64.whl", hash = "sha256:d3a4834f221061624b8887090637db9ad4f61752001eae37d56c52fddade2dc8", size = 462859, upload-time = "2026-03-31T21:57:34.455Z" },
-    { url = "https://files.pythonhosted.org/packages/be/6f/353954c29e7dcce7cf00280a02c75f30e133c00793c7a2ed3776d7b2f426/aiohttp-3.13.5-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:023ecba036ddd840b0b19bf195bfae970083fd7024ce1ac22e9bba90464620e9", size = 748876, upload-time = "2026-03-31T21:57:36.319Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/1b/428a7c64687b3b2e9cd293186695affc0e1e54a445d0361743b231f11066/aiohttp-3.13.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:15c933ad7920b7d9a20de151efcd05a6e38302cbf0e10c9b2acb9a42210a2416", size = 499557, upload-time = "2026-03-31T21:57:38.236Z" },
-    { url = "https://files.pythonhosted.org/packages/29/47/7be41556bfbb6917069d6a6634bb7dd5e163ba445b783a90d40f5ac7e3a7/aiohttp-3.13.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ab2899f9fa2f9f741896ebb6fa07c4c883bfa5c7f2ddd8cf2aafa86fa981b2d2", size = 500258, upload-time = "2026-03-31T21:57:39.923Z" },
-    { url = "https://files.pythonhosted.org/packages/67/84/c9ecc5828cb0b3695856c07c0a6817a99d51e2473400f705275a2b3d9239/aiohttp-3.13.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a60eaa2d440cd4707696b52e40ed3e2b0f73f65be07fd0ef23b6b539c9c0b0b4", size = 1749199, upload-time = "2026-03-31T21:57:41.938Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/d3/3c6d610e66b495657622edb6ae7c7fd31b2e9086b4ec50b47897ad6042a9/aiohttp-3.13.5-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:55b3bdd3292283295774ab585160c4004f4f2f203946997f49aac032c84649e9", size = 1721013, upload-time = "2026-03-31T21:57:43.904Z" },
-    { url = "https://files.pythonhosted.org/packages/49/a0/24409c12217456df0bae7babe3b014e460b0b38a8e60753d6cb339f6556d/aiohttp-3.13.5-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c2b2355dc094e5f7d45a7bb262fe7207aa0460b37a0d87027dcf21b5d890e7d5", size = 1781501, upload-time = "2026-03-31T21:57:46.285Z" },
-    { url = "https://files.pythonhosted.org/packages/98/9d/b65ec649adc5bccc008b0957a9a9c691070aeac4e41cea18559fef49958b/aiohttp-3.13.5-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b38765950832f7d728297689ad78f5f2cf79ff82487131c4d26fe6ceecdc5f8e", size = 1878981, upload-time = "2026-03-31T21:57:48.734Z" },
-    { url = "https://files.pythonhosted.org/packages/57/d8/8d44036d7eb7b6a8ec4c5494ea0c8c8b94fbc0ed3991c1a7adf230df03bf/aiohttp-3.13.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b18f31b80d5a33661e08c89e202edabf1986e9b49c42b4504371daeaa11b47c1", size = 1767934, upload-time = "2026-03-31T21:57:51.171Z" },
-    { url = "https://files.pythonhosted.org/packages/31/04/d3f8211f273356f158e3464e9e45484d3fb8c4ce5eb2f6fe9405c3273983/aiohttp-3.13.5-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:33add2463dde55c4f2d9635c6ab33ce154e5ecf322bd26d09af95c5f81cfa286", size = 1566671, upload-time = "2026-03-31T21:57:53.326Z" },
-    { url = "https://files.pythonhosted.org/packages/41/db/073e4ebe00b78e2dfcacff734291651729a62953b48933d765dc513bf798/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:327cc432fdf1356fb4fbc6fe833ad4e9f6aacb71a8acaa5f1855e4b25910e4a9", size = 1705219, upload-time = "2026-03-31T21:57:55.385Z" },
-    { url = "https://files.pythonhosted.org/packages/48/45/7dfba71a2f9fd97b15c95c06819de7eb38113d2cdb6319669195a7d64270/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:7c35b0bf0b48a70b4cb4fc5d7bed9b932532728e124874355de1a0af8ec4bc88", size = 1743049, upload-time = "2026-03-31T21:57:57.341Z" },
-    { url = "https://files.pythonhosted.org/packages/18/71/901db0061e0f717d226386a7f471bb59b19566f2cae5f0d93874b017271f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:df23d57718f24badef8656c49743e11a89fd6f5358fa8a7b96e728fda2abf7d3", size = 1749557, upload-time = "2026-03-31T21:57:59.626Z" },
-    { url = "https://files.pythonhosted.org/packages/08/d5/41eebd16066e59cd43728fe74bce953d7402f2b4ddfdfef2c0e9f17ca274/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:02e048037a6501a5ec1f6fc9736135aec6eb8a004ce48838cb951c515f32c80b", size = 1558931, upload-time = "2026-03-31T21:58:01.972Z" },
-    { url = "https://files.pythonhosted.org/packages/30/e6/4a799798bf05740e66c3a1161079bda7a3dd8e22ca392481d7a7f9af82a6/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:31cebae8b26f8a615d2b546fee45d5ffb76852ae6450e2a03f42c9102260d6fe", size = 1774125, upload-time = "2026-03-31T21:58:04.007Z" },
-    { url = "https://files.pythonhosted.org/packages/84/63/7749337c90f92bc2cb18f9560d67aa6258c7060d1397d21529b8004fcf6f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:888e78eb5ca55a615d285c3c09a7a91b42e9dd6fc699b166ebd5dee87c9ccf14", size = 1732427, upload-time = "2026-03-31T21:58:06.337Z" },
-    { url = "https://files.pythonhosted.org/packages/98/de/cf2f44ff98d307e72fb97d5f5bbae3bfcb442f0ea9790c0bf5c5c2331404/aiohttp-3.13.5-cp312-cp312-win32.whl", hash = "sha256:8bd3ec6376e68a41f9f95f5ed170e2fcf22d4eb27a1f8cb361d0508f6e0557f3", size = 433534, upload-time = "2026-03-31T21:58:08.712Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/ca/eadf6f9c8fa5e31d40993e3db153fb5ed0b11008ad5d9de98a95045bed84/aiohttp-3.13.5-cp312-cp312-win_amd64.whl", hash = "sha256:110e448e02c729bcebb18c60b9214a87ba33bac4a9fa5e9a5f139938b56c6cb1", size = 460446, upload-time = "2026-03-31T21:58:10.945Z" },
+    { url = "https://files.pythonhosted.org/packages/67/47/7727bfe8db93f8835a001bd4359d8480cc68d1259b8bce334668f8be97bd/aiohttp-3.14.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:54bf3522d6f7351e55f89a62d5c2bf138ad557b031670266c5df604ae88e0b5a", size = 759147, upload-time = "2026-06-01T19:37:12.918Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/f2/cd3fedff6fade73d71df9ec908c210cec518ef90fd00289250684b90aecf/aiohttp-3.14.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0746d9fb0ac4fdef643a84494efe3f06d50335dd8c7a530228b86448aae0a803", size = 513705, upload-time = "2026-06-01T19:37:14.633Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/fe/49746b6b610144a06323bebd8e1211a390310d8c69b98dd6d52df341bc3e/aiohttp-3.14.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:9f3a96b6d39a4872222beee72e1df41d2ff886ae96152cf3e757ef8c5673ef0e", size = 509627, upload-time = "2026-06-01T19:37:16.385Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/3f/28f2f6cf3d5c0e7b01b27140d0e7873fd11fb341169ad3ce78ad04aba628/aiohttp-3.14.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d336820adbb914debbc90a1d8c1bfc4bea55996aecf64866a989d35d1f9fd903", size = 1769293, upload-time = "2026-06-01T19:37:18.067Z" },
+    { url = "https://files.pythonhosted.org/packages/97/6f/2e5f1b525d5474b12b3c60abf733a755845f3bceff21542081ada515f837/aiohttp-3.14.0-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:71b2604c9bfc1b115547d63a094d5244b3f02799833513a99a68aaa7b167c4cb", size = 1732363, upload-time = "2026-06-01T19:37:20.138Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/ce/596120faa85ca7b19cd061e3f2f3be23aa8f11a0aedf9191db9e0da1bd76/aiohttp-3.14.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:610d68800435903e303ca0542b9d3e4eb72a12ff33a6d471a070c1d81eebd3c2", size = 1840375, upload-time = "2026-06-01T19:37:22.104Z" },
+    { url = "https://files.pythonhosted.org/packages/72/3c/a7ffe05a757a4a7867643da69357ec41f506879fbd1b231d2ed90af246b2/aiohttp-3.14.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:514db9a79337068981ee2137310283a07b4b885c584991097a91a4da419bcb81", size = 1921484, upload-time = "2026-06-01T19:37:24.068Z" },
+    { url = "https://files.pythonhosted.org/packages/93/fa/2c861170bbd4a491de93a69e081db1d971092569e0d593a98ef62c384dc1/aiohttp-3.14.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c452d17eeb95d563fc8b936f3050301dbd1d268126c4632d8b70ede9696202ee", size = 1774153, upload-time = "2026-06-01T19:37:26.256Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/da/1d2f5a165f47ec9b1f69d37b8b977fdc4d501aa72ffb7930db27bb9e49ea/aiohttp-3.14.0-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ed94a81506e3d1bdbad5108f497a58f2a2354aedb4ca314d5326f07d1fd1ac2d", size = 1632569, upload-time = "2026-06-01T19:37:28.192Z" },
+    { url = "https://files.pythonhosted.org/packages/46/1d/7a6e295c4257252f70f69e90864fdad74b6a1293054fb3f9e65a15de6d63/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1394dce36e0f0d260ac0b555a654de19cb989f3c1b8bdd24f505314dfea18a00", size = 1740325, upload-time = "2026-06-01T19:37:30.08Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/7e/e1899b1ca3ec62f1eab2a5cbde14039b97493f7f53eb88d9b668562ffa8d/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:d1467d1e7b48a73ca7237e0ee4335f3d02b923dbc27b82fd254bc301c97d4026", size = 1748691, upload-time = "2026-06-01T19:37:32.211Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/54/4e6b61c1fe7d3433f82bcc6bd7e4d7c683a742a10c9b12a025fd3695c047/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:6a5f3532125233c261cf61f32df4059cfcf482eb793c7d3db8452e3142028b86", size = 1814477, upload-time = "2026-06-01T19:37:34.173Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/38/86fd51be2e08d8e45c83d879d255f10391903cd9fe2a16512f7591a15873/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:3ea81eb518a2ecb319d8ec6d1424a37c773f6634bd87d6985eb606b2faac419f", size = 1623393, upload-time = "2026-06-01T19:37:36.281Z" },
+    { url = "https://files.pythonhosted.org/packages/78/49/466e947a42a88ee23c486d036e7e5d1b097f1bafd8084ad9c9a0a92f0f43/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:32e735c3182de7b64f6941a4ede48b38c7f47d9437bd615dd30b5bda8fa1bc93", size = 1824097, upload-time = "2026-06-01T19:37:38.421Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/89/35f3410bc284682338a1be6b6ea0c5abfa05f063942cfaa9256608440434/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:c21ca9a1c63d4509158f478aeb9d02914dcc52adc68d1bc9dee2452284ee5996", size = 1764790, upload-time = "2026-06-01T19:37:40.755Z" },
+    { url = "https://files.pythonhosted.org/packages/42/80/2d4291bd5724d3d17e5951aff5a3e02281483fb47295f0788276ee66cd73/aiohttp-3.14.0-cp311-cp311-win32.whl", hash = "sha256:19ca5fc84130675ba11c6ca5c7da5cb65f7bf8a32cdd2b616bf49cd334688aae", size = 454176, upload-time = "2026-06-01T19:37:42.837Z" },
+    { url = "https://files.pythonhosted.org/packages/59/ed/41d0ad4f6ececffc32bdf1f7b494e5498f7ca5c849ea2e3cc9bbd1668251/aiohttp-3.14.0-cp311-cp311-win_amd64.whl", hash = "sha256:d488e6e9d3bb8ba5ae7066d5be885ae9670eba021b8c6ccb9a3a568e6b19d6e5", size = 479334, upload-time = "2026-06-01T19:37:44.776Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/86/c0b5e305c770053f8c3d069bb52b8196917ba91949d1962d52eb307fb0d2/aiohttp-3.14.0-cp311-cp311-win_arm64.whl", hash = "sha256:8b93618102caf12801638a01a2b478a55410ddd71bd41cfaf6f707953a49ac43", size = 450262, upload-time = "2026-06-01T19:37:46.461Z" },
+    { url = "https://files.pythonhosted.org/packages/89/97/2b6889bfb6b6847520d50d95eb8c4307a45e28aaca39faf4a9454b3d1b2f/aiohttp-3.14.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:b29518c9c2ec7e373e68259206a137c7f4f5439c58baaec4b5ab3ab799850a4e", size = 750194, upload-time = "2026-06-01T19:37:48.164Z" },
+    { url = "https://files.pythonhosted.org/packages/21/e2/62634b7fff918ed98c3c6b2f0e70d520f7f28846cb412d451b04354c6459/aiohttp-3.14.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:dbec68ce61b64cb73cab4d33df9433427b1713c8bcccb181dce695c1b6f8e87c", size = 506966, upload-time = "2026-06-01T19:37:50.014Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/fb/5ce075150828c797a5106f1c2fb26034e709d4289b9d2bf8b07f1e59fac6/aiohttp-3.14.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:3cdf534aa455593e589302990c5097aa5c92c06c4262a20da22934f9186a5fff", size = 507527, upload-time = "2026-06-01T19:37:51.96Z" },
+    { url = "https://files.pythonhosted.org/packages/01/d5/405a0ae4e6b081754a3609c1c97c63a950e000a2def16046f1e736933a0e/aiohttp-3.14.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cb6c657104393b5fbff01a5f59b2023db74058a8077d94475d6c25d03882a108", size = 1762420, upload-time = "2026-06-01T19:37:53.839Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/1d/e05a7c896b15a6bc6fb8fc5319eb437861c2c49c34559ef928add6590315/aiohttp-3.14.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:46fbbec4e4fab7428d4396a3823f9320e4560aa3113b89eeebce712c27c9ed5a", size = 1733672, upload-time = "2026-06-01T19:37:55.791Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/22/a72f7c459e195fa41bf4f7abd1f925b91fe91f8097e51c654229ba144a33/aiohttp-3.14.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2c2c7e05dd5335b298085abf45ddf98673934c3ee1c083d0b9ea13d4186ad500", size = 1805064, upload-time = "2026-06-01T19:37:57.931Z" },
+    { url = "https://files.pythonhosted.org/packages/80/50/e85bdaba0be59ca4838005ebfef4048fcdd5f35a02b07057a9a123394440/aiohttp-3.14.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3c7139100fbaae76515b73051d8f0aa3a3ff02e415eec8a8eee8e2223d9ba955", size = 1902125, upload-time = "2026-06-01T19:38:00.225Z" },
+    { url = "https://files.pythonhosted.org/packages/19/d8/51de5c6b971c27bb1ef620293b8d1ca611ec78736b34b3f6ccf68e4c8785/aiohttp-3.14.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78d6f9286a629ce52728430afe18f8ed2b6c39a1fddb3802d7244b9983910ad2", size = 1783112, upload-time = "2026-06-01T19:38:02.641Z" },
+    { url = "https://files.pythonhosted.org/packages/73/ae/b4402bfde77e43dfb1b6ccff83c7b7ab63ed06b50c4754f0c5423fb374fe/aiohttp-3.14.0-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:cc3c3e12cdaeb92d7dcf13db00e9f6b1956b910e47256e696df1cfa946d02159", size = 1586356, upload-time = "2026-06-01T19:38:04.637Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/05/750a3265ca4dc54a460bd0cb1121a8f2ce9171fce4a135fb47ea7fd594d2/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4d6a998191f5ebe3b8c28463ff72bc030250008b3193c402464efadd08b5ca02", size = 1723119, upload-time = "2026-06-01T19:38:06.713Z" },
+    { url = "https://files.pythonhosted.org/packages/37/01/8c0812c50b3b1b1c37b323bf170d6be8847a8f234060485b7d1e71953f60/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:0fc2b75ae8d169d853be2862d960be8550da6c5c65711d5476407eb3fdb006bd", size = 1757216, upload-time = "2026-06-01T19:38:08.736Z" },
+    { url = "https://files.pythonhosted.org/packages/47/2a/50fb98028a26887cbe48dcc1df92a90825615bc73b5584301304090cded8/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:16eee56bcc72d04600bc56c1759982c2385ec0b41d3fd3521f836bf64a0957ef", size = 1770500, upload-time = "2026-06-01T19:38:11.111Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/32/0ffd598a2fa2b9a423daf242e700cfdabda35d6e602394ad9ae58972c1c7/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:5a2e7ca615c3ddc15b82687e05a624e5f5cba3f1d6c20cb81172d70ea498451e", size = 1576224, upload-time = "2026-06-01T19:38:13.391Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/f9/b9fc381dd9b66afb33f2634c40e229d106467be0afcabe79648631ab6712/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:f0b7b8bbbec3ce9467ee0ebe334622fd90624f593edd3136c567811453fc4fae", size = 1794252, upload-time = "2026-06-01T19:38:15.498Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/fb/05d9214c975f23225a8cd5c439325e338c7c377b315480ef3871db51f54e/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5ba10966d4f03dd96a14365be4b8e37c327c76f11c3ca867116966cdd9f98066", size = 1760193, upload-time = "2026-06-01T19:38:17.624Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/4b/02992fc4fb9e1b6673ee3f888a8e587a6447afda1f6f4aca776c148c2876/aiohttp-3.14.0-cp312-cp312-win32.whl", hash = "sha256:101df7779c80c0636014a6b2c6642acd3efb5b355d48347c9d7dfb720aee9430", size = 448650, upload-time = "2026-06-01T19:38:19.545Z" },
+    { url = "https://files.pythonhosted.org/packages/39/e9/246532214c3abda518477cbaaf16d420295ad8effa5233844cbb38f299ab/aiohttp-3.14.0-cp312-cp312-win_amd64.whl", hash = "sha256:b0a5747586d4467efd1f932710b269131c9717a872dce082cd92a00c1c13123a", size = 476145, upload-time = "2026-06-01T19:38:21.505Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c3/63f8c20090048915711598b0adf475b149216d736157961de06480a45b15/aiohttp-3.14.0-cp312-cp312-win_arm64.whl", hash = "sha256:5f1c5be60add78fabb4aacd13c5a348ae79d2fcbfc7fa78da8f1eb192273b370", size = 444250, upload-time = "2026-06-01T19:38:24.027Z" },
 ]
 
 [[package]]
@@ -1043,15 +1049,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9e/43/53afb8ba17218f19b77c7834128566c5bbb100a0ad9ba2e8e89d089d7079/autopep8-2.3.2-py2.py3-none-any.whl", hash = "sha256:ce8ad498672c845a0c3de2629c15b635ec2b05ef8177a6e7c91c74f3e9b51128", size = 45807, upload-time = "2025-01-14T14:46:15.466Z" },
 ]
 
-[[package]]
-name = "awsipranges"
-version = "0.3.3"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/19/2e/6efa95f995369da828715f41705686cd214b9259ed758266942553d40441/awsipranges-0.3.3.tar.gz", hash = "sha256:4f0b3f22a9dc1163c85b513bed812b6c92bdacd674e6a7b68252a3c25b99e2c0", size = 16739, upload-time = "2022-02-10T21:08:32.825Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/83/ce/5c9a8bf91bdc9592a409c99e58fd99f2727ab8d634719c0ad796021b76d7/awsipranges-0.3.3-py3-none-any.whl", hash = "sha256:f3d7a54aeaf7fe310beb5d377a4034a63a51b72677ae6af3e0967bc4de7eedaf", size = 18106, upload-time = "2022-02-10T21:08:31.497Z" },
-]
-
 [[package]]
 name = "azure-cli-core"
 version = "2.83.0"
@@ -1074,7 +1071,7 @@ dependencies = [
     { name = "pkginfo" },
     { name = "psutil", marker = "sys_platform != 'cygwin'" },
     { name = "py-deviceid" },
-    { name = "pyjwt" },
+    { name = "pyjwt", extra = ["crypto"] },
     { name = "pyopenssl" },
     { name = "requests", extra = ["socks"] },
 ]
@@ -2360,6 +2357,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c4/f1/468b49cccba3b42dda571063a14c668bb0b53a1d5712426d18e36663bd53/django_environ-0.11.2-py2.py3-none-any.whl", hash = "sha256:0ff95ab4344bfeff693836aa978e6840abef2e2f1145adff7735892711590c05", size = 19141, upload-time = "2023-09-01T21:02:59.88Z" },
 ]
 
+[[package]]
+name = "django-eventstream"
+version = "5.3.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+    { name = "django-grip" },
+    { name = "gripcontrol" },
+    { name = "pyjwt", extra = ["crypto"] },
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/f2/49/ec6cbc24f3f30465370df7096cfea9722bad2b0c1f35a7ff5d45fb96cff6/django_eventstream-5.3.3.tar.gz", hash = "sha256:6880b03298eebf18c1b736b972fb862eaf631dfbb79f8b27496418a3495d08dc", size = 47622, upload-time = "2025-10-23T00:22:40.291Z" }
+
 [[package]]
 name = "django-filter"
 version = "24.3"
@@ -2372,6 +2382,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/09/b1/92f1c30b47c1ebf510c35a2ccad9448f73437e5891bbd2b4febe357cc3de/django_filter-24.3-py3-none-any.whl", hash = "sha256:c4852822928ce17fb699bcfccd644b3574f1a2d80aeb2b4ff4f16b02dd49dc64", size = 95011, upload-time = "2024-08-02T13:27:55.616Z" },
 ]
 
+[[package]]
+name = "django-grip"
+version = "3.5.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+    { name = "gripcontrol" },
+    { name = "pubcontrol" },
+    { name = "six" },
+    { name = "werkzeug" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/cb/d0/2c7b04fa864073cd8cb324f8674672162282d97540d56732cbd3a9ae5bca/django-grip-3.5.2.tar.gz", hash = "sha256:1ee1601492cd110256bd03e4a68797a9fbefa27c15f5a838bf245df97db0450c", size = 7626, upload-time = "2025-03-24T18:53:58.677Z" }
+
 [[package]]
 name = "django-guid"
 version = "3.5.0"
@@ -2457,7 +2480,7 @@ source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "django" },
     { name = "djangorestframework" },
-    { name = "pyjwt" },
+    { name = "pyjwt", extra = ["crypto"] },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/a8/27/2874a325c11112066139769f7794afae238a07ce6adf96259f08fd37a9d7/djangorestframework_simplejwt-5.5.1.tar.gz", hash = "sha256:e72c5572f51d7803021288e2057afcbd03f17fe11d484096f40a460abc76e87f", size = 101265, upload-time = "2025-07-21T16:52:25.026Z" }
 wheels = [
@@ -2576,24 +2599,27 @@ wheels = [
 
 [[package]]
 name = "dulwich"
-version = "0.23.0"
+version = "1.2.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "typing-extensions", marker = "python_full_version < '3.12'" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/4b/ac/ba58cf420640c7bc77ae8e1b31e174d83c9117750c63cf9ea3b5e202e5c4/dulwich-0.23.0.tar.gz", hash = "sha256:0aa6c2489dd5e978b27e9b75983b7331a66c999f0efc54ebe37cab808ed322ae", size = 575116, upload-time = "2025-06-21T17:56:47.494Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7f/85/ceb8ecff5cdeee4ceeebb86b599476dee559041dacc6c2c50cc0d4711549/dulwich-1.2.5.tar.gz", hash = "sha256:0395b2c8924c3424bafe2d9c1edd5348cc4b21ce9c1d6655bf01f9a5c47164c8", size = 1253230, upload-time = "2026-05-28T22:27:55.17Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ae/11/f6bbba8583f69cf19ef4bd7f5fde1a6b5ccaf8b6951781cec8db247116f4/dulwich-0.23.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:d68498fdda13ab00791b483daab3bcfe9f9721c037aa458695e6ad81640c57cc", size = 972658, upload-time = "2025-06-21T17:56:13.505Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/9d/2720e0ab58666378a33c752a61543f936cd6b06dfe5d84a2215ddc0914b0/dulwich-0.23.0-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:cb7bb930b12471a1cfcea4b3d25a671dc0ad32573f0ad25684684298959a1527", size = 1049813, upload-time = "2025-06-21T17:56:14.884Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/f3/81d8075141dfcc0a0449c2093596e58d3e11444e3af54e819eca63b84dd0/dulwich-0.23.0-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:a2abbce32fd2bc7902bcc5f69b10bf22576810de21651baaa864b78fd7aec261", size = 1051639, upload-time = "2025-06-21T17:56:16.437Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/0d/c06ccb227b096aef5906142fe78b5c79f9070a0ea6152fc219941186d540/dulwich-0.23.0-cp311-cp311-win32.whl", hash = "sha256:9e3151f10ce2a9ff91bca64c74345217f53bdd947dc958032343822009832f7a", size = 642918, upload-time = "2025-06-21T17:56:18.373Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/1c/1e99aa34c9aead9e641b2d9934f0a3d00257f75027cf5cdecc8a1a6c18ae/dulwich-0.23.0-cp311-cp311-win_amd64.whl", hash = "sha256:3ae9f1d9dc92d4e9a3f89ba2c55221f7b6442c5dd93b3f6f539a3c9eb3f37bdd", size = 659010, upload-time = "2025-06-21T17:56:19.947Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/d7/1e6fba0235babe912e8467b036062e37d11672cbbeb0d8074f9d4559057b/dulwich-0.23.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:52cdef66a7994d29528ca79ca59452518bbba3fd56a9c61c61f6c467c1c7956e", size = 960292, upload-time = "2025-06-21T17:56:21.308Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/6a/23f0c487ec03f2752600cab4a8e0dedb38186246c475bf3fa90a8db830d5/dulwich-0.23.0-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:d473888a6ab9ed5d4a4c3f053cbe5b77f72d54b6efdf5688fed76094316e571e", size = 1047892, upload-time = "2025-06-21T17:56:22.989Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/e2/8f3d216be5fd0ee1180d917b59b34b54b9896384cf139f319b5d3a8f16b4/dulwich-0.23.0-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:19fcf20224c641a61c774da92f098fbaae9938c7e17a52841e64092adf7e78f9", size = 1048699, upload-time = "2025-06-21T17:56:24.602Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/c4/18e6223cd4ad1ae9334eb4e6aa5952fd8f5c3d75762918eb90c209fec4ba/dulwich-0.23.0-cp312-cp312-win32.whl", hash = "sha256:7fc8b76b704ef35cd001e993e3aa4e1d666a2064bf467c07c560f12b2959dcaf", size = 641268, upload-time = "2025-06-21T17:56:26.18Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/9c/65bfbbac62d8a2967e13f6a1512371c5eb6b906a61fb6dead992669cad0e/dulwich-0.23.0-cp312-cp312-win_amd64.whl", hash = "sha256:cb0566b888b578325350b4d67c61a0de35d417e9877560e3a6df88cae4576a59", size = 657837, upload-time = "2025-06-21T17:56:27.821Z" },
-    { url = "https://files.pythonhosted.org/packages/35/31/49318ee9db4b402e6d8b9b01bd4cae9298f59e1bb9bd56cf4a94e48fa069/dulwich-0.23.0-py3-none-any.whl", hash = "sha256:d8da6694ca332bb48775e35ee2215aa4673821164a91b83062f699c69f7cd135", size = 313776, upload-time = "2025-06-21T17:56:46.221Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/4a/654ae1671610fdf6b65a64586ad67ddd8550d4d08a632b2a4b9614754b6d/dulwich-1.2.5-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:556593fd11637f80f6018bee1916b1a84f5b420423b470ebb3f1a782ad6ef081", size = 1399277, upload-time = "2026-05-28T22:27:00.801Z" },
+    { url = "https://files.pythonhosted.org/packages/85/d8/06ee3bc8eded4bd7adf8adf0c9ea5f19bf96f7e5e626bfaf7311cde4208a/dulwich-1.2.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a70477c991e96cfe8fdd7c866e7251faf71b38bfeb51d6f27554c9cce1caabf3", size = 1382310, upload-time = "2026-05-28T22:27:02.216Z" },
+    { url = "https://files.pythonhosted.org/packages/07/17/a03adf50b9095f9f5d863393f21d585dea39bdc4fdf60788ff3a9407a512/dulwich-1.2.5-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:9008ef25cabd379cda4fa86000fc38ca14b72afe17db798a8c85c0b2b7ce4d1e", size = 1470993, upload-time = "2026-05-28T22:27:04.075Z" },
+    { url = "https://files.pythonhosted.org/packages/60/58/1dc352d2a5e80befe4338af7208febb44bcfd7496b0dde5ac6dacb07b031/dulwich-1.2.5-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:a5549f4afc973e0a15ea6b0244d57f848d3f3ee13dac557eb311024aebebf128", size = 1497820, upload-time = "2026-05-28T22:27:05.549Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/a8/e058959a87e7df7753b112ef66a43ccbc57338c1bbdc23a0edf3833396df/dulwich-1.2.5-cp311-cp311-win32.whl", hash = "sha256:5108acead814d1de8b6262d6d8fb90af7e82f5a4d83788b6b48e39d01800a92f", size = 1066549, upload-time = "2026-05-28T22:27:06.832Z" },
+    { url = "https://files.pythonhosted.org/packages/33/91/ff0b444f686718635348986bd73dfce42e947912417893de35de399b878b/dulwich-1.2.5-cp311-cp311-win_amd64.whl", hash = "sha256:5e067b7feceb7034bc99e7c7143a704f1d97d4be7027d9a0aa5a83c0657ff091", size = 1079481, upload-time = "2026-05-28T22:27:08.33Z" },
+    { url = "https://files.pythonhosted.org/packages/19/22/4f75770bbe5521cac61c4820ef46d4fbf8c2175d3519ba3d0378d4ba798e/dulwich-1.2.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:701a9ecf7a8a44f5e2459e46befa93530cf36a8b1ae3140aefc007db1d7d0207", size = 1396522, upload-time = "2026-05-28T22:27:09.997Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/b1/c07c347681c0cf6acd4b189bf6e8d6207c71a1347b7a1e865eb40faa46b9/dulwich-1.2.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:2f90d68bfa97c4ca71de7507984365aefe27b6d248cb28dc99644d0f3ae8c60b", size = 1334826, upload-time = "2026-05-28T22:27:11.582Z" },
+    { url = "https://files.pythonhosted.org/packages/13/80/6818eb7ce492e18ab2efa92ab901d173b4b0b159e5681c1424f329600c40/dulwich-1.2.5-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:00b54a1d56ddbacdd8eadd6d4787a51b3a05fefa30eadbf9165fd283a00b90ed", size = 1416616, upload-time = "2026-05-28T22:27:13.195Z" },
+    { url = "https://files.pythonhosted.org/packages/14/a7/9790e60d19870f6554f7583722bb324c1355784316f20aeda1c0b5b1491a/dulwich-1.2.5-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:d8f7ea8f47e38e5b0de3fab97e07e9c9161ffddc90b3964512cab2b7749df4e6", size = 1441354, upload-time = "2026-05-28T22:27:14.683Z" },
+    { url = "https://files.pythonhosted.org/packages/91/44/0ea8a69c24aa1254ff5996d682eae2eab287d471b937dcdb26d9ea9720b4/dulwich-1.2.5-cp312-cp312-win32.whl", hash = "sha256:8929134acf4ff967203df7600b38535f9b5b590462067a7e30dbce01acb97af9", size = 1017058, upload-time = "2026-05-28T22:27:16.121Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/9c/2fcddda7faec3bae52db7c64bfcb5dc756f597f33fae90e8d4e4b4d3b39b/dulwich-1.2.5-cp312-cp312-win_amd64.whl", hash = "sha256:9693d2c9e226b2ea855c1dc3a87e2f4d972f7523fc0f7924e5997e9f4c23d97f", size = 1031731, upload-time = "2026-05-28T22:27:17.633Z" },
+    { url = "https://files.pythonhosted.org/packages/07/4b/4a18a59ad230581cd0ef460e96001f90762e566dc2dfdba22aa358eb5a0e/dulwich-1.2.5-py3-none-any.whl", hash = "sha256:1679b376433a0fc7f36586afda1d4ed7427afa7a79d4bf17e5014474eea69fa4", size = 686745, upload-time = "2026-05-28T22:27:53.695Z" },
 ]
 
 [[package]]
@@ -2980,6 +3006,17 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c8/ab/717c58343cf02c5265b531384b248787e04d8160b8afe53d9eec053d7b44/greenlet-3.3.1-cp312-cp312-win_arm64.whl", hash = "sha256:bfb2d1763d777de5ee495c85309460f6fd8146e50ec9d0ae0183dbf6f0a829d1", size = 226403, upload-time = "2026-01-23T15:31:39.372Z" },
 ]
 
+[[package]]
+name = "gripcontrol"
+version = "4.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pubcontrol" },
+    { name = "pyjwt", extra = ["crypto"] },
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/4f/51/1cbf88384fbe97a1454fb0adddcdca8cb90ceb99c3250274c334db844f4f/gripcontrol-4.4.0.tar.gz", hash = "sha256:44ee6fe244a02870aa4e5bc810138ccaf5070dce5eb149b8ee9e27b960a95c2d", size = 12526, upload-time = "2026-05-14T21:19:28.49Z" }
+
 [[package]]
 name = "grpc-google-iam-v1"
 version = "0.14.3"
@@ -3041,14 +3078,14 @@ wheels = [
 
 [[package]]
 name = "gunicorn"
-version = "23.0.0"
+version = "26.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "packaging" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/34/72/9614c465dc206155d93eff0ca20d42e1e35afc533971379482de953521a4/gunicorn-23.0.0.tar.gz", hash = "sha256:f014447a0101dc57e294f6c18ca6b40227a4c90e9bdb586042628030cba004ec", size = 375031, upload-time = "2024-08-10T20:25:27.378Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6d/b7/a4a3f632f823e432ce6bc65f62961b7980c898c77f075a2f7118cb3846fe/gunicorn-26.0.0.tar.gz", hash = "sha256:ca9346f85e3a4aeeb64d491045c16b9a35647abd37ea15efe53080eb8b090baf", size = 727286, upload-time = "2026-05-05T06:38:25.529Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/cb/7d/6dac2a6e1eba33ee43f318edbed4ff29151a49b5d37f080aad1e6469bca4/gunicorn-23.0.0-py3-none-any.whl", hash = "sha256:ec400d38950de4dfd418cff8328b2c8faed0edb0d517d3394e457c317908ca4d", size = 85029, upload-time = "2024-08-10T20:25:24.996Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/40/9c2384fc2be4ad25dd4a49decd5ad9ea5a3639814c11bd40ab77cb9f0a14/gunicorn-26.0.0-py3-none-any.whl", hash = "sha256:40233d26a5f0d1872916188c276e21641155111c2853f0c2cd55260aec0d24fc", size = 212009, upload-time = "2026-05-05T06:38:23.007Z" },
 ]
 
 [[package]]
@@ -3150,20 +3187,20 @@ wheels = [
 
 [[package]]
 name = "iamdata"
-version = "0.1.202602021"
+version = "0.1.202605131"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/93/5e/8179963b7a528c548824a8e4088150509d9fa8571dd622b7399f6d2d5680/iamdata-0.1.202602021.tar.gz", hash = "sha256:c24265fc3694076f65da91a8aa9361b60da25f7b8cfd8ba4ddd6aa1b9bb5153e", size = 771233, upload-time = "2026-02-02T05:49:56.76Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cc/ea/d68e25aa4392e8a9f8e6523adc95a5fb86baf98d052efa2cec4d4a00e7ce/iamdata-0.1.202605131.tar.gz", hash = "sha256:ab4e8f1ea080394157848fecd0ca643633e35b2e0cb1965c9ed9bdd673afe00c", size = 793465, upload-time = "2026-05-13T05:57:10.607Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/74/9e/ae7a3019aa5a27d70412b74da4f0304695efa5d9a88f0689f37ea2602ea2/iamdata-0.1.202602021-py3-none-any.whl", hash = "sha256:48419662d75dd0e1ea22b9cc98fd70201d4c72760c6897acc46ad9ab90633d18", size = 1226614, upload-time = "2026-02-02T05:49:54.735Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/93/03396b477b0faa9f1a12142209b59aa13d0fe4f64e2be47883f607789c14/iamdata-0.1.202605131-py3-none-any.whl", hash = "sha256:350e317d96fb8c8ddf30aa6da222788d302af5f13c9e357b59f9eefe50b8af5a", size = 1259166, upload-time = "2026-05-13T05:57:09.093Z" },
 ]
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -3966,30 +4003,30 @@ wheels = [
 
 [[package]]
 name = "numpy"
-version = "2.0.2"
+version = "2.2.6"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a9/75/10dd1f8116a8b796cb2c737b674e02d02e80454bda953fa7e65d8c12b016/numpy-2.0.2.tar.gz", hash = "sha256:883c987dee1880e2a864ab0dc9892292582510604156762362d9326444636e78", size = 18902015, upload-time = "2024-08-26T20:19:40.945Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/76/21/7d2a95e4bba9dc13d043ee156a356c0a8f0c6309dff6b21b4d71a073b8a8/numpy-2.2.6.tar.gz", hash = "sha256:e29554e2bef54a90aa5cc07da6ce955accb83f21ab5de01a62c8478897b264fd", size = 20276440, upload-time = "2025-05-17T22:38:04.611Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/8b/cf/034500fb83041aa0286e0fb16e7c76e5c8b67c0711bb6e9e9737a717d5fe/numpy-2.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:49ca4decb342d66018b01932139c0961a8f9ddc7589611158cb3c27cbcf76448", size = 21169137, upload-time = "2024-08-26T20:07:45.345Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/d9/32de45561811a4b87fbdee23b5797394e3d1504b4a7cf40c10199848893e/numpy-2.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:11a76c372d1d37437857280aa142086476136a8c0f373b2e648ab2c8f18fb195", size = 13703552, upload-time = "2024-08-26T20:08:06.666Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/ca/2f384720020c7b244d22508cb7ab23d95f179fcfff33c31a6eeba8d6c512/numpy-2.0.2-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:807ec44583fd708a21d4a11d94aedf2f4f3c3719035c76a2bbe1fe8e217bdc57", size = 5298957, upload-time = "2024-08-26T20:08:15.83Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/78/a3e4f9fb6aa4e6fdca0c5428e8ba039408514388cf62d89651aade838269/numpy-2.0.2-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:8cafab480740e22f8d833acefed5cc87ce276f4ece12fdaa2e8903db2f82897a", size = 6905573, upload-time = "2024-08-26T20:08:27.185Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/72/cfc3a1beb2caf4efc9d0b38a15fe34025230da27e1c08cc2eb9bfb1c7231/numpy-2.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a15f476a45e6e5a3a79d8a14e62161d27ad897381fecfa4a09ed5322f2085669", size = 13914330, upload-time = "2024-08-26T20:08:48.058Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/a8/c17acf65a931ce551fee11b72e8de63bf7e8a6f0e21add4c937c83563538/numpy-2.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:13e689d772146140a252c3a28501da66dfecd77490b498b168b501835041f951", size = 19534895, upload-time = "2024-08-26T20:09:16.536Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/86/8767f3d54f6ae0165749f84648da9dcc8cd78ab65d415494962c86fac80f/numpy-2.0.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:9ea91dfb7c3d1c56a0e55657c0afb38cf1eeae4544c208dc465c3c9f3a7c09f9", size = 19937253, upload-time = "2024-08-26T20:09:46.263Z" },
-    { url = "https://files.pythonhosted.org/packages/df/87/f76450e6e1c14e5bb1eae6836478b1028e096fd02e85c1c37674606ab752/numpy-2.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c1c9307701fec8f3f7a1e6711f9089c06e6284b3afbbcd259f7791282d660a15", size = 14414074, upload-time = "2024-08-26T20:10:08.483Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/ca/0f0f328e1e59f73754f06e1adfb909de43726d4f24c6a3f8805f34f2b0fa/numpy-2.0.2-cp311-cp311-win32.whl", hash = "sha256:a392a68bd329eafac5817e5aefeb39038c48b671afd242710b451e76090e81f4", size = 6470640, upload-time = "2024-08-26T20:10:19.732Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/57/3a3f14d3a759dcf9bf6e9eda905794726b758819df4663f217d658a58695/numpy-2.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:286cd40ce2b7d652a6f22efdfc6d1edf879440e53e76a75955bc0c826c7e64dc", size = 15910230, upload-time = "2024-08-26T20:10:43.413Z" },
-    { url = "https://files.pythonhosted.org/packages/45/40/2e117be60ec50d98fa08c2f8c48e09b3edea93cfcabd5a9ff6925d54b1c2/numpy-2.0.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:df55d490dea7934f330006d0f81e8551ba6010a5bf035a249ef61a94f21c500b", size = 20895803, upload-time = "2024-08-26T20:11:13.916Z" },
-    { url = "https://files.pythonhosted.org/packages/46/92/1b8b8dee833f53cef3e0a3f69b2374467789e0bb7399689582314df02651/numpy-2.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8df823f570d9adf0978347d1f926b2a867d5608f434a7cff7f7908c6570dcf5e", size = 13471835, upload-time = "2024-08-26T20:11:34.779Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/19/e2793bde475f1edaea6945be141aef6c8b4c669b90c90a300a8954d08f0a/numpy-2.0.2-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:9a92ae5c14811e390f3767053ff54eaee3bf84576d99a2456391401323f4ec2c", size = 5038499, upload-time = "2024-08-26T20:11:43.902Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/ff/ddf6dac2ff0dd50a7327bcdba45cb0264d0e96bb44d33324853f781a8f3c/numpy-2.0.2-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:a842d573724391493a97a62ebbb8e731f8a5dcc5d285dfc99141ca15a3302d0c", size = 6633497, upload-time = "2024-08-26T20:11:55.09Z" },
-    { url = "https://files.pythonhosted.org/packages/72/21/67f36eac8e2d2cd652a2e69595a54128297cdcb1ff3931cfc87838874bd4/numpy-2.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c05e238064fc0610c840d1cf6a13bf63d7e391717d247f1bf0318172e759e692", size = 13621158, upload-time = "2024-08-26T20:12:14.95Z" },
-    { url = "https://files.pythonhosted.org/packages/39/68/e9f1126d757653496dbc096cb429014347a36b228f5a991dae2c6b6cfd40/numpy-2.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0123ffdaa88fa4ab64835dcbde75dcdf89c453c922f18dced6e27c90d1d0ec5a", size = 19236173, upload-time = "2024-08-26T20:12:44.049Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/e9/1f5333281e4ebf483ba1c888b1d61ba7e78d7e910fdd8e6499667041cc35/numpy-2.0.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:96a55f64139912d61de9137f11bf39a55ec8faec288c75a54f93dfd39f7eb40c", size = 19634174, upload-time = "2024-08-26T20:13:13.634Z" },
-    { url = "https://files.pythonhosted.org/packages/71/af/a469674070c8d8408384e3012e064299f7a2de540738a8e414dcfd639996/numpy-2.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:ec9852fb39354b5a45a80bdab5ac02dd02b15f44b3804e9f00c556bf24b4bded", size = 14099701, upload-time = "2024-08-26T20:13:34.851Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/3d/08ea9f239d0e0e939b6ca52ad403c84a2bce1bde301a8eb4888c1c1543f1/numpy-2.0.2-cp312-cp312-win32.whl", hash = "sha256:671bec6496f83202ed2d3c8fdc486a8fc86942f2e69ff0e986140339a63bcbe5", size = 6174313, upload-time = "2024-08-26T20:13:45.653Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/b5/4ac39baebf1fdb2e72585c8352c56d063b6126be9fc95bd2bb5ef5770c20/numpy-2.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:cfd41e13fdc257aa5778496b8caa5e856dc4896d4ccf01841daee1d96465467a", size = 15606179, upload-time = "2024-08-26T20:14:08.786Z" },
+    { url = "https://files.pythonhosted.org/packages/da/a8/4f83e2aa666a9fbf56d6118faaaf5f1974d456b1823fda0a176eff722839/numpy-2.2.6-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f9f1adb22318e121c5c69a09142811a201ef17ab257a1e66ca3025065b7f53ae", size = 21176963, upload-time = "2025-05-17T21:31:19.36Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/2b/64e1affc7972decb74c9e29e5649fac940514910960ba25cd9af4488b66c/numpy-2.2.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:c820a93b0255bc360f53eca31a0e676fd1101f673dda8da93454a12e23fc5f7a", size = 14406743, upload-time = "2025-05-17T21:31:41.087Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/9f/0121e375000b5e50ffdd8b25bf78d8e1a5aa4cca3f185d41265198c7b834/numpy-2.2.6-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:3d70692235e759f260c3d837193090014aebdf026dfd167834bcba43e30c2a42", size = 5352616, upload-time = "2025-05-17T21:31:50.072Z" },
+    { url = "https://files.pythonhosted.org/packages/31/0d/b48c405c91693635fbe2dcd7bc84a33a602add5f63286e024d3b6741411c/numpy-2.2.6-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:481b49095335f8eed42e39e8041327c05b0f6f4780488f61286ed3c01368d491", size = 6889579, upload-time = "2025-05-17T21:32:01.712Z" },
+    { url = "https://files.pythonhosted.org/packages/52/b8/7f0554d49b565d0171eab6e99001846882000883998e7b7d9f0d98b1f934/numpy-2.2.6-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b64d8d4d17135e00c8e346e0a738deb17e754230d7e0810ac5012750bbd85a5a", size = 14312005, upload-time = "2025-05-17T21:32:23.332Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/dd/2238b898e51bd6d389b7389ffb20d7f4c10066d80351187ec8e303a5a475/numpy-2.2.6-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ba10f8411898fc418a521833e014a77d3ca01c15b0c6cdcce6a0d2897e6dbbdf", size = 16821570, upload-time = "2025-05-17T21:32:47.991Z" },
+    { url = "https://files.pythonhosted.org/packages/83/6c/44d0325722cf644f191042bf47eedad61c1e6df2432ed65cbe28509d404e/numpy-2.2.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bd48227a919f1bafbdda0583705e547892342c26fb127219d60a5c36882609d1", size = 15818548, upload-time = "2025-05-17T21:33:11.728Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/9d/81e8216030ce66be25279098789b665d49ff19eef08bfa8cb96d4957f422/numpy-2.2.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9551a499bf125c1d4f9e250377c1ee2eddd02e01eac6644c080162c0c51778ab", size = 18620521, upload-time = "2025-05-17T21:33:39.139Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/fd/e19617b9530b031db51b0926eed5345ce8ddc669bb3bc0044b23e275ebe8/numpy-2.2.6-cp311-cp311-win32.whl", hash = "sha256:0678000bb9ac1475cd454c6b8c799206af8107e310843532b04d49649c717a47", size = 6525866, upload-time = "2025-05-17T21:33:50.273Z" },
+    { url = "https://files.pythonhosted.org/packages/31/0a/f354fb7176b81747d870f7991dc763e157a934c717b67b58456bc63da3df/numpy-2.2.6-cp311-cp311-win_amd64.whl", hash = "sha256:e8213002e427c69c45a52bbd94163084025f533a55a59d6f9c5b820774ef3303", size = 12907455, upload-time = "2025-05-17T21:34:09.135Z" },
+    { url = "https://files.pythonhosted.org/packages/82/5d/c00588b6cf18e1da539b45d3598d3557084990dcc4331960c15ee776ee41/numpy-2.2.6-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:41c5a21f4a04fa86436124d388f6ed60a9343a6f767fced1a8a71c3fbca038ff", size = 20875348, upload-time = "2025-05-17T21:34:39.648Z" },
+    { url = "https://files.pythonhosted.org/packages/66/ee/560deadcdde6c2f90200450d5938f63a34b37e27ebff162810f716f6a230/numpy-2.2.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:de749064336d37e340f640b05f24e9e3dd678c57318c7289d222a8a2f543e90c", size = 14119362, upload-time = "2025-05-17T21:35:01.241Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/65/4baa99f1c53b30adf0acd9a5519078871ddde8d2339dc5a7fde80d9d87da/numpy-2.2.6-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:894b3a42502226a1cac872f840030665f33326fc3dac8e57c607905773cdcde3", size = 5084103, upload-time = "2025-05-17T21:35:10.622Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/89/e5a34c071a0570cc40c9a54eb472d113eea6d002e9ae12bb3a8407fb912e/numpy-2.2.6-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:71594f7c51a18e728451bb50cc60a3ce4e6538822731b2933209a1f3614e9282", size = 6625382, upload-time = "2025-05-17T21:35:21.414Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/35/8c80729f1ff76b3921d5c9487c7ac3de9b2a103b1cd05e905b3090513510/numpy-2.2.6-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f2618db89be1b4e05f7a1a847a9c1c0abd63e63a1607d892dd54668dd92faf87", size = 14018462, upload-time = "2025-05-17T21:35:42.174Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/3d/1e1db36cfd41f895d266b103df00ca5b3cbe965184df824dec5c08c6b803/numpy-2.2.6-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fd83c01228a688733f1ded5201c678f0c53ecc1006ffbc404db9f7a899ac6249", size = 16527618, upload-time = "2025-05-17T21:36:06.711Z" },
+    { url = "https://files.pythonhosted.org/packages/61/c6/03ed30992602c85aa3cd95b9070a514f8b3c33e31124694438d88809ae36/numpy-2.2.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:37c0ca431f82cd5fa716eca9506aefcabc247fb27ba69c5062a6d3ade8cf8f49", size = 15505511, upload-time = "2025-05-17T21:36:29.965Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/25/5761d832a81df431e260719ec45de696414266613c9ee268394dd5ad8236/numpy-2.2.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fe27749d33bb772c80dcd84ae7e8df2adc920ae8297400dabec45f0dedb3f6de", size = 18313783, upload-time = "2025-05-17T21:36:56.883Z" },
+    { url = "https://files.pythonhosted.org/packages/57/0a/72d5a3527c5ebffcd47bde9162c39fae1f90138c961e5296491ce778e682/numpy-2.2.6-cp312-cp312-win32.whl", hash = "sha256:4eeaae00d789f66c7a25ac5f34b71a7035bb474e679f410e5e1a94deb24cf2d4", size = 6246506, upload-time = "2025-05-17T21:37:07.368Z" },
+    { url = "https://files.pythonhosted.org/packages/36/fa/8c9210162ca1b88529ab76b41ba02d433fd54fecaf6feb70ef9f124683f1/numpy-2.2.6-cp312-cp312-win_amd64.whl", hash = "sha256:c1f9540be57940698ed329904db803cf7a402f3fc200bfe599334c9bd84a40b2", size = 12614190, upload-time = "2025-05-17T21:37:26.213Z" },
 ]
 
 [[package]]
@@ -4031,7 +4068,7 @@ dependencies = [
     { name = "pycryptodomex" },
     { name = "pydantic" },
     { name = "pydash" },
-    { name = "pyjwt" },
+    { name = "pyjwt", extra = ["crypto"] },
     { name = "python-dateutil" },
     { name = "pyyaml" },
     { name = "requests" },
@@ -4410,8 +4447,8 @@ wheels = [
 
 [[package]]
 name = "prowler"
-version = "5.27.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#0abbb7fc590eaf7de6ed354dd5a217bca261d2b0" }
+version = "5.31.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#b5bb85c9564f6ca6a7f66c851bb56bde719205ee" }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },
     { name = "alibabacloud-credentials" },
@@ -4427,7 +4464,6 @@ dependencies = [
     { name = "alibabacloud-tea-openapi" },
     { name = "alibabacloud-vpc20160428" },
     { name = "alive-progress" },
-    { name = "awsipranges" },
     { name = "azure-identity" },
     { name = "azure-keyvault-keys" },
     { name = "azure-mgmt-apimanagement" },
@@ -4484,9 +4520,14 @@ dependencies = [
     { name = "pygithub" },
     { name = "python-dateutil" },
     { name = "pytz" },
+    { name = "scaleway" },
     { name = "schema" },
     { name = "shodan" },
     { name = "slack-sdk" },
+    { name = "stackit-core" },
+    { name = "stackit-iaas" },
+    { name = "stackit-objectstorage" },
+    { name = "stackit-resourcemanager" },
     { name = "tabulate" },
     { name = "tzlocal" },
     { name = "uuid6" },
@@ -4494,7 +4535,7 @@ dependencies = [
 
 [[package]]
 name = "prowler-api"
-version = "1.31.0"
+version = "1.32.0"
 source = { virtual = "." }
 dependencies = [
     { name = "cartography" },
@@ -4507,6 +4548,7 @@ dependencies = [
     { name = "django-celery-results" },
     { name = "django-cors-headers" },
     { name = "django-environ" },
+    { name = "django-eventstream" },
     { name = "django-filter" },
     { name = "django-guid" },
     { name = "django-postgres-extra" },
@@ -4533,6 +4575,7 @@ dependencies = [
     { name = "sentry-sdk", extra = ["django"] },
     { name = "sqlparse" },
     { name = "uuid6" },
+    { name = "uvloop" },
     { name = "werkzeug" },
     { name = "xmlsec" },
 ]
@@ -4571,6 +4614,7 @@ requires-dist = [
     { name = "django-celery-results", specifier = "==2.6.0" },
     { name = "django-cors-headers", specifier = "==4.4.0" },
     { name = "django-environ", specifier = "==0.11.2" },
+    { name = "django-eventstream", specifier = "==5.3.3" },
     { name = "django-filter", specifier = "==24.3" },
     { name = "django-guid", specifier = "==3.5.0" },
     { name = "django-postgres-extra", specifier = "==2.0.9" },
@@ -4583,7 +4627,7 @@ requires-dist = [
     { name = "drf-spectacular-jsonapi", specifier = "==0.5.1" },
     { name = "fonttools", specifier = "==4.62.1" },
     { name = "gevent", specifier = "==25.9.1" },
-    { name = "gunicorn", specifier = "==23.0.0" },
+    { name = "gunicorn", specifier = "==26.0.0" },
     { name = "h2", specifier = "==4.3.0" },
     { name = "lxml", specifier = "==6.1.0" },
     { name = "markdown", specifier = "==3.10.2" },
@@ -4597,6 +4641,7 @@ requires-dist = [
     { name = "sentry-sdk", extras = ["django"], specifier = "==2.56.0" },
     { name = "sqlparse", specifier = "==0.5.5" },
     { name = "uuid6", specifier = "==2024.7.10" },
+    { name = "uvloop", specifier = "==0.22.1" },
     { name = "werkzeug", specifier = "==3.1.7" },
     { name = "xmlsec", specifier = "==1.3.17" },
 ]
@@ -4671,6 +4716,16 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/7b/08/9c66c269b0d417a0af9fb969535f0371b8c538633535a7a6a5ca3f9231e2/psycopg2_binary-2.9.9-cp312-cp312-win_amd64.whl", hash = "sha256:81ff62668af011f9a48787564ab7eded4e9fb17a4a6a74af5ffa6a457400d2ab", size = 1163864, upload-time = "2023-10-28T09:37:28.155Z" },
 ]
 
+[[package]]
+name = "pubcontrol"
+version = "3.5.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pyjwt", extra = ["crypto"] },
+    { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/25/6a/02202a247214a6ffd5148ab1b16aca1c334b40dca211bca0442c8b7c7447/pubcontrol-3.5.0.tar.gz", hash = "sha256:a5ec6b3f53edfd005675518e5e4cc23b34122776835ae7c6dbd1db173d1ff0cb", size = 18199, upload-time = "2023-07-05T19:11:40.477Z" }
+
 [[package]]
 name = "py-deviceid"
 version = "0.1.1"
@@ -4682,14 +4737,14 @@ wheels = [
 
 [[package]]
 name = "py-iam-expand"
-version = "0.1.0"
+version = "0.3.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "iamdata" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/22/99/8d31a30b37825577275bb3663885b55075fba80257fcd6813b85d3aaffa8/py_iam_expand-0.1.0.tar.gz", hash = "sha256:5a2884dc267ac59a02c3a80fefc0b34c309dac681baa0f87c436067c6cf53a96", size = 10228, upload-time = "2025-04-30T07:15:35.304Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a3/08/f6e11a029b81f0bec4b7b1f18704aadf509a882cc386c90ef1ac043c18cc/py_iam_expand-0.3.0.tar.gz", hash = "sha256:4ccfe25f40ba0633a152c4f86b49cde8972ee3d4b6009b017a4310cc4b9e64c7", size = 10234, upload-time = "2026-02-24T09:47:47.772Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/79/19/482c2e0768cda7afaed07918e4fbd951e2418255fb5d1d9b35b284871716/py_iam_expand-0.1.0-py3-none-any.whl", hash = "sha256:b845ce7b50ac895b02b4f338e09c62a68ea51849794f76e189b02009bd388510", size = 12522, upload-time = "2025-04-30T07:15:33.799Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/dd/4056d0bc3d6317039d2dd2ee7cd6a5389575603e270399a8f9f20e11e721/py_iam_expand-0.3.0-py3-none-any.whl", hash = "sha256:94c0a1e9dd60316ce60ddc0cdc9a046119bde335b5bb9593ee29224857860d5a", size = 12527, upload-time = "2026-02-24T09:47:45.602Z" },
 ]
 
 [[package]]
@@ -4873,11 +4928,11 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.12.1"
+version = "2.13.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c2/27/a3b6e5bf6ff856d2509292e95c8f57f0df7017cf5394921fc4e4ef40308a/pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b", size = 102564, upload-time = "2026-03-13T19:27:37.25Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
 ]
 
 [package.optional-dependencies]
@@ -5526,6 +5581,67 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/49/4b/359f28a903c13438ef59ebeee215fb25da53066db67b305c125f1c6d2a25/sqlparse-0.5.5-py3-none-any.whl", hash = "sha256:12a08b3bf3eec877c519589833aed092e2444e68240a3577e8e26148acc7b1ba", size = 46138, upload-time = "2025-12-19T07:17:46.573Z" },
 ]
 
+[[package]]
+name = "stackit-core"
+version = "0.2.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+    { name = "pydantic" },
+    { name = "pyjwt", extra = ["crypto"] },
+    { name = "requests" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/24/90/20f9ec7387eec4067cfd3d29055d0e2b5e1e0322c601a7f48125fd8ea35f/stackit_core-0.2.0.tar.gz", hash = "sha256:b8af91877cdb060d6969a303d8cf20bc0b33b345afd91f679c44a987381e2d47", size = 8987, upload-time = "2025-06-12T08:24:45.251Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ab/b4/7b53187ce68956870d864ccb9ccfb68066c9df9de1c9568fd2feb03c4504/stackit_core-0.2.0-py3-none-any.whl", hash = "sha256:04632fc6742790d08ddfcb7f2313e04d1254827397a80250f838a2f81b92645b", size = 10240, upload-time = "2025-06-12T08:24:44.214Z" },
+]
+
+[[package]]
+name = "stackit-iaas"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dateutil" },
+    { name = "requests" },
+    { name = "stackit-core" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/52/07/24e65278300d5c3cb19cb1660bff924c80812cf8aad3e715f826bae5aa80/stackit_iaas-1.4.0.tar.gz", hash = "sha256:93523b23442350c7ebefd9129485c4c2a539f694a9c36a0f8edfaba9862057ea", size = 116236, upload-time = "2026-05-13T09:43:15.996Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/08/51/2201164d7bfacf47539888c735f10f6320c188252384957aa1b23121a210/stackit_iaas-1.4.0-py3-none-any.whl", hash = "sha256:3f4a32321b57ac238f73e5d660c6428186b92cc0425c1f0783ba801e377149d9", size = 316588, upload-time = "2026-05-13T09:43:14.943Z" },
+]
+
+[[package]]
+name = "stackit-objectstorage"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dateutil" },
+    { name = "requests" },
+    { name = "stackit-core" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/90/80/b790756af40a5c6d979dd688b2557394ac54b594eb4c08edc33157ba890f/stackit_objectstorage-1.4.0.tar.gz", hash = "sha256:4a3812b4de102b199f061706a802909f9e53ae9b0858769d5bd720f814c8bdbe", size = 31814, upload-time = "2026-05-13T09:43:05.027Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/68/f1/ffa8d5e2ec9f818c72a6f045691364eb4e927ee86641993a70882d00205a/stackit_objectstorage-1.4.0-py3-none-any.whl", hash = "sha256:1a3285c6840d95cff591d84fd21803575cb0d010c398e6575ed92987b9c39866", size = 65061, upload-time = "2026-05-13T09:43:04.13Z" },
+]
+
+[[package]]
+name = "stackit-resourcemanager"
+version = "0.8.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dateutil" },
+    { name = "requests" },
+    { name = "stackit-core" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/23/2d/f458f18e48ed2b1c83df52cff7dbdfd5dd904fb2980ffd9385876e47bbd9/stackit_resourcemanager-0.8.0.tar.gz", hash = "sha256:f44542beab4130857f5a7f465cf02defeef657bdf63c1beeb3102f0ba3c003fe", size = 33943, upload-time = "2026-05-13T09:43:08.667Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c7/9c/38a74d0f7a89b4320f6d2366fb660638bda8860daa08748b12c713d84381/stackit_resourcemanager-0.8.0-py3-none-any.whl", hash = "sha256:dd04bb8353d041a137c4dcba190beabded7acfaff1bc98b218fce20a99389ebc", size = 81288, upload-time = "2026-05-13T09:43:07.81Z" },
+]
+
 [[package]]
 name = "statsd"
 version = "4.0.1"
@@ -5730,6 +5846,26 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d3/3e/4ae6af487ce5781ed71d5fe10aca72e7cbc4d4f45afc31b120287082a8dd/uuid6-2024.7.10-py3-none-any.whl", hash = "sha256:93432c00ba403751f722829ad21759ff9db051dea140bf81493271e8e4dd18b7", size = 6376, upload-time = "2024-07-10T16:39:36.148Z" },
 ]
 
+[[package]]
+name = "uvloop"
+version = "0.22.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/06/f0/18d39dbd1971d6d62c4629cc7fa67f74821b0dc1f5a77af43719de7936a7/uvloop-0.22.1.tar.gz", hash = "sha256:6c84bae345b9147082b17371e3dd5d42775bddce91f885499017f4607fdaf39f", size = 2443250, upload-time = "2025-10-16T22:17:19.342Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c7/d5/69900f7883235562f1f50d8184bb7dd84a2fb61e9ec63f3782546fdbd057/uvloop-0.22.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:c60ebcd36f7b240b30788554b6f0782454826a0ed765d8430652621b5de674b9", size = 1352420, upload-time = "2025-10-16T22:16:21.187Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/73/c4e271b3bce59724e291465cc936c37758886a4868787da0278b3b56b905/uvloop-0.22.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:3b7f102bf3cb1995cfeaee9321105e8f5da76fdb104cdad8986f85461a1b7b77", size = 748677, upload-time = "2025-10-16T22:16:22.558Z" },
+    { url = "https://files.pythonhosted.org/packages/86/94/9fb7fad2f824d25f8ecac0d70b94d0d48107ad5ece03769a9c543444f78a/uvloop-0.22.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:53c85520781d84a4b8b230e24a5af5b0778efdb39142b424990ff1ef7c48ba21", size = 3753819, upload-time = "2025-10-16T22:16:23.903Z" },
+    { url = "https://files.pythonhosted.org/packages/74/4f/256aca690709e9b008b7108bc85fba619a2bc37c6d80743d18abad16ee09/uvloop-0.22.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:56a2d1fae65fd82197cb8c53c367310b3eabe1bbb9fb5a04d28e3e3520e4f702", size = 3804529, upload-time = "2025-10-16T22:16:25.246Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/74/03c05ae4737e871923d21a76fe28b6aad57f5c03b6e6bfcfa5ad616013e4/uvloop-0.22.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:40631b049d5972c6755b06d0bfe8233b1bd9a8a6392d9d1c45c10b6f9e9b2733", size = 3621267, upload-time = "2025-10-16T22:16:26.819Z" },
+    { url = "https://files.pythonhosted.org/packages/75/be/f8e590fe61d18b4a92070905497aec4c0e64ae1761498cad09023f3f4b3e/uvloop-0.22.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:535cc37b3a04f6cd2c1ef65fa1d370c9a35b6695df735fcff5427323f2cd5473", size = 3723105, upload-time = "2025-10-16T22:16:28.252Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/ff/7f72e8170be527b4977b033239a83a68d5c881cc4775fca255c677f7ac5d/uvloop-0.22.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:fe94b4564e865d968414598eea1a6de60adba0c040ba4ed05ac1300de402cd42", size = 1359936, upload-time = "2025-10-16T22:16:29.436Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/c6/e5d433f88fd54d81ef4be58b2b7b0cea13c442454a1db703a1eea0db1a59/uvloop-0.22.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:51eb9bd88391483410daad430813d982010f9c9c89512321f5b60e2cddbdddd6", size = 752769, upload-time = "2025-10-16T22:16:30.493Z" },
+    { url = "https://files.pythonhosted.org/packages/24/68/a6ac446820273e71aa762fa21cdcc09861edd3536ff47c5cd3b7afb10eeb/uvloop-0.22.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:700e674a166ca5778255e0e1dc4e9d79ab2acc57b9171b79e65feba7184b3370", size = 4317413, upload-time = "2025-10-16T22:16:31.644Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/6f/e62b4dfc7ad6518e7eff2516f680d02a0f6eb62c0c212e152ca708a0085e/uvloop-0.22.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7b5b1ac819a3f946d3b2ee07f09149578ae76066d70b44df3fa990add49a82e4", size = 4426307, upload-time = "2025-10-16T22:16:32.917Z" },
+    { url = "https://files.pythonhosted.org/packages/90/60/97362554ac21e20e81bcef1150cb2a7e4ffdaf8ea1e5b2e8bf7a053caa18/uvloop-0.22.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e047cc068570bac9866237739607d1313b9253c3051ad84738cbb095be0537b2", size = 4131970, upload-time = "2025-10-16T22:16:34.015Z" },
+    { url = "https://files.pythonhosted.org/packages/99/39/6b3f7d234ba3964c428a6e40006340f53ba37993f46ed6e111c6e9141d18/uvloop-0.22.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:512fec6815e2dd45161054592441ef76c830eddaad55c8aa30952e6fe1ed07c0", size = 4296343, upload-time = "2025-10-16T22:16:35.149Z" },
+]
+
 [[package]]
 name = "vine"
 version = "5.1.0"
@@ -5785,7 +5921,7 @@ source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
     { name = "httpx" },
-    { name = "pyjwt" },
+    { name = "pyjwt", extra = ["crypto"] },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/3c/2f/99fb8718274116c5c146c745755620fd5c5943f78ca52ca9b17e94348286/workos-6.0.4.tar.gz", hash = "sha256:b0bfe8fd212b8567422c4ea3732eb33608794033eb3a69900c6b04db183c32d6", size = 172217, upload-time = "2026-04-16T03:09:28.583Z" }
 wheels = [
diff --git a/contrib/aws/multi-account-securityhub/Dockerfile b/contrib/aws/multi-account-securityhub/Dockerfile
index 1cc6c326b7..de5c57ba7b 100644
--- a/contrib/aws/multi-account-securityhub/Dockerfile
+++ b/contrib/aws/multi-account-securityhub/Dockerfile
@@ -1,7 +1,7 @@
 # Build command
 # docker build --platform=linux/amd64  --no-cache -t prowler:latest .
 
-ARG PROWLER_VERSION=latest
+ARG PROWLER_VERSION=latest@sha256:4b796c6df40a3350c7947747b59bdda230d0da6222287500e13b0a8e1574aad4
 
 FROM toniblyx/prowler:${PROWLER_VERSION}
 
diff --git a/contrib/inventory-graph/lib/inventory_output.py b/contrib/inventory-graph/lib/inventory_output.py
index 359e7eb91f..459dc37cdb 100644
--- a/contrib/inventory-graph/lib/inventory_output.py
+++ b/contrib/inventory-graph/lib/inventory_output.py
@@ -16,7 +16,6 @@ from typing import Optional
 from prowler.lib.logger import logger
 from lib.models import ConnectivityGraph
 
-
 # ---------------------------------------------------------------------------
 # JSON output
 # ---------------------------------------------------------------------------
diff --git a/contrib/k8s/helm/prowler-api/values.yaml b/contrib/k8s/helm/prowler-api/values.yaml
index 81eda5f690..0395c6f704 100644
--- a/contrib/k8s/helm/prowler-api/values.yaml
+++ b/contrib/k8s/helm/prowler-api/values.yaml
@@ -28,7 +28,7 @@ containers:
     image:
       repository: prowlercloud/prowler-api
       pullPolicy: IfNotPresent
-    command: ["../docker-entrypoint.sh", "beat"]
+    command: ["/home/prowler/docker-entrypoint.sh", "beat"]
 
 secrets:
   POSTGRES_HOST:
diff --git a/contrib/k8s/helm/prowler-app/templates/ui/configmap.yaml b/contrib/k8s/helm/prowler-app/templates/ui/configmap.yaml
index 38d6e65ee3..856770722a 100644
--- a/contrib/k8s/helm/prowler-app/templates/ui/configmap.yaml
+++ b/contrib/k8s/helm/prowler-app/templates/ui/configmap.yaml
@@ -11,8 +11,7 @@ data:
   {{- else }}
   AUTH_URL: {{ .Values.ui.authUrl | quote }}
   {{- end }}
-  API_BASE_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1"
-  NEXT_PUBLIC_API_BASE_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1"
-  NEXT_PUBLIC_API_DOCS_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1/docs"
+  UI_API_BASE_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1"
+  UI_API_DOCS_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1/docs"
   AUTH_TRUST_HOST: "true"
   UI_PORT: {{ .Values.ui.service.port | quote }}
diff --git a/contrib/k8s/helm/prowler-app/values.yaml b/contrib/k8s/helm/prowler-app/values.yaml
index 9acca09f2a..ed390af29e 100644
--- a/contrib/k8s/helm/prowler-app/values.yaml
+++ b/contrib/k8s/helm/prowler-app/values.yaml
@@ -440,7 +440,7 @@ worker_beat:
     tag: ""
 
   command:
-    - ../docker-entrypoint.sh
+    - /home/prowler/docker-entrypoint.sh
   args:
     - beat
 
diff --git a/contrib/k8s/helm/prowler-ui/values.yaml b/contrib/k8s/helm/prowler-ui/values.yaml
index d4f2dbe137..aca0178b3a 100644
--- a/contrib/k8s/helm/prowler-ui/values.yaml
+++ b/contrib/k8s/helm/prowler-ui/values.yaml
@@ -21,8 +21,8 @@ fullnameOverride: ""
 
 secrets:
   SITE_URL: http://localhost:3000
-  API_BASE_URL: http://prowler-api:8080/api/v1
-  NEXT_PUBLIC_API_DOCS_URL: http://prowler-api:8080/api/v1/docs
+  UI_API_BASE_URL: http://prowler-api:8080/api/v1
+  UI_API_DOCS_URL: http://prowler-api:8080/api/v1/docs
   AUTH_TRUST_HOST: True
   UI_PORT: 3000
   # openssl rand -base64 32
diff --git a/contrib/reverse-proxy/docker-compose.reverse-proxy.yml b/contrib/reverse-proxy/docker-compose.reverse-proxy.yml
index 08c52f3558..b8f8edec30 100644
--- a/contrib/reverse-proxy/docker-compose.reverse-proxy.yml
+++ b/contrib/reverse-proxy/docker-compose.reverse-proxy.yml
@@ -16,7 +16,7 @@
 
 services:
   nginx:
-    image: nginx:alpine
+    image: nginx:alpine@sha256:8b1e78743a03dbb2c95171cc58639fef29abc8816598e27fb910ed2e621e589a
     container_name: prowler-nginx
     restart: unless-stopped
     ports:
diff --git a/dashboard/common_methods.py b/dashboard/common_methods.py
index a2f9ffe89b..b9f59513a5 100644
--- a/dashboard/common_methods.py
+++ b/dashboard/common_methods.py
@@ -1538,6 +1538,186 @@ def get_section_container_iso(data, section_1, section_2):
     return html.Div(section_containers, className="compliance-data-layout")
 
 
+def _status_bar(success, failed, classname):
+    """Build the stacked PASS/FAIL bar shown next to an accordion title."""
+    fig = go.Figure(
+        data=[
+            go.Bar(
+                name="Failed",
+                x=[failed],
+                y=[""],
+                orientation="h",
+                marker=dict(color="#e77676"),
+                width=[0.8],
+            ),
+            go.Bar(
+                name="Success",
+                x=[success],
+                y=[""],
+                orientation="h",
+                marker=dict(color="#45cc6e"),
+                width=[0.8],
+            ),
+        ]
+    )
+    fig.update_layout(
+        barmode="stack",
+        margin=dict(l=10, r=10, t=10, b=10),
+        paper_bgcolor="rgba(0,0,0,0)",
+        plot_bgcolor="rgba(0,0,0,0)",
+        showlegend=False,
+        width=350,
+        height=30,
+        xaxis=dict(showticklabels=False, showgrid=False, zeroline=False),
+        yaxis=dict(showticklabels=False, showgrid=False, zeroline=False),
+        annotations=[
+            dict(
+                x=success + failed,
+                y=0,
+                xref="x",
+                yref="y",
+                text=str(success),
+                showarrow=False,
+                font=dict(color="#45cc6e", size=14),
+                xanchor="left",
+                yanchor="middle",
+            ),
+            dict(
+                x=0,
+                y=0,
+                xref="x",
+                yref="y",
+                text=str(failed),
+                showarrow=False,
+                font=dict(color="#e77676", size=14),
+                xanchor="right",
+                yanchor="middle",
+            ),
+        ],
+    )
+    fig.add_annotation(
+        x=failed,
+        y=0.3,
+        text="|",
+        showarrow=False,
+        xanchor="center",
+        yanchor="middle",
+        font=dict(size=20),
+    )
+    return dcc.Graph(figure=fig, config={"staticPlot": True}, className=classname)
+
+
+def get_section_containers_generic(data, section_col, id_col):
+    """Two-level view: section -> requirement id (+ description) -> checks.
+
+    Sorts lexicographically so arbitrary requirement IDs never crash the
+    version-aware sort used by the CIS renderer.
+    """
+    data["STATUS"] = data["STATUS"].apply(map_status_to_icon)
+    data[section_col] = data[section_col].astype(str)
+    data[id_col] = data[id_col].astype(str)
+    data.sort_values(by=[section_col, id_col], inplace=True)
+
+    counts_section = data.groupby([section_col, "STATUS"]).size().unstack(fill_value=0)
+    counts_id = (
+        data.groupby([section_col, id_col, "STATUS"]).size().unstack(fill_value=0)
+    )
+
+    def count(counts, key, emoji):
+        return counts.loc[key, emoji] if emoji in counts.columns else 0
+
+    has_description = "REQUIREMENTS_DESCRIPTION" in data.columns
+    table_cols = ["CHECKID", "STATUS", "REGION", "ACCOUNTID", "RESOURCEID"]
+
+    section_containers = []
+    for section in data[section_col].unique():
+        graph_div = html.Div(
+            _status_bar(
+                count(counts_section, section, pass_emoji),
+                count(counts_section, section, fail_emoji),
+                "info-bar",
+            ),
+            className="graph-section",
+        )
+
+        internal_items = []
+        for req_id in data[data[section_col] == section][id_col].unique():
+            specific_data = data[
+                (data[section_col] == section) & (data[id_col] == req_id)
+            ]
+            data_table = dash_table.DataTable(
+                data=specific_data.to_dict("records"),
+                columns=[
+                    {"name": i, "id": i}
+                    for i in table_cols
+                    if i in specific_data.columns
+                ],
+                style_table={"overflowX": "auto"},
+                style_as_list_view=True,
+                style_cell={"textAlign": "left", "padding": "5px"},
+            )
+            graph_div_req = html.Div(
+                _status_bar(
+                    count(counts_id, (section, req_id), pass_emoji),
+                    count(counts_id, (section, req_id), fail_emoji),
+                    "info-bar-child",
+                ),
+                className="graph-section-req",
+            )
+
+            title = req_id
+            if has_description:
+                title = (
+                    f"{req_id} - {specific_data['REQUIREMENTS_DESCRIPTION'].iloc[0]}"
+                )
+            if len(title) > 130:
+                title = title[:130] + " ..."
+
+            internal_items.append(
+                html.Div(
+                    [
+                        graph_div_req,
+                        dbc.Accordion(
+                            [
+                                dbc.AccordionItem(
+                                    title=title,
+                                    children=[
+                                        html.Div(
+                                            [data_table],
+                                            className="inner-accordion-content",
+                                        )
+                                    ],
+                                )
+                            ],
+                            start_collapsed=True,
+                            flush=True,
+                        ),
+                    ],
+                    className="accordion-inner--child",
+                )
+            )
+
+        section_containers.append(
+            html.Div(
+                [
+                    graph_div,
+                    dbc.Accordion(
+                        [
+                            dbc.AccordionItem(
+                                title=f"{section}", children=internal_items
+                            )
+                        ],
+                        start_collapsed=True,
+                        flush=True,
+                    ),
+                ],
+                className="accordion-inner",
+            )
+        )
+
+    return html.Div(section_containers, className="compliance-data-layout")
+
+
 def get_section_containers_format4(data, section_1):
 
     data["STATUS"] = data["STATUS"].apply(map_status_to_icon)
diff --git a/dashboard/compliance/aws_ai_security_framework_aws.py b/dashboard/compliance/aws_ai_security_framework_aws.py
new file mode 100644
index 0000000000..ece9bdf9cb
--- /dev/null
+++ b/dashboard/compliance/aws_ai_security_framework_aws.py
@@ -0,0 +1,27 @@
+import warnings
+
+from dashboard.common_methods import get_section_containers_3_levels
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+    aux = data[
+        [
+            "REQUIREMENTS_ATTRIBUTES_SECTION",
+            "REQUIREMENTS_ATTRIBUTES_SUBSECTION",
+            "NAME",
+            "CHECKID",
+            "STATUS",
+            "REGION",
+            "ACCOUNTID",
+            "RESOURCEID",
+        ]
+    ]
+
+    return get_section_containers_3_levels(
+        aux,
+        "REQUIREMENTS_ATTRIBUTES_SECTION",
+        "REQUIREMENTS_ATTRIBUTES_SUBSECTION",
+        "NAME",
+    )
diff --git a/dashboard/compliance/generic.py b/dashboard/compliance/generic.py
new file mode 100644
index 0000000000..f7d68bb52a
--- /dev/null
+++ b/dashboard/compliance/generic.py
@@ -0,0 +1,44 @@
+import warnings
+
+from dashboard.common_methods import (
+    get_section_containers_format4,
+    get_section_containers_generic,
+)
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+    # Discover REQUIREMENTS_ATTRIBUTES_* columns at runtime.
+    attr_cols = [c for c in data.columns if c.startswith("REQUIREMENTS_ATTRIBUTES_")]
+
+    # Section column (in priority order):
+    #   1. REQUIREMENTS_ATTRIBUTES_SECTION — most common convention
+    #   2. First discovered attribute column — covers novel schemas
+    #   3. None — no section, group flat by requirement id
+    if "REQUIREMENTS_ATTRIBUTES_SECTION" in attr_cols:
+        section_col = "REQUIREMENTS_ATTRIBUTES_SECTION"
+    elif attr_cols:
+        section_col = attr_cols[0]
+    else:
+        section_col = None
+
+    base_cols = [
+        "REQUIREMENTS_ID",
+        "REQUIREMENTS_DESCRIPTION",
+        "STATUS",
+        "CHECKID",
+        "REGION",
+        "ACCOUNTID",
+        "RESOURCEID",
+    ]
+
+    # Two levels (section -> requirement id) when a section distinct from the
+    # id exists; otherwise group flat by requirement id.
+    if section_col and section_col != "REQUIREMENTS_ID":
+        needed = [section_col] + base_cols
+        aux = data[[c for c in needed if c in data.columns]].copy()
+        return get_section_containers_generic(aux, section_col, "REQUIREMENTS_ID")
+
+    aux = data[[c for c in base_cols if c in data.columns]].copy()
+    return get_section_containers_format4(aux, "REQUIREMENTS_ID")
diff --git a/dashboard/lib/layouts.py b/dashboard/lib/layouts.py
index 930432b6c4..3fb230f314 100644
--- a/dashboard/lib/layouts.py
+++ b/dashboard/lib/layouts.py
@@ -156,7 +156,7 @@ def create_layout_compliance(
                             html.Img(src="assets/favicon.ico", className="w-5 mr-3"),
                             html.Span("Subscribe to Prowler Cloud"),
                         ],
-                        href="https://prowler.pro/",
+                        href="https://cloud.prowler.com/",
                         target="_blank",
                         className="text-prowler-stone-900 inline-flex px-4 py-2 text-xs font-bold uppercase transition-all rounded-lg text-gray-900 hover:bg-prowler-stone-900/10 border-solid border-1 hover:border-prowler-stone-900/10 hover:border-solid hover:border-1 border-prowler-stone-900/10",
                     ),
diff --git a/dashboard/pages/compliance.py b/dashboard/pages/compliance.py
index c1da9f611e..773dd095da 100644
--- a/dashboard/pages/compliance.py
+++ b/dashboard/pages/compliance.py
@@ -215,6 +215,58 @@ else:
     )
 
 
+def _ensure_scope_columns(data):
+    """Guarantee ACCOUNTID and REGION exist.
+
+    Scope columns always sit between DESCRIPTION and ASSESSMENTDATE, so derive
+    them positionally for any provider (e.g. Okta's ORGANIZATIONDOMAIN) and
+    fall back to "-" to avoid a KeyError.
+    """
+    cols = list(data.columns)
+    scope = []
+    if "DESCRIPTION" in cols and "ASSESSMENTDATE" in cols:
+        start, end = cols.index("DESCRIPTION") + 1, cols.index("ASSESSMENTDATE")
+        scope = [c for c in cols[start:end] if c not in ("ACCOUNTID", "REGION")]
+
+    if "ACCOUNTID" not in data.columns:
+        if scope:
+            data.rename(columns={scope.pop(0): "ACCOUNTID"}, inplace=True)
+        else:
+            data["ACCOUNTID"] = "-"
+    if "REGION" not in data.columns:
+        if scope:
+            data.rename(columns={scope.pop(0): "REGION"}, inplace=True)
+        else:
+            data["REGION"] = "-"
+    return data
+
+
+def _dispatch_compliance_renderer(data, analytics_input):
+    """Resolve the compliance renderer module and return (table, deduped_data).
+
+    Tries to import the framework-specific builtin module.  On
+    ModuleNotFoundError (dynamic/external provider with no dedicated module),
+    falls back to the generic renderer.  Any other ImportError is re-raised.
+    get_table() is called OUTSIDE the try block so errors inside the renderer
+    surface as real exceptions rather than being swallowed.
+    """
+    current = analytics_input.replace(".", "_")
+    target = f"dashboard.compliance.{current}"
+    try:
+        module = importlib.import_module(target)
+    except ModuleNotFoundError as exc:
+        if exc.name != target:
+            raise
+        from dashboard.compliance import generic as module
+    dedup_columns = ["CHECKID", "STATUS", "RESOURCEID", "STATUSEXTENDED"]
+    if "MUTED" in data.columns:
+        dedup_columns.insert(2, "MUTED")
+    data = data.drop_duplicates(subset=dedup_columns)
+    if "threatscore" in analytics_input:
+        data = get_threatscore_mean_by_pillar(data)
+    return module.get_table(data), data
+
+
 @callback(
     [
         Output("output", "children"),
@@ -292,7 +344,7 @@ def display_data(
         data.rename(columns={"TENANCYID": "ACCOUNTID"}, inplace=True)
 
     # Filter the chosen level of the CIS
-    if is_level_1:
+    if is_level_1 and "REQUIREMENTS_ATTRIBUTES_PROFILE" in data.columns:
         data = data[data["REQUIREMENTS_ATTRIBUTES_PROFILE"].str.contains("Level 1")]
 
     # Rename the column PROJECTID to ACCOUNTID for GCP
@@ -314,6 +366,9 @@ def display_data(
         data.rename(columns={"SUBSCRIPTION": "ACCOUNTID"}, inplace=True)
         data["REGION"] = "-"
 
+    # Normalize scope columns for any remaining (e.g. dynamic) provider.
+    data = _ensure_scope_columns(data)
+
     # Filter ACCOUNT
     if account_filter == ["All"]:
         updated_cloud_account_values = data["ACCOUNTID"].unique()
@@ -409,36 +464,7 @@ def display_data(
         # Check cases where the compliance start with AWS_
         if "aws_" in analytics_input:
             analytics_input = analytics_input + "_aws"
-        try:
-            current = analytics_input.replace(".", "_")
-            compliance_module = importlib.import_module(
-                f"dashboard.compliance.{current}"
-            )
-            # Build subset list based on available columns
-            dedup_columns = ["CHECKID", "STATUS", "RESOURCEID", "STATUSEXTENDED"]
-            if "MUTED" in data.columns:
-                dedup_columns.insert(2, "MUTED")
-            data = data.drop_duplicates(subset=dedup_columns)
-
-            if "threatscore" in analytics_input:
-                data = get_threatscore_mean_by_pillar(data)
-
-            table = compliance_module.get_table(data)
-        except ModuleNotFoundError:
-            table = html.Div(
-                [
-                    html.H5(
-                        "No data found for this compliance",
-                        className="card-title",
-                        style={"text-align": "left", "color": "black"},
-                    )
-                ],
-                style={
-                    "width": "99%",
-                    "margin-right": "0.8%",
-                    "margin-bottom": "10px",
-                },
-            )
+        table, data = _dispatch_compliance_renderer(data, analytics_input)
 
         df = data.copy()
         # Remove Muted rows
diff --git a/dashboard/pages/overview.py b/dashboard/pages/overview.py
index 665aa8e195..e705f15e9f 100644
--- a/dashboard/pages/overview.py
+++ b/dashboard/pages/overview.py
@@ -1538,7 +1538,7 @@ def filter_data(
                     html.Img(src="assets/favicon.ico", className="w-5 mr-3"),
                     html.Span("Subscribe to Prowler Cloud"),
                 ],
-                href="https://prowler.pro/",
+                href="https://cloud.prowler.com/",
                 target="_blank",
                 className="text-prowler-stone-900 inline-flex px-4 py-2 text-xs font-bold uppercase transition-all rounded-lg text-gray-900 hover:bg-prowler-stone-900/10 border-solid border-1 hover:border-prowler-stone-900/10 hover:border-solid hover:border-1 border-prowler-stone-900/10",
             ),
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index 2020c7d21a..d737298183 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -1,6 +1,6 @@
 services:
   api-dev-init:
-    image: busybox:1.37.0
+    image: busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
     volumes:
       - ./_data/api:/data
     command: ["sh", "-c", "chown -R 1000:1000 /data"]
@@ -64,7 +64,7 @@ services:
         condition: service_healthy
 
   postgres:
-    image: postgres:16.3-alpine3.20
+    image: postgres:16.3-alpine3.20@sha256:36ed71227ae36305d26382657c0b96cbaf298427b3f1eaeb10d77a6dea3eec41
     hostname: "postgres-db"
     volumes:
       - ./_data/postgres:/var/lib/postgresql/data
@@ -88,7 +88,7 @@ services:
       retries: 5
 
   valkey:
-    image: valkey/valkey:7-alpine3.19
+    image: valkey/valkey:7-alpine3.19@sha256:4054fe7fc607b9326ac7c4691ed26e9670d2ff17a9fb28c2577adecf928acbcc
     hostname: "valkey"
     volumes:
       - ./_data/valkey:/data
@@ -104,7 +104,7 @@ services:
       retries: 3
 
   neo4j:
-    image: graphstack/dozerdb:5.26.3.0
+    image: graphstack/dozerdb:5.26.3.0@sha256:a77526ea3918fdc46d1fff70c4aea7d71d3874a26ecec059179d6775845b1247
     hostname: "neo4j"
     volumes:
       - ./_data/neo4j:/data
@@ -139,6 +139,8 @@ services:
 
   worker-dev:
     image: prowler-api-dev
+    # Give Celery soft shutdown time to drain/re-queue in-flight tasks on stop.
+    stop_grace_period: 120s
     build:
       context: ./api
       dockerfile: Dockerfile
@@ -183,7 +185,7 @@ services:
         soft: 65536
         hard: 65536
     entrypoint:
-      - "../docker-entrypoint.sh"
+      - "/home/prowler/docker-entrypoint.sh"
       - "beat"
 
   mcp-server:
diff --git a/docker-compose.yml b/docker-compose.yml
index a9d2e03c3d..6cb5ac237d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,7 +6,7 @@
 #
 services:
   api-init:
-    image: busybox:1.37.0
+    image: busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
     volumes:
       - ./_data/api:/data
     command: ["sh", "-c", "chown -R 1000:1000 /data"]
@@ -60,7 +60,7 @@ services:
       start_period: 60s
 
   postgres:
-    image: postgres:16.3-alpine3.20
+    image: postgres:16.3-alpine3.20@sha256:36ed71227ae36305d26382657c0b96cbaf298427b3f1eaeb10d77a6dea3eec41
     hostname: "postgres-db"
     volumes:
       - ./_data/postgres:/var/lib/postgresql/data
@@ -80,7 +80,7 @@ services:
       retries: 5
 
   valkey:
-    image: valkey/valkey:7-alpine3.19
+    image: valkey/valkey:7-alpine3.19@sha256:4054fe7fc607b9326ac7c4691ed26e9670d2ff17a9fb28c2577adecf928acbcc
     hostname: "valkey"
     volumes:
       - ./_data/valkey:/data
@@ -96,7 +96,7 @@ services:
       retries: 3
 
   neo4j:
-    image: graphstack/dozerdb:5.26.3.0
+    image: graphstack/dozerdb:5.26.3.0@sha256:a77526ea3918fdc46d1fff70c4aea7d71d3874a26ecec059179d6775845b1247
     hostname: "neo4j"
     volumes:
       - ./_data/neo4j:/data
@@ -129,6 +129,8 @@ services:
 
   worker:
     image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
+    # Give Celery soft shutdown time to drain/re-queue in-flight tasks on stop.
+    stop_grace_period: 120s
     env_file:
       - path: .env
         required: false
@@ -158,7 +160,7 @@ services:
         soft: 65536
         hard: 65536
     entrypoint:
-      - "../docker-entrypoint.sh"
+      - "/home/prowler/docker-entrypoint.sh"
       - "beat"
 
   mcp-server:
diff --git a/docs/developer-guide/ai-skills.mdx b/docs/developer-guide/ai-skills.mdx
index 6a0787dac8..ceb154d027 100644
--- a/docs/developer-guide/ai-skills.mdx
+++ b/docs/developer-guide/ai-skills.mdx
@@ -8,7 +8,77 @@ This guide explains the AI Skills system that provides on-demand context and pat
 **What are AI Skills?** Skills are structured instructions that help AI agents (Claude Code, Cursor, Copilot, etc.) understand Prowler's conventions, patterns, and best practices.
 </Info>
 
-## Architecture Overview
+Skills live in the [`skills/`](https://github.com/prowler-cloud/prowler/tree/master/skills) directory of the Prowler OSS repository. Each skill is a folder containing a `SKILL.md` file with its patterns and metadata.
+
+## Installation
+
+To enable skills for the supported AI coding assistants, run the setup script from the repository root:
+
+```bash
+./skills/setup.sh
+```
+
+The script creates symlinks so each tool finds the skills in its expected location:
+
+| Tool | Created by setup |
+|------|------------------|
+| Claude Code | `.claude/skills/` symlink and `CLAUDE.md` |
+| Gemini CLI | `.gemini/skills/` symlink and `GEMINI.md` |
+| Codex (OpenAI) | `.codex/skills/` symlink (uses `AGENTS.md` natively) |
+| GitHub Copilot | `.github/copilot-instructions.md` symlink to `AGENTS.md` |
+
+After running the setup, restart the AI coding assistant to load the skills.
+
+## Using Skills
+
+AI agents discover skills automatically and load them when a request matches a skill trigger. To load a skill manually during a session, point the agent to the skill's `SKILL.md` file:
+
+```text
+Read skills/{skill-name}/SKILL.md
+```
+
+For the full list of available skills, their triggers, and the Auto-invoke mappings, see the [`skills/README.md`](https://github.com/prowler-cloud/prowler/blob/master/skills/README.md) and [`AGENTS.md`](https://github.com/prowler-cloud/prowler/blob/master/AGENTS.md) in the repository.
+
+## Available Skills
+
+| Type | Skills |
+|------|--------|
+| **Generic** | typescript, react-19, nextjs-16, tailwind-4, pytest, playwright, django-drf, zod-4, zustand-5, ai-sdk-5, vitest, tdd |
+| **Prowler** | prowler, prowler-sdk-check, prowler-api, prowler-ui, prowler-mcp, prowler-provider, prowler-compliance, prowler-compliance-review, prowler-docs, prowler-pr, prowler-ci, prowler-attack-paths-query |
+| **Testing** | prowler-test-sdk, prowler-test-api, prowler-test-ui |
+| **Meta** | skill-creator, skill-sync |
+
+<Note>
+This table is a snapshot. The repository is the source of truth: see [`skills/README.md`](https://github.com/prowler-cloud/prowler/blob/master/skills/README.md) for the current, complete list.
+</Note>
+
+## Skill Structure
+
+Each skill follows the [Agent Skills spec](https://agentskills.io):
+
+```text
+skills/{skill-name}/
+├── SKILL.md          # Patterns, rules, decision trees
+├── assets/           # Code templates, schemas
+└── references/       # Links to local docs (single source of truth)
+```
+
+## Key Design Decisions
+
+1. **Self-contained skills** - Critical patterns inline for fast loading
+2. **Local doc references** - No web URLs, points to `docs/developer-guide/*.mdx`
+3. **Single source of truth** - Skills reference docs, no duplication
+4. **On-demand loading** - AI loads only what's needed for the task
+
+## Creating New Skills
+
+Use the `skill-creator` meta-skill to create new skills that follow the Agent Skills spec. See [`AGENTS.md`](https://github.com/prowler-cloud/prowler/blob/master/AGENTS.md) for the full list of available skills and their triggers.
+
+## How Skills Work
+
+The diagrams below explain the internals of the skill system. They are useful for understanding the design, but are not required to install or use skills.
+
+### Architecture Overview
 
 ```mermaid
 graph LR
@@ -28,7 +98,7 @@ graph LR
     style F fill:#1a4d2e,stroke:#66bb6a,color:#fff
 ```
 
-## How It Works
+### Request Lifecycle
 
 ```mermaid
 sequenceDiagram
@@ -68,7 +138,7 @@ sequenceDiagram
     A->>U: Creates check with correct patterns
 ```
 
-## Before vs After
+### With and Without Skills
 
 ```mermaid
 graph TD
@@ -96,7 +166,7 @@ graph TD
     style AFTER fill:#1a4d1a,stroke:#66bb6a,color:#fff
 ```
 
-## Complete Architecture
+### Full Component Map
 
 ```mermaid
 flowchart TB
@@ -110,7 +180,7 @@ flowchart TB
         subgraph GENERIC["Generic Skills"]
             G1["typescript"]
             G2["react-19"]
-            G3["nextjs-15"]
+            G3["nextjs-16"]
             G4["tailwind-4"]
             G5["pytest"]
             G6["playwright"]
@@ -186,34 +256,3 @@ flowchart TB
     style STRUCTURE fill:#5c3d1a,stroke:#ffb74d,color:#fff
     style DOCS fill:#1a3d4d,stroke:#4dd0e1,color:#fff
 ```
-
-## Skills Included
-
-| Type | Skills |
-|------|--------|
-| **Generic** | typescript, react-19, nextjs-15, tailwind-4, pytest, playwright, django-drf, zod-4, zustand-5, ai-sdk-5 |
-| **Prowler** | prowler, prowler-sdk-check, prowler-api, prowler-ui, prowler-mcp, prowler-provider, prowler-compliance, prowler-compliance-review, prowler-docs, prowler-pr, prowler-ci |
-| **Testing** | prowler-test-sdk, prowler-test-api, prowler-test-ui |
-| **Meta** | skill-creator, skill-sync |
-
-## Skill Structure
-
-Each skill follows the [Agent Skills spec](https://agentskills.io):
-
-```
-skills/{skill-name}/
-├── SKILL.md          # Patterns, rules, decision trees
-├── assets/           # Code templates, schemas
-└── references/       # Links to local docs (single source of truth)
-```
-
-## Key Design Decisions
-
-1. **Self-contained skills** - Critical patterns inline for fast loading
-2. **Local doc references** - No web URLs, points to `docs/developer-guide/*.mdx`
-3. **Single source of truth** - Skills reference docs, no duplication
-4. **On-demand loading** - AI loads only what's needed for the task
-
-## Creating New Skills
-
-Use the `skill-creator` meta-skill to create new skills that follow the Agent Skills spec. See `AGENTS.md` for the full list of available skills and their triggers.
diff --git a/docs/developer-guide/end2end-testing.mdx b/docs/developer-guide/end2end-testing.mdx
index 0a62251531..9013a32245 100644
--- a/docs/developer-guide/end2end-testing.mdx
+++ b/docs/developer-guide/end2end-testing.mdx
@@ -221,9 +221,9 @@ Before running E2E tests:
     ```
 
 - **Ensure Prowler API is available**
-  - By default, Playwright uses `NEXT_PUBLIC_API_BASE_URL=http://localhost:8080/api/v1` (configured in `playwright.config.ts`).
+  - By default, Playwright uses `UI_API_BASE_URL=http://localhost:8080/api/v1` (configured in `playwright.config.ts`).
   - Start Prowler API so it is reachable on that URL (for example, via `docker-compose-dev.yml` or the development orchestration used locally).
-  - If a different API URL is required, set `NEXT_PUBLIC_API_BASE_URL` accordingly before running the tests.
+  - If a different API URL is required, set `UI_API_BASE_URL` accordingly before running the tests.
 
 - **Ensure Prowler App UI is available**
   - Playwright automatically starts the Next.js server through the `webServer` block in `playwright.config.ts` (`pnpm run dev` by default).
diff --git a/docs/developer-guide/environment-variables.mdx b/docs/developer-guide/environment-variables.mdx
new file mode 100644
index 0000000000..1f4d17ee2e
--- /dev/null
+++ b/docs/developer-guide/environment-variables.mdx
@@ -0,0 +1,53 @@
+---
+title: 'Environment Variable Naming Convention'
+---
+
+Prowler is a monorepo composed of several runtime components — Prowler App (the web user interface), Prowler API (the backend), Prowler SDK, and Prowler MCP Server (Model Context Protocol) — that frequently share a single `.env` file. To keep that shared configuration unambiguous, each component namespaces its environment variables with a component-specific prefix.
+
+## Component Prefixes
+
+Each component owns a dedicated prefix for the environment variables it reads:
+
+| Component | Prefix | Status |
+|-----------|--------|--------|
+| Prowler App (web UI) | `UI_` | Adopted |
+| Prowler API (backend) | `API_` | Planned |
+| Prowler SDK | `SDK_` | Planned |
+| Prowler MCP Server | `MCP_` | Planned |
+
+## Why Component Prefixes Matter
+
+Component prefixes solve three concrete problems in a shared configuration file:
+
+- **Collisions in a shared `.env`:** Several components historically read identically named variables. The API base URL, for example, is consumed by more than one component, so a single unprefixed name is ambiguous. A component prefix removes that ambiguity.
+- **Explicit ownership:** A prefix states, at a glance, which component consumes a variable.
+- **Reduced accidental exposure:** For Prowler App, scoping browser-facing configuration under one intentional prefix prevents server-only values from leaking into the client bundle.
+
+## Prowler App
+
+Prowler App has adopted the `UI_` prefix. Its public configuration is resolved from the container environment at runtime rather than inlined at build time, so a single pre-built image serves any deployment. For the operational details on changing these values without rebuilding the image, see [Troubleshooting](/troubleshooting).
+
+The former build-time variables map to the new runtime variables as follows:
+
+| Former variable | New variable |
+|-----------------|--------------|
+| `NEXT_PUBLIC_API_BASE_URL` | `UI_API_BASE_URL` |
+| `NEXT_PUBLIC_API_DOCS_URL` | `UI_API_DOCS_URL` |
+| `NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID` | `UI_GOOGLE_TAG_MANAGER_ID` |
+| `NEXT_PUBLIC_SENTRY_DSN`, `SENTRY_DSN` | `UI_SENTRY_DSN` |
+| `NEXT_PUBLIC_SENTRY_ENVIRONMENT`, `SENTRY_ENVIRONMENT` | `UI_SENTRY_ENVIRONMENT` |
+
+The build-time-only Sentry variables used for source-map upload — `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_AUTH_TOKEN`, and `SENTRY_RELEASE` — keep their names, as they are not part of the App's runtime configuration.
+
+## Upcoming Breaking Change
+
+<Warning>
+Adopting the `API_`, `SDK_`, and `MCP_` prefixes for Prowler API, Prowler SDK, and Prowler MCP Server is a planned breaking change in a future release. Migrate environment configuration to the new names when upgrading.
+</Warning>
+
+Prowler API, Prowler SDK, and Prowler MCP Server have not yet adopted the convention. In a future release, the variables each of these components reads will be namespaced under `API_`, `SDK_`, and `MCP_` respectively. The per-component mapping from current to prefixed names will be documented when each change is released.
+
+## Deprecated Names
+
+- **Prowler App:** The bare server-side `SENTRY_DSN` and `SENTRY_ENVIRONMENT` are no longer read; the server and edge runtimes now read `UI_SENTRY_DSN` and `UI_SENTRY_ENVIRONMENT`. The former `NEXT_PUBLIC_*` build-time variables are deprecated but still read at runtime as a fallback when the matching `UI_*` variable is unset. This fallback will be removed in a future release, so set the `UI_*` runtime variables on the running container.
+- **Prowler API, Prowler SDK, and Prowler MCP Server:** The current, unprefixed variable names are deprecated. They continue to work today and will be removed once the prefixed convention is adopted for each component, as described in [Upcoming Breaking Change](#upcoming-breaking-change).
diff --git a/docs/developer-guide/introduction.mdx b/docs/developer-guide/introduction.mdx
index 117640c669..1d434912ef 100644
--- a/docs/developer-guide/introduction.mdx
+++ b/docs/developer-guide/introduction.mdx
@@ -108,6 +108,39 @@ uv sync
 source .venv/bin/activate
 ```
 
+### Running the Local API Development Stack
+
+For API development, Prowler provides a Makefile-based local stack in addition to the manual and Docker Compose workflows documented in the API README. PostgreSQL, Valkey, and Neo4j run with Docker Compose, while Django and the Celery worker run natively through `uv`.
+
+Before using this method, ensure `docker compose`, `tmux`, and `uv` are installed.
+
+This workflow is designed for macOS and should also work on Linux when Docker, `tmux`, and `uv` are available. Windows requires script changes before it can be supported.
+
+To start the local API stack, run:
+
+```shell
+make dev
+```
+
+This command starts the required services, creates a `tmux` session with panes for the API, worker, and PostgreSQL logs, waits until the API responds, and prints the API URL and log file paths. The API is available at:
+
+```text
+http://localhost:8080/api/v1
+```
+
+Use these commands to manage the stack:
+
+```shell
+make dev-setup   # Bootstrap dependencies, migrations, and fixtures
+make dev-attach  # Attach to the tmux session
+make dev-launch  # Start the stack on fixed ports and attach
+make dev-stop    # Stop the tmux session and containers
+make dev-clean   # Remove stopped development containers
+make dev-wipe    # Stop everything and delete local development data
+make dev-status  # Show development container status
+```
+
+The UI is not started by this workflow. Start it separately by following the UI development instructions in the `ui/` directory.
 
 ### Pre-Commit Hooks
 
diff --git a/docs/developer-guide/security-compliance-framework.mdx b/docs/developer-guide/security-compliance-framework.mdx
index 431849689f..cf756c4da0 100644
--- a/docs/developer-guide/security-compliance-framework.mdx
+++ b/docs/developer-guide/security-compliance-framework.mdx
@@ -2,40 +2,228 @@
 title: 'Creating a New Security Compliance Framework in Prowler'
 ---
 
-This guide explains how to add a new security compliance framework to Prowler, end to end. It covers directory layout, the JSON schema, check mapping conventions, the Pydantic models that validate each framework, the CSV output formatter, local validation, testing, and the pull request process.
+This guide explains how to add a new security compliance framework to Prowler, end to end. It covers directory layout, the two supported JSON schemas (universal and legacy), the Pydantic models that validate each framework, check mapping conventions, output formatting, local validation, testing, and the pull request process.
 
 ## Introduction
 
-A compliance framework in Prowler maps a public or custom control catalog (for example CIS, NIST 800-53, PCI DSS, HIPAA, ENS, CCC) to the security checks that Prowler already runs. Each requirement links to zero, one or more Prowler checks. When a scan executes, findings are aggregated per requirement to produce the compliance report rendered by Prowler CLI and Prowler Cloud.
+A compliance framework in Prowler maps a public or custom control catalog (for example CIS, NIST 800-53, PCI DSS, HIPAA, ENS, CCC, DORA) to the security checks that Prowler already runs. Each requirement links to zero, one or more Prowler checks. When a scan executes, findings are aggregated per requirement to produce the compliance report rendered by Prowler CLI and Prowler Cloud.
 
-Prowler ships with 85+ compliance frameworks across All Providers. The catalog lives under `prowler/compliance/<provider>/` (or `prowler/compliance/` for universal compliance frameworks)
+Prowler ships 85+ compliance frameworks across all providers. The catalog lives under `prowler/compliance/<provider>/` (legacy, per-provider) or `prowler/compliance/` (universal, multi-provider).
 
 <Warning>
-A compliance framework must represent the **complete state** of the source catalog. Every requirement defined by the framework has to be present in the JSON file, even when none of the existing Prowler checks can automate it. In that case, leave `Checks` as an empty array, but do not omit the requirement.
+A compliance framework must represent the **complete state** of the source catalog. Every requirement defined by the framework has to be present in the JSON file, even when no Prowler check can automate it. In that case, leave the requirement's check list empty, but do not omit the requirement.
 
 Requirement coverage feeds the compliance percentage calculations and the metadata surfaces (dashboards, widgets, exports). Missing requirements skew those metrics and break the report as a faithful snapshot of the framework.
 </Warning>
 
+### Two supported schemas
+
+| Schema | When to use | File location | Discovered as |
+| --- | --- | --- | --- |
+| **Universal (recommended for new frameworks)** | Multi-provider frameworks, or single-provider frameworks that benefit from declarative table/PDF rendering | `prowler/compliance/<framework>.json` (top-level) | Available for **every** provider whose key appears in any `requirement.checks` dict |
+| **Legacy provider-specific** | Single-provider frameworks with framework-specific attribute classes already declared in the codebase (CIS, ENS, ISO 27001, etc.) | `prowler/compliance/<provider>/<framework>_<version>_<provider>.json` | Available only under that provider |
+
+Auto-discovery happens in `get_bulk_compliance_frameworks_universal(provider)` (`prowler/lib/check/compliance_models.py:915`), which scans **both** the top-level `prowler/compliance/` directory and every per-provider sub-directory. Legacy frameworks are transparently converted to the universal `ComplianceFramework` model via `adapt_legacy_to_universal()` before being returned, so the rest of Prowler — CLI table rendering, CSV/OCSF outputs, PDF generation — works the same regardless of the source schema.
+
+> The legacy entry-point `Compliance.get_bulk(provider)` (used by older code paths) only scans per-provider sub-directories. Universal top-level files are picked up exclusively via the universal loader; this matters if you are wiring a new code path against the legacy API.
+
+For **new** frameworks, prefer the universal schema: it requires no Python code changes, supports multiple providers in a single file, and table/PDF rendering is driven entirely from declarative configuration inside the JSON.
+
+> All Pydantic models in `compliance_models.py` are imported from `pydantic.v1`. Subclasses you add for the legacy schema must use `from pydantic.v1 import BaseModel`.
+
 ### Prerequisites
 
 Before adding a new framework, complete the following checks:
 
-- **Verify the framework is not already supported.** Inspect `prowler/compliance/<provider>/` for an existing JSON file matching the name and version.
+- **Verify the framework is not already supported.** Inspect `prowler/compliance/` and every `prowler/compliance/<provider>/` for an existing JSON file matching the name and version.
 - **Confirm the required checks exist.** Every requirement that can be automated must point to one or more existing Prowler checks. For each missing check, implement it first by following the [Prowler Checks](/developer-guide/checks) guide.
-- **Review a reference framework.** Use an existing framework with a similar structure as your template. `cis_2.0_aws.json` is the canonical reference for CIS-style frameworks. `ccc_aws.json`, `ens_rd2022_aws.json`, and `nist_800_53_revision_5_aws.json` illustrate other attribute shapes.
+- **Review a reference framework.** Use an existing framework with a similar structure as your template:
+  - Universal: `prowler/compliance/dora_2022_2554.json`, `prowler/compliance/csa_ccm_4.0.json`.
+  - Legacy: `prowler/compliance/aws/cis_2.0_aws.json` (canonical CIS shape), `prowler/compliance/aws/ccc_aws.json`, `prowler/compliance/aws/ens_rd2022_aws.json`, `prowler/compliance/aws/nist_800_53_revision_5_aws.json`.
 
-## Four-Layer Architecture
+## Universal Compliance Framework
 
-A compliance framework spans four layers. A complete contribution must touch each layer that applies.
+### Where the file lives
 
-- **Layer 1 – Schema validation:** The Pydantic models in `prowler/lib/check/compliance_models.py` define the canonical schema for each attribute shape (CIS, ENS, Mitre, CCC, C5, CSA CCM, ISO 27001, KISA ISMS-P, AWS Well-Architected, Prowler ThreatScore, and a generic fallback).
-- **Layer 2 – JSON catalog:** The framework JSON file in `prowler/compliance/<provider>/` lists every requirement and maps it to checks.
-- **Layer 3 – Output formatter:** The Python module in `prowler/lib/outputs/compliance/<framework>/` builds the CSV row model, the per-provider transformer, and the CLI summary table.
-- **Layer 4 – Output dispatchers:** The dispatchers in `prowler/lib/outputs/compliance/compliance.py` and `prowler/lib/outputs/compliance/compliance_output.py` route findings to the right formatter based on the framework identifier.
+Place the file at the top level of the compliance directory:
 
-The rest of this guide walks each layer in order.
+```
+prowler/compliance/<framework_name>.json
+```
 
-## Directory Structure and File Naming
+Examples in the repository: `prowler/compliance/csa_ccm_4.0.json`, `prowler/compliance/dora_2022_2554.json`.
+
+The file is auto-discovered — there is **no** need to register it in any `__init__.py`, modify `prowler/lib/outputs/`, or update any other Python module. The framework key Prowler CLI accepts via `--compliance` is the basename of the JSON file without `.json` (`dora_2022_2554.json` → `dora_2022_2554`).
+
+### Top-level structure
+
+```json
+{
+  "framework": "<short identifier, e.g. \"DORA\" or \"CSA-CCM\">",
+  "name": "<human-readable full name>",
+  "version": "<framework version>",
+  "description": "<one-paragraph description shown in --list-compliance and PDF reports>",
+  "icon": "<short icon slug, optional>",
+  "attributes_metadata": [ /* see below */ ],
+  "outputs": { /* see below — optional */ },
+  "requirements": [ /* see below */ ]
+}
+```
+
+A `provider` field at the top level is **optional**. The framework's effective provider list is derived by `ComplianceFramework.get_providers()` (`compliance_models.py:739`) from the union of all keys appearing in `requirement.checks` across all requirements; the explicit `provider` field is used **only as a fallback** when no requirement carries any `checks` key. This is what enables a single file (e.g. `dora_2022_2554.json`) to cover AWS today and add Azure / GCP / etc. tomorrow without restructuring.
+
+Provider keys inside `requirement.checks` must match the directory names under `prowler/providers/`. The valid keys at present are: `aws`, `azure`, `gcp`, `m365`, `kubernetes`, `iac`, `github`, `googleworkspace`, `alibabacloud`, `cloudflare`, `mongodbatlas`, `nhn`, `openstack`, `oraclecloud`, `llm`. Comparison in `supports_provider()` is case-insensitive, but lowercase is the convention used everywhere in the repository.
+
+### `attributes_metadata`
+
+Declares the shape of the per-requirement `attributes` dict. When this field is present, the root validator `validate_attributes_against_metadata` (`compliance_models.py:669`) enforces the schema at load time and rejects:
+
+- Missing keys marked `required: true`.
+- Keys present in `attributes` but not declared in `attributes_metadata` (typo / drift guard).
+- Values that violate a declared `enum`.
+- Values whose Python type does not match a declared `int`, `float` or `bool`.
+
+The runtime type check **only** covers `int`, `float` and `bool`. For `str`, `list_str` and `list_dict` the type is documentation-only — non-conforming values won't fail validation. If `attributes_metadata` is omitted, **no per-requirement validation runs at all**.
+
+```json
+"attributes_metadata": [
+  {
+    "key": "Pillar",
+    "label": "Pillar",
+    "type": "str",
+    "required": true,
+    "enum": [
+      "ICT Risk Management",
+      "ICT-Related Incident Reporting",
+      "Digital Operational Resilience Testing",
+      "ICT Third-Party Risk Management",
+      "Information Sharing"
+    ],
+    "output_formats": { "csv": true, "ocsf": true }
+  },
+  {
+    "key": "Article",
+    "label": "Article",
+    "type": "str",
+    "required": true,
+    "output_formats": { "csv": true, "ocsf": true }
+  }
+]
+```
+
+Per attribute:
+
+- `key` (required): attribute name as it will appear in `requirement.attributes`.
+- `label`: human-readable label used in CSV headers and PDF.
+- `type`: one of `str`, `int`, `float`, `bool`, `list_str`, `list_dict`. Defaults to `str`.
+- `enum`: optional list of allowed values; non-conforming values are rejected at load time.
+- `required`: if `true`, every requirement must include this key with a non-null value.
+- `enum_display` / `enum_order`: optional per-enum-value visual metadata (label, abbreviation, color, icon) and explicit ordering for PDF rendering.
+- `output_formats`: `{ "csv": <bool>, "ocsf": <bool> }` — toggles inclusion in each output format. Both default to `true`.
+
+### `outputs`
+
+Optional. Controls how the framework is rendered in the console table and in the generated PDF report. Skipping it falls back to sensible defaults.
+
+```json
+"outputs": {
+  "table_config": {
+    "group_by": "Pillar"
+  },
+  "pdf_config": {
+    "language": "en",
+    "primary_color": "#003399",
+    "secondary_color": "#0055A5",
+    "bg_color": "#F0F4FA",
+    "group_by_field": "Pillar",
+    "sections": [ "ICT Risk Management", "ICT-Related Incident Reporting", "..." ],
+    "section_short_names": { "ICT Risk Management": "ICT Risk Mgmt" },
+    "charts": [
+      {
+        "id": "pillar_compliance",
+        "type": "horizontal_bar",
+        "group_by": "Pillar",
+        "title": "Compliance Score by Pillar",
+        "y_label": "Pillar",
+        "x_label": "Compliance %",
+        "value_source": "compliance_percent",
+        "color_mode": "by_value"
+      }
+    ],
+    "filter": { "only_failed": true, "include_manual": false }
+  }
+}
+```
+
+`table_config.group_by` must reference an attribute key declared in `attributes_metadata`. The same applies to `pdf_config.group_by_field` and to every `charts[].group_by`.
+
+For frameworks with weighted scoring (e.g. ThreatScore) declare `pdf_config.scoring` with `risk_field` / `weight_field` / `risk_boost_factor`. For column splitting (e.g. CIS Level 1 vs Level 2) use `table_config.split_by`.
+
+### `requirements`
+
+```json
+"requirements": [
+  {
+    "id": "DORA-Art5",
+    "name": "Governance and organisation",
+    "description": "Financial entities shall have a sound, comprehensive and well-documented ICT internal governance and control framework. ...",
+    "attributes": {
+      "Pillar": "ICT Risk Management",
+      "Article": "Article 5",
+      "ArticleTitle": "Governance and organisation"
+    },
+    "checks": {
+      "aws": [
+        "iam_avoid_root_usage",
+        "iam_no_root_access_key",
+        "iam_root_mfa_enabled"
+      ],
+      "azure": [],
+      "gcp": []
+    }
+  }
+]
+```
+
+Per requirement:
+
+- `id` (required): unique identifier within the framework.
+- `description` (required): the requirement text as authored by the framework.
+- `name`: short title shown alongside the id.
+- `attributes`: flat dict; keys must conform to `attributes_metadata`.
+- `checks`: dict keyed by provider name (the same lowercase keys listed in the previous section). Each value is a list of Prowler check names that evidence this requirement for that provider. The list **may be empty** and the dict itself defaults to `{}` if omitted; either way the requirement is still loaded and listed by `--list-compliance-requirements`, it just has zero checks to execute. Note: there is **no automatic check-existence validation** at load time — referencing a non-existent check name will silently produce a requirement with no findings. Validate this yourself (see "Validating Your Framework" below).
+
+For MITRE-style frameworks, additional optional fields are available on the requirement: `tactics`, `sub_techniques`, `platforms`, `technique_url` (these are populated automatically when adapting a legacy MITRE JSON to the universal model).
+
+### Multi-provider frameworks
+
+A single universal file can cover any number of providers. The framework appears under each provider's `--list-compliance` output as long as **at least one** requirement has that provider key in its `checks` dict.
+
+When extending an existing universal framework with a new provider, the only change required is editing `requirement.checks`:
+
+```diff
+ "checks": {
+   "aws": ["iam_avoid_root_usage", "iam_no_root_access_key"],
++  "azure": ["entra_policy_ensure_mfa_for_admin_roles"]
+ }
+```
+
+No code changes, no new file, no registration step.
+
+## Legacy Provider-Specific Compliance Framework
+
+The legacy schema is still fully supported and remains the format used by most frameworks shipped today (CIS, NIST, ISO 27001, FedRAMP, PCI DSS, GDPR, HIPAA, ENS, etc.). It binds a framework to a single provider and validates each requirement against a framework-specific Pydantic attribute class.
+
+The legacy schema spans **four layers** — a complete contribution must touch every layer that applies:
+
+- **Layer 1 — Schema validation:** the Pydantic models in `prowler/lib/check/compliance_models.py` define the canonical schema for each attribute shape.
+- **Layer 2 — JSON catalog:** the framework JSON file in `prowler/compliance/<provider>/` lists every requirement and maps it to checks.
+- **Layer 3 — Output formatter:** the Python module in `prowler/lib/outputs/compliance/<framework>/` builds the CSV row model, the per-provider transformer, and the CLI summary table.
+- **Layer 4 — Output dispatchers:** the dispatchers in `prowler/lib/outputs/compliance/compliance.py` and `prowler/lib/outputs/compliance/compliance_output.py` route findings to the right formatter based on the framework identifier.
+
+The universal schema collapses Layers 3 and 4 into declarative configuration inside the JSON — that is the main reason it is preferred for new contributions.
+
+### Directory structure and file naming
 
 Compliance frameworks live at:
 
@@ -46,8 +234,8 @@ prowler/compliance/<provider>/<framework>_<version>_<provider>.json
 The filename conventions are:
 
 - All lowercase, words separated with underscores.
-- `<provider>` is a supported provider identifier: `aws`, `azure`, `gcp`, `kubernetes`, `m365`, `github`, `googleworkspace`, `alibabacloud`, `oraclecloud`, `cloudflare`, `mongodbatlas`, `nhn`, `openstack`, `iac`, `llm`.
-- `<version>` is optional. Omit it when the framework has no versioning, as in `ccc_aws.json`.
+- `<provider>` is a supported provider identifier (same lowercase list as the universal section above).
+- `<version>` is optional but recommended. Omit only when the framework has no versioning (e.g. `ccc_aws.json`).
 - The file basename (without `.json`) is the framework key that Prowler CLI accepts via `--compliance`.
 
 Examples:
@@ -62,48 +250,50 @@ The output formatter directory mirrors the framework name:
 
 ```
 prowler/lib/outputs/compliance/<framework>/
-├── <framework>.py           # CLI summary-table dispatcher
+├── <framework>.py            # CLI summary-table dispatcher
 ├── <framework>_<provider>.py # Per-provider transformer class
 ├── models.py                 # Pydantic CSV row model
 └── __init__.py
 ```
 
-## JSON Schema Reference
+### JSON schema reference
 
-Every compliance file is a JSON document with the following top-level keys.
+Every legacy compliance file is a JSON document with the following top-level keys. `Framework`, `Name` and `Provider` are validated non-empty by the root validator `framework_and_provider_must_not_be_empty` (`compliance_models.py:329`).
 
 | Field | Type | Required | Description |
 |---|---|---|---|
 | `Framework` | string | Yes | Canonical framework identifier, for example `CIS`, `NIST-800-53-Revision-5`, `ENS`, `CCC`. |
 | `Name` | string | Yes | Human-readable framework name displayed by Prowler App. |
-| `Version` | string | Yes | Framework version, for example `2.0`. Use an empty string only for frameworks without versioning. See [Version Handling](#version-handling). |
+| `Version` | string | Yes (recommended) | Framework version, e.g. `2.0`. See [Version Handling](#version-handling). |
 | `Provider` | string | Yes | Upper-cased provider identifier: `AWS`, `AZURE`, `GCP`, `KUBERNETES`, `M365`, `GITHUB`, `GOOGLEWORKSPACE`, and so on. |
 | `Description` | string | Yes | Short description of the framework's scope and purpose. |
 | `Requirements` | array | Yes | List of [requirement objects](#requirement-object). |
 
-### Requirement Object
+#### Requirement Object
 
 Each entry in `Requirements` describes one control or requirement.
 
 | Field | Type | Required | Description |
 |---|---|---|---|
 | `Id` | string | Yes | Unique identifier within the framework, for example `1.10` or `CCC.Core.CN01.AR01`. |
-| `Name` | string | No | Optional human-readable name used by frameworks that distinguish control name from description, such as NIST. |
+| `Name` | string | No | Optional human-readable name (frameworks like NIST distinguish control name from description). |
 | `Description` | string | Yes | Verbatim description from the source framework. |
 | `Attributes` | array | Yes | List of [attribute objects](#attribute-objects). The shape depends on the framework. |
 | `Checks` | array of strings | Yes | Prowler check identifiers that automate the requirement. Leave the list empty when the control cannot be automated. |
 
-### Attribute Objects
+#### Attribute Objects
 
-Attributes carry the metadata that Prowler App and the CSV output display for each requirement. The object shape is framework-specific and is validated by a dedicated Pydantic model in `prowler/lib/check/compliance_models.py`. The most common shapes are summarized below.
+`Attributes` is parsed against the union declared in `Compliance_Requirement.Attributes` (`compliance_models.py:293`). Pydantic v1 tries each member of the union in declaration order and falls back to `Generic_Compliance_Requirement_Attribute` (the last entry) when nothing else matches — so a brand-new shape that doesn't match any existing class will silently be accepted as Generic, losing its specific fields.
 
-#### CIS_Requirement_Attribute
+As of today, the registered attribute classes are: `CIS_Requirement_Attribute`, `ENS_Requirement_Attribute`, `ASDEssentialEight_Requirement_Attribute`, `ISO27001_2013_Requirement_Attribute`, `AWS_Well_Architected_Requirement_Attribute`, `KISA_ISMSP_Requirement_Attribute`, `Prowler_ThreatScore_Requirement_Attribute`, `CCC_Requirement_Attribute`, `C5Germany_Requirement_Attribute`, `CSA_CCM_Requirement_Attribute`, and `Generic_Compliance_Requirement_Attribute` (fallback). MITRE-style frameworks use the separate `Mitre_Requirement` model with `Tactics` / `SubTechniques` / `Platforms` / `TechniqueURL` at the requirement top level. The most common shapes are summarized below.
+
+##### CIS_Requirement_Attribute
 
 Used by every CIS benchmark.
 
 | Field | Type | Required | Notes |
 |---|---|---|---|
-| `Section` | string | Yes | Top-level section, for example `1 Identity and Access Management`. |
+| `Section` | string | Yes | Top-level section, e.g. `1 Identity and Access Management`. |
 | `SubSection` | string | No | Optional second-level grouping. |
 | `Profile` | enum | Yes | One of `Level 1`, `Level 2`, `E3 Level 1`, `E3 Level 2`, `E5 Level 1`, `E5 Level 2`. |
 | `AssessmentStatus` | enum | Yes | `Manual` or `Automated`. |
@@ -116,7 +306,7 @@ Used by every CIS benchmark.
 | `DefaultValue` | string | No | Default configuration value, when relevant. |
 | `References` | string | Yes | Colon-separated list of reference URLs. |
 
-#### ENS_Requirement_Attribute
+##### ENS_Requirement_Attribute
 
 Used by the Spanish ENS (Esquema Nacional de Seguridad) frameworks.
 
@@ -132,13 +322,13 @@ Used by the Spanish ENS (Esquema Nacional de Seguridad) frameworks.
 | `ModoEjecucion` | string | Yes | Execution mode (`manual`, `automático`, `híbrido`). |
 | `Dependencias` | array of strings | Yes | Ids of prerequisite controls. Empty list when none. |
 
-#### CCC_Requirement_Attribute
+##### CCC_Requirement_Attribute
 
 Used by the Common Cloud Controls Catalog.
 
 | Field | Type | Required | Notes |
 |---|---|---|---|
-| `FamilyName` | string | Yes | Control family, for example `Data`. |
+| `FamilyName` | string | Yes | Control family, e.g. `Data`. |
 | `FamilyDescription` | string | Yes | Description of the family. |
 | `Section` | string | Yes | Section title. |
 | `SubSection` | string | Yes | Subsection title, or empty string. |
@@ -148,9 +338,9 @@ Used by the Common Cloud Controls Catalog.
 | `SectionThreatMappings` | array of objects | Yes | Each entry has `ReferenceId` and `Identifiers`. |
 | `SectionGuidelineMappings` | array of objects | Yes | Each entry has `ReferenceId` and `Identifiers`. |
 
-#### Generic_Compliance_Requirement_Attribute
+##### Generic_Compliance_Requirement_Attribute
 
-The fallback attribute model used when no framework-specific schema applies (for example NIST 800-53, PCI DSS, GDPR, HIPAA).
+The fallback attribute model used when no framework-specific schema applies (e.g. NIST 800-53, PCI DSS, GDPR, HIPAA). It is **always the last** element of the `Compliance_Requirement.Attributes` Union; that ordering is load-bearing.
 
 | Field | Type | Required | Notes |
 |---|---|---|---|
@@ -158,17 +348,17 @@ The fallback attribute model used when no framework-specific schema applies (for
 | `Section` | string | No | Section name. |
 | `SubSection` | string | No | Subsection name. |
 | `SubGroup` | string | No | Subgroup name. |
-| `Service` | string | No | Affected service, for example `aws`, `iam`. |
+| `Service` | string | No | Affected service, e.g. `iam`. |
 | `Type` | string | No | Control type. |
 | `Comment` | string | No | Free-form comment. |
 
-Additional per-framework attribute models exist for `AWS_Well_Architected_Requirement_Attribute`, `ISO27001_2013_Requirement_Attribute`, `Mitre_Requirement_Attribute_<Provider>`, `KISA_ISMSP_Requirement_Attribute`, `Prowler_ThreatScore_Requirement_Attribute`, `C5Germany_Requirement_Attribute`, and `CSA_CCM_Requirement_Attribute`. Consult `prowler/lib/check/compliance_models.py` for their full field sets.
+For the remaining attribute classes (`AWS_Well_Architected_Requirement_Attribute`, `ISO27001_2013_Requirement_Attribute`, `Mitre_Requirement_Attribute_<Provider>`, `KISA_ISMSP_Requirement_Attribute`, `Prowler_ThreatScore_Requirement_Attribute`, `C5Germany_Requirement_Attribute`, `CSA_CCM_Requirement_Attribute`) consult `prowler/lib/check/compliance_models.py` for the full field sets.
 
 <Note>
-The `Attributes` field is a Pydantic `Union`. The generic attribute model must remain the last element of that Union, otherwise Pydantic v1 silently coerces every framework into the generic shape and your specialized fields are dropped.
+The `Attributes` field is a Pydantic `Union`. The generic attribute model **must** remain the last element of that Union — otherwise Pydantic v1 silently coerces every framework into the generic shape and your specialized fields are dropped. Adding a brand-new attribute shape requires inserting the Pydantic class **before** `Generic_Compliance_Requirement_Attribute`.
 </Note>
 
-## Minimal Working Example
+#### Minimal working example
 
 The following snippet is a complete, valid framework file named `my_framework_1.0_aws.json`, saved at `prowler/compliance/aws/my_framework_1.0_aws.json`. It uses the generic attribute shape for simplicity.
 
@@ -214,26 +404,26 @@ The following snippet is a complete, valid framework file named `my_framework_1.
 }
 ```
 
-## Mapping Checks to Requirements
+### Mapping checks to requirements
 
 Each requirement links to the Prowler checks that, together, produce a PASS or FAIL verdict for that control.
 
-- **Include every requirement from the source catalog.** The framework file must mirror the full control list, one-to-one. Compliance percentages, dashboards, and exported metadata are computed against the total requirement count, so omitting an unmappable control inflates coverage and misrepresents the framework.
-- List every check by its canonical identifier, the value of `CheckID` inside the check's `.metadata.json` file.
+- **Include every requirement from the source catalog.** The framework file must mirror the full control list, one-to-one. Compliance percentages, dashboards, and exported metadata are computed against the total requirement count.
+- List every check by its canonical identifier — the value of `CheckID` inside the check's `.metadata.json` file.
 - One requirement can reference multiple checks. The requirement is evaluated as FAIL when any referenced check produces a FAIL finding for a resource in scope.
-- Leave `Checks` as an empty array when the requirement cannot be automated. The requirement still appears in the report, contributes to the total, and resolves to `MANUAL`. An empty mapping is valid; a missing requirement is not.
+- Leave `Checks` (legacy) or `checks.<provider>` (universal) as an empty array when the requirement cannot be automated. The requirement still appears in the report and contributes to the total.
 - Reuse checks across requirements when the same control applies in multiple places. Do not duplicate check logic to match framework structure.
-- Avoid referencing checks from a different provider. A compliance file is bound to one provider, and cross-provider checks will never match findings in the scan.
+- Avoid referencing checks from a different provider. A legacy compliance file is bound to one provider, and cross-provider checks will never match findings in the scan.
 
-To discover available checks, run:
+To discover available checks:
 
 ```bash
 uv run python prowler-cli.py <provider> --list-checks
 ```
 
-## Supporting Multiple Providers
+### Supporting multiple providers (legacy)
 
-Each compliance file targets a single provider. To cover several providers with the same framework (for example CIS across AWS, Azure, and GCP), ship one JSON file per provider:
+The legacy schema binds each file to a single provider. To cover several providers with the same framework, ship one JSON file per provider:
 
 ```
 prowler/compliance/aws/cis_2.0_aws.json
@@ -241,15 +431,15 @@ prowler/compliance/azure/cis_2.0_azure.json
 prowler/compliance/gcp/cis_2.0_gcp.json
 ```
 
-Keep the `Framework` and `Version` values identical across the files so the dispatcher matches them, and change only the `Provider`, `Checks`, and provider-specific metadata.
+Keep the `Framework` and `Version` values identical across the files so the dispatcher matches them; change only the `Provider`, `Checks`, and provider-specific metadata. The CIS output formatter already supports every provider listed above.
 
-The CIS output formatter already supports every provider listed above. For a brand-new framework that spans several providers, add one transformer per provider in `prowler/lib/outputs/compliance/<framework>/` and extend the summary-table dispatcher accordingly. See [Output Formatter](#output-formatter).
+For a brand-new framework that spans several providers, **prefer the universal schema** — it covers every provider from a single file. If you must use the legacy schema, add one transformer per provider in `prowler/lib/outputs/compliance/<framework>/` and extend the summary-table dispatcher accordingly. See [Output Formatter](#output-formatter).
 
-## Output Formatter
+### Output formatter
 
-Prowler renders every compliance framework in two forms: a detailed CSV report written to disk, and a summary table printed in the CLI. Both are produced by the output formatter package for the framework.
+Legacy frameworks render in two forms: a detailed CSV report written to disk, and a summary table printed in the CLI. Both are produced by the output formatter package for the framework. Universal frameworks do **not** need a Python output formatter — the `outputs` config inside the JSON drives rendering — so this section applies only to the legacy schema.
 
-For a new framework named `my_framework`, create:
+For a new legacy framework named `my_framework`, create:
 
 ```
 prowler/lib/outputs/compliance/my_framework/
@@ -259,19 +449,19 @@ prowler/lib/outputs/compliance/my_framework/
 └── models.py                  # CSV row Pydantic model
 ```
 
-### Step 1 – Define the CSV Row Model
+#### Step 1 — Define the CSV row model
 
 In `models.py`, declare a Pydantic v1 model with one field per CSV column. Use existing models such as `AWSCISModel` in `prowler/lib/outputs/compliance/cis/models.py` as the reference. Fields typically include `Provider`, `Description`, `AccountId`, `Region`, `AssessmentDate`, `Requirements_Id`, `Requirements_Description`, one `Requirements_Attributes_*` field per attribute key, plus the finding fields `Status`, `StatusExtended`, `ResourceId`, `ResourceName`, `CheckId`, `Muted`, `Framework`, `Name`.
 
-### Step 2 – Implement the Transformer Class
+#### Step 2 — Implement the transformer
 
 In `my_framework_aws.py`, subclass `ComplianceOutput` from `prowler.lib.outputs.compliance.compliance_output` and implement `transform(findings, compliance, compliance_name)`. Iterate over `findings`, match each finding to the requirements it satisfies through `finding.compliance.get(compliance_name, [])`, and append one row per attribute to `self._data`.
 
-### Step 3 – Add the Summary-Table Dispatcher
+#### Step 3 — Add the summary-table dispatcher
 
 In `my_framework.py`, implement `get_my_framework_table(findings, bulk_checks_metadata, compliance_framework, output_filename, output_directory, compliance_overview)` following the pattern in `prowler/lib/outputs/compliance/cis/cis.py`.
 
-### Step 4 – Register the Framework in the Dispatchers
+#### Step 4 — Register the framework in the dispatchers
 
 - Add the dispatcher call in `prowler/lib/outputs/compliance/compliance.py`, inside `display_compliance_table`, with a branch such as `elif "my_framework" in compliance_framework:`.
 - Register the CSV model and transformer in `prowler/lib/outputs/compliance/compliance_output.py` so the CSV file is emitted during the scan.
@@ -280,49 +470,94 @@ In `my_framework.py`, implement `get_my_framework_table(findings, bulk_checks_me
 For NIST-style catalogs that use `Generic_Compliance_Requirement_Attribute`, no custom formatter is needed. The generic formatter in `prowler/lib/outputs/compliance/generic/` handles them automatically, provided the JSON validates against the generic attribute schema.
 </Note>
 
-## Version Handling
+### Legacy-to-universal adapter
+
+At load time, every legacy file is transparently adapted to a `ComplianceFramework` via `adapt_legacy_to_universal()` (`compliance_models.py:819`), which: (a) flattens the first element of `Attributes` into a flat `attributes` dict, (b) wraps `Checks` as `{provider_lower: [...]}`, (c) infers `attributes_metadata` from the matched Pydantic class via `_infer_attribute_metadata()`. The rest of Prowler (CSV/OCSF/PDF output, CLI table) then treats both formats identically.
+
+Loader-error behaviour differs between the two entry points:
+
+- `load_compliance_framework()` (legacy) is **fail-fast**: it calls `sys.exit(1)` on any `ValidationError` (`compliance_models.py:464`).
+- `load_compliance_framework_universal()` is more lenient — it logs the error and returns `None`, so `get_bulk_compliance_frameworks_universal()` simply skips the broken file and keeps loading the rest.
+
+## Version handling
 
 Prowler matches frameworks by concatenating `Framework` and `Version`. A missing or empty `Version` collapses several frameworks to the same key and breaks CLI filtering with `--compliance`.
 
-- Always set `Version` to a non-empty string, even for frameworks that rename editions rather than version them. Use the edition identifier (for example `RD2022`, `v2025.10`, `4.0`).
+- Always set `Version` (or `version` for universal frameworks) to a non-empty string, even for frameworks that rename editions rather than version them. Use the edition identifier (for example `RD2022`, `v2025.10`, `4.0`, `2022/2554`).
 - When the source catalog has no version, use the first year of adoption or the release date.
-- Make sure the version substring embedded in the filename matches `Version`, because the CLI dispatcher reads `compliance_framework.split("_")[1]` to select the correct version.
+- For **legacy** files, make sure the version substring embedded in the filename matches `Version`, because the CLI dispatcher reads `compliance_framework.split("_")[1]` to select the correct version.
 
-## Validating the Framework Locally
+## Validating Your Framework
 
-Follow the steps below before opening a pull request.
+Before opening a PR, validate the JSON loads cleanly against the model and that every referenced check actually exists.
 
-### 1. Run the Compliance Model Validator
+### 1. Schema validation
+
+For **universal** frameworks, load the file and inspect what was parsed. The framework key inside `bulk` is the **basename of the JSON file** (without `.json`); for `prowler/compliance/dora_2022_2554.json` that key is `dora_2022_2554`, for `prowler/compliance/aws/cis_5.0_aws.json` it is `cis_5.0_aws`.
+
+```python
+from prowler.lib.check.compliance_models import (
+    load_compliance_framework_universal,
+    get_bulk_compliance_frameworks_universal,
+)
+
+fw = load_compliance_framework_universal("prowler/compliance/<your_framework>.json")
+assert fw is not None, "load returned None — check the logs for the validation error"
+print(fw.framework, len(fw.requirements), fw.get_providers())
+
+bulk = get_bulk_compliance_frameworks_universal("aws")
+assert "<your_framework_filename_without_json>" in bulk
+```
+
+### 2. Check existence cross-check
+
+There is **no automatic check-existence validation** at load time. Cross-check that every check name in your framework maps to a real check directory:
+
+```python
+import os
+real = set()
+for svc in os.listdir("prowler/providers/aws/services"):
+    svc_path = f"prowler/providers/aws/services/{svc}"
+    if not os.path.isdir(svc_path):
+        continue
+    for entry in os.listdir(svc_path):
+        if os.path.isfile(f"{svc_path}/{entry}/{entry}.metadata.json"):
+            real.add(entry)
+
+referenced = {c for r in fw.requirements for c in r.checks.get("aws", [])}
+missing = referenced - real
+assert not missing, f"checks referenced in framework but not found in repo: {sorted(missing)}"
+```
+
+### 3. CLI smoke test
 
 ```bash
 uv run python prowler-cli.py <provider> --list-compliance
 ```
 
-The framework must appear in the output. A validation error indicates a schema mismatch between the JSON file and the attribute model.
-
-### 2. Run a Scan Filtered by the Framework
+The framework must appear in the output. A validation error indicates a schema mismatch.
 
 ```bash
 uv run python prowler-cli.py <provider> \
-  --compliance <framework>_<version>_<provider> \
+  --compliance <framework_key> \
   --log-level ERROR
 ```
 
 Verify that:
 
 - Prowler produces a CSV file under `output/compliance/` with the expected name.
-- The CLI summary table lists every section in the framework.
+- The CLI summary table lists every section / pillar of the framework.
 - Findings roll up under the expected requirements.
 
-### 3. Inspect the CSV Output
+### 4. Inspect the CSV output
 
 Open the generated CSV and confirm:
 
-- All columns defined in `models.py` appear.
-- Every requirement has at least one row per scanned resource.
-- Values such as `Requirements_Attributes_Section` reflect the JSON content.
+- All columns defined in `models.py` (legacy) or in `attributes_metadata` (universal) appear.
+- Every requirement has at least one row per scanned resource (when there are findings).
+- Attribute values such as `Requirements_Attributes_Section` reflect the JSON content.
 
-### 4. Verify the Framework in Prowler App
+### 5. Verify the framework in Prowler App
 
 Launch Prowler App locally (`docker compose up` from the repository root) and run a scan with the new compliance framework. Confirm the compliance page renders the requirements, sections, and status widgets correctly.
 
@@ -331,7 +566,7 @@ Launch Prowler App locally (`docker compose up` from the repository root) and ru
 Compliance contributions require two layers of tests.
 
 - **Schema tests** exercise the Pydantic models. Extend `tests/lib/check/universal_compliance_models_test.py` with a case that loads the new JSON file and asserts the attribute type matches the expected model.
-- **Output tests** exercise the transformer. Mirror the structure under `tests/lib/outputs/compliance/<framework>/` with fixtures that feed synthetic findings through the transformer and assert the resulting CSV rows.
+- **Output tests** (legacy frameworks only) exercise the transformer. Mirror the structure under `tests/lib/outputs/compliance/<framework>/` with fixtures that feed synthetic findings through the transformer and assert the resulting CSV rows.
 
 Run the suite with:
 
@@ -342,7 +577,20 @@ uv run pytest -n auto tests/lib/check/universal_compliance_models_test.py \
 
 For guidance on writing Prowler SDK tests, refer to [Unit Testing](/developer-guide/unit-testing).
 
-## Submitting the Pull Request
+## Running and listing your framework
+
+Once the file is in place, the CLI auto-discovers it:
+
+```sh
+prowler <provider> --list-compliance                                            # framework appears in the list
+prowler <provider> --compliance <framework_key> --list-checks
+prowler <provider> --compliance <framework_key>                                 # full scan + compliance report
+prowler <provider> --compliance <framework_key> --list-compliance-requirements <framework_key>
+```
+
+For end-user-facing tutorials (recommended for high-profile frameworks), add a dedicated page under `docs/user-guide/compliance/tutorials/` and register it in the `"Compliance"` group of `docs/docs.json`. See `docs/user-guide/compliance/tutorials/threatscore.mdx` as a reference.
+
+## Submitting the pull request
 
 Before opening the pull request:
 
@@ -352,28 +600,31 @@ Before opening the pull request:
     uv run pytest -n auto
     ```
 2. Add a changelog entry under the `### 🚀 Added` section of `prowler/CHANGELOG.md`, describing the new framework and the providers it covers.
-3. Follow the [Pull Request Template](https://github.com/prowler-cloud/prowler/blob/master/.github/pull_request_template.md) and set the PR title using Conventional Commits, for example `feat(compliance): add My Framework 1.0 for AWS`.
+3. Follow the [Pull Request Template](https://github.com/prowler-cloud/prowler/blob/master/.github/pull_request_template.md) and set the PR title using Conventional Commits, e.g. `feat(compliance): add My Framework 1.0 for AWS`.
 4. Request review from the compliance codeowners listed in `.github/CODEOWNERS`.
 
 ## Troubleshooting
 
 The following issues are the most common when contributing a compliance framework.
 
-- **`ValidationError: field required` during scan.** The JSON is missing a required attribute field. Re-check the matching Pydantic model in `prowler/lib/check/compliance_models.py`.
-- **All attributes collapse to `Generic_Compliance_Requirement_Attribute` values.** The Pydantic `Union` is ordered incorrectly, or the JSON matches only the generic shape. Move the generic model to the last Union position and ensure every required field is present in the JSON.
-- **`--compliance` filter does not find the framework.** The filename does not match the expected pattern `<framework>_<version>_<provider>.json`, the version is empty, or the file lives outside `prowler/compliance/<provider>/`.
-- **CLI summary table is empty but the CSV is populated.** The dispatcher branch in `prowler/lib/outputs/compliance/compliance.py` is missing or its substring match does not catch the framework key.
-- **CSV file is missing after the scan.** The transformer class is not registered in `prowler/lib/outputs/compliance/compliance_output.py`, or `transform()` raises silently. Run the scan with `--log-level DEBUG`.
-- **Findings do not roll up under a requirement.** A check listed in `Checks` either does not exist for that provider or is spelled incorrectly. Run `--list-checks | grep <check_name>` to confirm.
+- **`ValidationError: field required` during scan (legacy).** The JSON is missing a required attribute field. Re-check the matching Pydantic model in `prowler/lib/check/compliance_models.py`.
+- **All attributes collapse to `Generic_Compliance_Requirement_Attribute` values (legacy).** The Pydantic `Union` is ordered incorrectly, or the JSON matches only the generic shape. Keep the generic model in the last Union position and ensure every required field is present in the JSON.
+- **`attributes_metadata validation failed` (universal).** The root validator in `compliance_models.py:669` rejected the file. The error message lists each offending requirement; common causes are unknown attribute keys (typo or missing entry in `attributes_metadata`), enum violations, or missing required keys.
+- **`--compliance` filter does not find the framework.** For legacy: the filename does not match `<framework>_<version>_<provider>.json`, the version is empty, or the file lives outside `prowler/compliance/<provider>/`. For universal: the file is not at the top level of `prowler/compliance/` or it loaded as `None` (check logs for the validation error).
+- **CLI summary table is empty but the CSV is populated (legacy).** The dispatcher branch in `prowler/lib/outputs/compliance/compliance.py` is missing or its substring match does not catch the framework key.
+- **CSV file is missing after the scan (legacy).** The transformer class is not registered in `prowler/lib/outputs/compliance/compliance_output.py`, or `transform()` raises silently. Run the scan with `--log-level DEBUG`.
+- **Findings do not roll up under a requirement.** A check listed in `Checks` either does not exist for that provider or is spelled incorrectly. Run `--list-checks | grep <check_name>` to confirm, or run the check-existence cross-check from "Validating Your Framework".
 
-## Reference Examples
+## Reference examples
 
 Use the following files as templates when modeling a new contribution.
 
-- `prowler/compliance/aws/cis_2.0_aws.json` – CIS attribute shape.
-- `prowler/compliance/aws/nist_800_53_revision_5_aws.json` – Generic attribute shape.
-- `prowler/compliance/aws/ccc_aws.json` – CCC attribute shape.
-- `prowler/compliance/azure/ens_rd2022_azure.json` – ENS attribute shape.
-- `prowler/lib/check/compliance_models.py` – Canonical Pydantic schemas.
-- `prowler/lib/outputs/compliance/cis/` – Reference implementation of a multi-provider output formatter.
-- `prowler/lib/outputs/compliance/generic/` – Reference implementation of a generic output formatter.
+- `prowler/compliance/dora_2022_2554.json` — universal schema, single-provider populated (AWS), ready to extend with more providers.
+- `prowler/compliance/csa_ccm_4.0.json` — universal schema, multi-provider populated (AWS, Azure, GCP, AlibabaCloud, OracleCloud).
+- `prowler/compliance/aws/cis_2.0_aws.json` — legacy CIS attribute shape.
+- `prowler/compliance/aws/nist_800_53_revision_5_aws.json` — legacy generic attribute shape.
+- `prowler/compliance/aws/ccc_aws.json` — legacy CCC attribute shape.
+- `prowler/compliance/azure/ens_rd2022_azure.json` — legacy ENS attribute shape.
+- `prowler/lib/check/compliance_models.py` — canonical Pydantic schemas for both formats.
+- `prowler/lib/outputs/compliance/cis/` — reference implementation of a multi-provider legacy output formatter.
+- `prowler/lib/outputs/compliance/generic/` — reference implementation of a legacy generic output formatter.
diff --git a/docs/developer-guide/server-sent-events.mdx b/docs/developer-guide/server-sent-events.mdx
new file mode 100644
index 0000000000..c91f27227f
--- /dev/null
+++ b/docs/developer-guide/server-sent-events.mdx
@@ -0,0 +1,241 @@
+---
+title: 'Server-Sent Events (SSE)'
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+<VersionBadge version="1.32.0" />
+
+This guide explains how to add a **Server-Sent Events (SSE)** endpoint to the Prowler API. SSE lets the backend push a one-way stream of events to a client over a single long-lived HTTP connection — ideal for live progress, token-by-token LLM output, or any "the server has news for you" use case where the client should not poll.
+
+<Info>
+The platform ships the SSE **infrastructure** (`api.sse`) and wiring. No feature endpoint streams over SSE out of the box — this guide shows how to build one on top of the shared base.
+</Info>
+
+## When to use SSE
+
+| Need | Use |
+|------|-----|
+| Server pushes incremental updates, client only reads | **SSE** |
+| Bidirectional, low-latency messaging (chat both ways, games) | WebSocket |
+| Client asks, server answers once | Plain REST |
+
+SSE is the right tool when the **client only consumes**: scan progress, long-running job checkpoints, streamed LLM tokens, cross-client resource-sync notifications. It rides on plain HTTP, reconnects automatically in the browser via the native [`EventSource`](https://developer.mozilla.org/en-US/docs/Web/API/EventSource) API, and needs no extra protocol.
+
+## How it works
+
+SSE is wired through [`django-eventstream`](https://github.com/fanout/django_eventstream) and a small platform layer in `api/src/backend/api/sse/`:
+
+| Piece | File | Responsibility |
+|-------|------|----------------|
+| `BaseSSEViewSet` | `api/sse/base_views.py` | Base DRF viewset a feature subclasses. The feature implements `get_channels`; the base handles auth, the tenant transaction, and delegates streaming to `django-eventstream`. |
+| `SSEChannelManager` | `api/sse/channelmanager.py` | Registered in `settings.EVENTSTREAM_CHANNELMANAGER_CLASS`. Reads the channel set off the request and enforces the platform-wide tenant gate. |
+| `SSEAuthentication` | `api/authentication.py` | Same JWT/API-key stack as the rest of the API, plus an `?access_token=<jwt>` fallback for browser `EventSource` clients. Lives with the other authentication classes, not in the `sse` package. |
+| `make_channel_name` / `tenant_id_from_channel` | `api/sse/utils.py` | Single source of truth for the channel-name format, so publishers and the channel manager agree byte-for-byte. |
+| Settings | `config/settings/eventstream.py` | Valkey Pub/Sub backend (dedicated DB), channel manager, allowed headers. |
+
+### Transport: the server runs on ASGI
+
+SSE connections are long-lived. Holding one open per synchronous worker would exhaust the worker pool, so the API runs under Gunicorn's native **`asgi` worker** (`config.asgi:application`). Streams are parked on the event loop while ordinary CRUD endpoints keep their synchronous execution (Django runs sync views in a thread-sensitive executor under ASGI). This is configured in `config/guniconf.py` and used by both the dev and production entrypoints — no separate server process is needed.
+
+### The data flow
+
+```
+publisher (Celery task / view)             subscriber (browser, CLI)
+        │                                          │
+        │  send_event(channel, "scan.progress", …) │  GET …/event-stream
+        ▼                                          ▼
+   Valkey Pub/Sub  ◄────────────────────►  BaseSSEViewSet.list
+   (EVENTSTREAM_VALKEY_DB)                  → get_channels() (RLS-scoped)
+                                            → SSEChannelManager (tenant gate)
+                                            → StreamingHttpResponse (text/event-stream)
+```
+
+A publisher anywhere in the system (most often a Celery task) calls `send_event(channel, event_type, payload)`. `django-eventstream` fans it out over Valkey Pub/Sub to every connection subscribed to that channel.
+
+## Adding an SSE endpoint to your feature
+
+The example below streams progress for a long-running **scan**. Adapt the resource, prefix, and event names to your feature.
+
+<Steps>
+
+<Step title="Pick a channel prefix">
+
+Channels follow the format `<prefix>:<tenant_id>:<resource_id>`, built only through `make_channel_name`. The prefix is owned by your feature and may contain hyphens but **never colons** (the parser splits on `:`).
+
+```python
+CHANNEL_PREFIX = "scan-progress"
+```
+
+The tenant id is baked into every channel name. That is what lets the platform enforce cross-tenant isolation without knowing anything about your feature.
+
+</Step>
+
+<Step title="Subclass BaseSSEViewSet">
+
+Create the viewset for the SSE sub-resource. The only required method is `get_channels`; it runs inside the tenant transaction set up by the base class, so any database lookup inside it is automatically RLS-scoped.
+
+```python
+# scans/event_streams.py
+from api.sse import BaseSSEViewSet, make_channel_name
+from django.shortcuts import get_object_or_404
+from scans.models import Scan
+
+CHANNEL_PREFIX = "scan-progress"
+
+
+class ScanEventStreamViewSet(BaseSSEViewSet):
+    def get_queryset(self):
+        # RLS already scopes to the tenant; narrow further as needed
+        # (e.g. only scans the requesting user may see).
+        return Scan.objects.filter(tenant_id=self.request.tenant_id)
+
+    def get_channels(self) -> set[str]:
+        scan = get_object_or_404(self.get_queryset(), pk=self.kwargs["scan_pk"])
+        return {make_channel_name(CHANNEL_PREFIX, scan.tenant_id, scan.id)}
+```
+
+<Warning>
+`get_channels` **must raise** the relevant DRF exception (`NotFound`, `PermissionDenied`, `NotAuthenticated`) when authorization fails — `get_object_or_404` does this for you. Returning an empty set surfaces as django-eventstream's confusing "No channels specified" error instead of the real cause.
+</Warning>
+
+</Step>
+
+<Step title="Wire the URL as a sub-resource">
+
+Mount the endpoint as an `event-stream` sub-resource. Keep it **outside the DRF router**, which would force the URL into a list/detail convention. Route the `get` method to the viewset's `list` action.
+
+```python
+# scans/urls.py
+path(
+    "scans/<uuid:scan_pk>/event-stream",
+    ScanEventStreamViewSet.as_view({"get": "list"}),
+    name="scan-event-stream",
+),
+```
+
+</Step>
+
+<Step title="Define your event vocabulary">
+
+A feature owns its event types in `<app>/<domain>/events.py`: one `publish_<event>` function per event type, each body a **single** `send_event` call so the wire-level string lives in exactly one place.
+
+```python
+# scans/events.py
+from django_eventstream import send_event
+
+
+def publish_progress(channel: str, checked: int, total: int) -> None:
+    send_event(channel, "scan.progress", {"checked": checked, "total": total})
+
+
+def publish_end(channel: str, scan_id: str) -> None:
+    # Terminal event carries the canonical id so reconnecting clients
+    # can refetch the persisted resource over REST.
+    send_event(channel, "scan.end", {"scan_id": scan_id})
+
+
+def publish_error(channel: str, code: str, detail: str) -> None:
+    send_event(channel, "scan.error", {"code": code, "detail": detail})
+```
+
+There is no platform-side enum, registry, or dispatch table — **the naming convention is the contract** (see below).
+
+</Step>
+
+<Step title="Publish from the producer">
+
+Wherever the work happens — usually a Celery task — build the channel the same way and publish:
+
+```python
+from api.sse import make_channel_name
+from scans.events import publish_progress, publish_end
+
+channel = make_channel_name("scan-progress", scan.tenant_id, scan.id)
+publish_progress(channel, checked=42, total=100)
+...
+publish_end(channel, scan_id=str(scan.id))
+```
+
+</Step>
+
+</Steps>
+
+## Event naming convention
+
+Every event uses an event type of the form **`<resource>.<verb>`** (lowercased, dot-separated). The verb comes from this platform-wide vocabulary — if you need a verb that is not listed, document the addition in this guide so the catalog stays discoverable.
+
+| Verb | When to use |
+|------|-------------|
+| `delta` | An incremental piece of a stream the client concatenates (LLM text tokens, audio chunks). Standard term across OpenAI / Anthropic / LiteLLM / Vercel AI SDK. |
+| `start` | Begin marker for a compound operation (e.g. a tool call whose execution will be reported by a matching `end`). |
+| `end` | Terminal marker. Carries the canonical resource id so reconnecting clients can refetch persisted state via REST. |
+| `progress` | Periodic checkpoint with quantifiable completion, e.g. `{"checked": 42, "total": 100}`. |
+| `created` / `updated` / `deleted` | Resource-lifecycle events for cross-client sync streams. |
+| `error` | Terminal failure. Carries a stable `code` for client switching and a human-readable `detail`. |
+
+<Note>
+Payloads are **flat JSON**. The wire-level `event:` field already names the event type, so do **not** wrap the payload in `{"type": ..., "data": ...}`. Include the canonical resource UUID on terminal events so reconnecting clients can reconcile via REST.
+</Note>
+
+## Authentication
+
+SSE endpoints use the same authentication stack as the rest of the API. Non-browser clients (CLI, programmatic) send the standard `Authorization` header — JWT or API key.
+
+Browser `EventSource` is the only widely available SSE client API and it **cannot set custom headers**. For that case only, the endpoint accepts a JWT via the `?access_token=<jwt>` query parameter. The header always wins when present — a header is intentional, while a query parameter can leak into referers and logs, so it is consulted only as a fallback.
+
+```javascript
+// Browser
+const es = new EventSource(
+  `/api/v1/scans/${scanId}/event-stream?access_token=${jwt}`
+);
+```
+
+```bash
+# CLI / programmatic — header, exactly like every other endpoint
+curl -N -H "Authorization: Bearer $JWT" \
+  https://<host>/api/v1/scans/$SCAN_ID/event-stream
+```
+
+## Tenant isolation & security model
+
+Authorization is enforced at two layers:
+
+1. **At connect**, `get_channels` runs under the regular DRF stack inside the tenant transaction (`rls_transaction`). Resource lookups are RLS-scoped, so a user cannot even resolve a channel for a resource they cannot see. Narrow the queryset further (e.g. `created_by=request.user`) when a resource is per-user within a tenant.
+2. **After connect**, `SSEChannelManager.can_read_channel` re-verifies tenant membership by parsing the tenant id embedded in the channel name. Cross-tenant subscription is rejected even if a URL-level check ever has a bug. A malformed channel name is treated as "not authorized".
+
+Because the tenant id lives inside the channel name, this gate works for any feature without the platform knowing anything about it.
+
+## Reconnect & state recovery
+
+The platform deliberately ships **without server-side replay** (`is_channel_reliable` returns `False`). When a client reconnects, it does **not** receive missed events. Instead:
+
+- Terminal events (`*.end`) carry the canonical resource **UUID**.
+- On reconnect, the client refetches the authoritative state from the normal REST endpoint using that id.
+
+Design your event payloads accordingly: deltas are ephemeral and concatenated in-flight; the durable truth always lives behind a REST resource.
+
+## Local development
+
+- The dev and production entrypoints both launch Gunicorn with the `asgi` worker (`config.asgi:application`). In dev, `DJANGO_DEBUG=True` enables hot reload; `preload_app` is automatically disabled under debug so edited code is picked up.
+- SSE uses a **dedicated Valkey database** (`EVENTSTREAM_VALKEY_DB`, default `2`) kept separate from the Celery broker so a noisy broker cannot crowd out streaming traffic. It reuses the same `VALKEY_*` connection settings as the rest of the platform.
+
+| Env var | Default | Purpose |
+|---------|---------|---------|
+| `EVENTSTREAM_VALKEY_DB` | `2` | Valkey DB index for the SSE Pub/Sub bus |
+| `DJANGO_WORKER_CLASS` | `asgi` | Gunicorn worker class |
+
+Test the stream end to end with `curl -N` (disable buffering) and an auth header:
+
+```bash
+curl -N -H "Authorization: Bearer $JWT" \
+  http://localhost:8080/api/v1/scans/$SCAN_ID/event-stream
+```
+
+## Testing
+
+The platform basis is covered by `api/tests/test_sse.py` (channel parsing, the tenant gate, and auth precedence). For a feature endpoint, test:
+
+- `get_channels` returns the expected channel for an authorized resource and raises `NotFound`/`PermissionDenied` otherwise.
+- Each `publish_<event>` helper emits the correct event type and flat payload (mock `send_event`).
+- The producer builds the channel with `make_channel_name` using the resource's own `tenant_id`.
diff --git a/docs/docs.json b/docs/docs.json
index e31575878e..a74aa7e91d 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -395,7 +395,8 @@
               "developer-guide/lighthouse-architecture",
               "developer-guide/mcp-server",
               "developer-guide/ai-skills",
-              "developer-guide/prowler-studio"
+              "developer-guide/prowler-studio",
+              "developer-guide/server-sent-events"
             ]
           },
           {
@@ -416,6 +417,7 @@
             "group": "Miscellaneous",
             "pages": [
               "developer-guide/documentation",
+              "developer-guide/environment-variables",
               {
                 "group": "Testing",
                 "pages": [
diff --git a/docs/getting-started/installation/prowler-app.mdx b/docs/getting-started/installation/prowler-app.mdx
index 3f19329914..eea9075cda 100644
--- a/docs/getting-started/installation/prowler-app.mdx
+++ b/docs/getting-started/installation/prowler-app.mdx
@@ -20,7 +20,8 @@ Refer to the [Prowler App Tutorial](/user-guide/tutorials/prowler-app) for detai
 
     _Commands_:
 
-    ```bash
+    <CodeGroup>
+    ```bash macOS/Linux
     VERSION=$(curl -s https://api.github.com/repos/prowler-cloud/prowler/releases/latest | jq -r .tag_name)
     curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${VERSION}/docker-compose.yml"
     # Environment variables can be customized in the .env file. Using default values in production environments is not recommended.
@@ -28,6 +29,15 @@ Refer to the [Prowler App Tutorial](/user-guide/tutorials/prowler-app) for detai
     docker compose up -d
     ```
 
+    ```powershell Windows PowerShell
+    $VERSION = (Invoke-RestMethod -Uri "https://api.github.com/repos/prowler-cloud/prowler/releases/latest").tag_name
+    Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/docker-compose.yml" -OutFile "docker-compose.yml"
+    # Environment variables can be customized in the .env file. Using default values in production environments is not recommended.
+    Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/.env" -OutFile ".env"
+    docker compose up -d
+    ```
+    </CodeGroup>
+
     <Callout icon="lock" iconType="regular" color="#e74c3c">
       For a secure setup, the API auto-generates a unique key pair, `DJANGO_TOKEN_SIGNING_KEY` and `DJANGO_TOKEN_VERIFYING_KEY`, and stores it in `~/.config/prowler-api` (non-container) or the bound Docker volume in `_data/api` (container). Never commit or reuse static/default keys. To rotate keys, delete the stored key files and restart the API.
     </Callout>
@@ -118,8 +128,8 @@ To update the environment file:
 Edit the `.env` file and change version values:
 
 ```env
-PROWLER_UI_VERSION="5.29.0"
-PROWLER_API_VERSION="5.29.0"
+PROWLER_UI_VERSION="5.30.0"
+PROWLER_API_VERSION="5.30.0"
 ```
 
 <Note>
diff --git a/docs/getting-started/installation/prowler-cli.mdx b/docs/getting-started/installation/prowler-cli.mdx
index f87653dcfe..eae3d54ab1 100644
--- a/docs/getting-started/installation/prowler-cli.mdx
+++ b/docs/getting-started/installation/prowler-cli.mdx
@@ -4,7 +4,7 @@ title: 'Installation'
 
 ## Installation
 
-To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler is available as a project in [PyPI](https://pypi.org/project/prowler/):
+To install Prowler as a Python package, use `Python >= 3.10, <= 3.13`. Prowler is available as a project in [PyPI](https://pypi.org/project/prowler/):
 
 <Tabs>
   <Tab title="pipx">
@@ -12,7 +12,7 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
 
     _Requirements_:
 
-    * `Python >= 3.10, <= 3.12`
+    * `Python >= 3.10, <= 3.13`
     * `pipx` installed: [pipx installation](https://pipx.pypa.io/stable/installation/).
     * AWS, GCP, Azure and/or Kubernetes credentials
 
@@ -30,7 +30,7 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
 
     _Requirements_:
 
-    * `Python >= 3.10, <= 3.12`
+    * `Python >= 3.10, <= 3.13`
     * `Python pip >= 21.0.0`
     * AWS, GCP, Azure, M365 and/or Kubernetes credentials
 
@@ -81,7 +81,7 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
   <Tab title="Amazon Linux 2">
     _Requirements_:
 
-    * `Python >= 3.10, <= 3.12`
+    * `Python >= 3.10, <= 3.13`
     * AWS, GCP, Azure and/or Kubernetes credentials
 
     _Commands_:
@@ -96,8 +96,8 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
   <Tab title="Ubuntu">
     _Requirements_:
 
-    * `Ubuntu 23.04` or above. For older Ubuntu versions, check [pipx installation](https://docs.prowler.com/projects/prowler-open-source/en/latest/#__tabbed_1_1) and ensure `Python >= 3.10, <= 3.12` is installed.
-    * `Python >= 3.10, <= 3.12`
+    * `Ubuntu 23.04` or above. For older Ubuntu versions, check [pipx installation](https://docs.prowler.com/projects/prowler-open-source/en/latest/#__tabbed_1_1) and ensure `Python >= 3.10, <= 3.13` is installed.
+    * `Python >= 3.10, <= 3.13`
     * AWS, GCP, Azure and/or Kubernetes credentials
 
     _Commands_:
diff --git a/docs/troubleshooting.mdx b/docs/troubleshooting.mdx
index 9d60c57321..50cc43a3c0 100644
--- a/docs/troubleshooting.mdx
+++ b/docs/troubleshooting.mdx
@@ -201,35 +201,29 @@ When running Prowler behind a reverse proxy (nginx, Traefik, etc.) or load balan
 
 **Root Cause:**
 
-Next.js environment variables prefixed with `NEXT_PUBLIC_` are **bundled at build time**, not runtime. The pre-built Docker images from Docker Hub (`prowlercloud/prowler-ui:stable`) are built with default internal URLs. Simply setting `NEXT_PUBLIC_API_BASE_URL` in your `.env` file or environment variables and restarting the container will **NOT** work because these values are already compiled into the JavaScript bundle.
+The API base and docs URLs are resolved from the container environment **at runtime**. A single pre-built Docker image (`prowlercloud/prowler-ui:stable`) therefore serves any environment: point the URLs at your external domain and restart the container — no rebuild is required.
 
 **Solution:**
 
-You must **rebuild** the UI Docker image with your external URL:
-
-```bash
-# Clone the repository (if you haven't already)
-git clone https://github.com/prowler-cloud/prowler.git
-cd prowler/ui
-
-# Build with your external URL as a build argument
-docker build \
-  --build-arg NEXT_PUBLIC_API_BASE_URL=https://prowler.example.com/api/v1 \
-  --build-arg NEXT_PUBLIC_API_DOCS_URL=https://prowler.example.com/api/v1/docs \
-  -t prowler-ui-custom:latest \
-  --target prod \
-  .
-```
-
-Then update your `docker-compose.yml` to use your custom image instead of the pre-built one:
+Set the runtime environment variables to your external URL and restart the UI container:
 
 ```yaml
 services:
   ui:
-    image: prowler-ui-custom:latest  # Use your custom-built image
+    image: prowlercloud/prowler-ui:stable
+    environment:
+      UI_API_BASE_URL: https://prowler.example.com/api/v1
+      UI_API_DOCS_URL: https://prowler.example.com/api/v1/docs
     # ... rest of configuration
 ```
 
+The same values can be supplied through your `.env` file:
+
+```bash
+UI_API_BASE_URL=https://prowler.example.com/api/v1
+UI_API_DOCS_URL=https://prowler.example.com/api/v1/docs
+```
+
 <Note>
-The `NEXT_PUBLIC_` prefix is a Next.js convention that exposes environment variables to the browser. Since the browser bundle is compiled during `docker build`, these variables must be provided as build arguments, not runtime environment variables.
+Earlier releases inlined these values into the JavaScript bundle at build time (via the `NEXT_PUBLIC_` prefix) and required a rebuild with `--build-arg`. That is no longer necessary: `UI_API_BASE_URL` and `UI_API_DOCS_URL` are read at container start, so updating them and restarting is sufficient.
 </Note>
diff --git a/docs/user-guide/cookbooks/cicd-pipeline.mdx b/docs/user-guide/cookbooks/cicd-pipeline.mdx
index a88513d901..11295b1f29 100644
--- a/docs/user-guide/cookbooks/cicd-pipeline.mdx
+++ b/docs/user-guide/cookbooks/cicd-pipeline.mdx
@@ -127,7 +127,7 @@ Add the following to `.gitlab-ci.yml`:
 
 ```yaml
 prowler-scan:
-  image: python:3.12-slim
+  image: python:3.13-slim
   stage: test
   script:
     - pip install prowler
@@ -154,7 +154,7 @@ stages:
   - security
 
 .prowler-base:
-  image: python:3.12-slim
+  image: python:3.13-slim
   stage: security
   before_script:
     - pip install prowler
diff --git a/docs/user-guide/providers/gcp/authentication.mdx b/docs/user-guide/providers/gcp/authentication.mdx
index 9447d73a20..ec53445c84 100644
--- a/docs/user-guide/providers/gcp/authentication.mdx
+++ b/docs/user-guide/providers/gcp/authentication.mdx
@@ -138,6 +138,10 @@ To keep permissions focused:
 
 4. Continue through the wizard and finish. No principals need to be granted access in step 3 unless you want other identities to impersonate this account.
 
+<Note>
+To use this service account with `--organization-id`, additionally grant `roles/cloudasset.viewer` at the organization node and enable the Cloud Asset API in the service account's host project. See [Scanning a Specific GCP Organization](./organization). Without these, organization-wide scans silently fall back to listing only the projects accessible to the service account.
+</Note>
+
 ### Step 3: Generate a JSON Key
 
 1. Open the newly created service account, move to the **Keys** tab, and choose **Add key > Create new key**.
diff --git a/docs/user-guide/providers/gcp/organization.mdx b/docs/user-guide/providers/gcp/organization.mdx
index 6f4f7658e5..6790be5827 100644
--- a/docs/user-guide/providers/gcp/organization.mdx
+++ b/docs/user-guide/providers/gcp/organization.mdx
@@ -11,8 +11,19 @@ prowler gcp --organization-id organization-id
 ```
 
 <Warning>
-Ensure the credentials used have one of the following roles at the organization level:
-Cloud Asset Viewer (`roles/cloudasset.viewer`), or Cloud Asset Owner (`roles/cloudasset.owner`).
+Ensure the credentials used have one of the following roles bound **at the organization node** (not at a project): Cloud Asset Viewer (`roles/cloudasset.viewer`) or Cloud Asset Owner (`roles/cloudasset.owner`). The role must be bound directly on the organization so the Cloud Asset API can enumerate projects across the whole hierarchy.
+
+```bash
+gcloud organizations add-iam-policy-binding <organization-id> \
+  --member="serviceAccount:<service-account-email>" \
+  --role="roles/cloudasset.viewer"
+```
+
+The Cloud Asset API (`cloudasset.googleapis.com`) must also be enabled in the project that owns the credentials (the service account's host project, or the quota project for user credentials):
+
+```bash
+gcloud services enable cloudasset.googleapis.com --project <credentials-project-id>
+```
 
 </Warning>
 <Note>
diff --git a/docs/user-guide/providers/okta/authentication.mdx b/docs/user-guide/providers/okta/authentication.mdx
index c9154ee936..2e08cac8af 100644
--- a/docs/user-guide/providers/okta/authentication.mdx
+++ b/docs/user-guide/providers/okta/authentication.mdx
@@ -35,14 +35,28 @@ The bundled checks require the following read-only scopes:
 - `okta.policies.read`
 - `okta.brands.read`
 - `okta.apps.read`
+- `okta.authenticators.read`
+- `okta.networkZones.read`
+- `okta.apiTokens.read`
+- `okta.roles.read`
+- `okta.groups.read`
+- `okta.logStreams.read`
+- `okta.idps.read`
 
 Additional scopes will be needed as more services and checks are added. These are the current ones needed:
 
 | Scope | Used by |
 |---|---|
-| `okta.policies.read` | Sign-on, password, and authentication policies |
+| `okta.policies.read` | Sign-on, password, authentication, and `USER_LIFECYCLE` (Workflow > Automations) policies |
 | `okta.brands.read` | Sign-in page customizations (DOD Notice and Consent Banner check) |
 | `okta.apps.read` | First-party app settings (Okta Admin Console session), integrated app inventory, and the Authentication Policies bound to Okta applications |
+| `okta.authenticators.read` | Okta authenticator configuration, including Okta Verify and Smart Card IdP |
+| `okta.networkZones.read` | Network Zone inventory, anonymized-proxy blocklist checks, and API token Network Zone validation |
+| `okta.apiTokens.read` | API token metadata and token network conditions |
+| `okta.roles.read` | Admin role assignments for API token owners (both direct and group-inherited) |
+| `okta.groups.read` | Group memberships of API token owners, used to resolve admin roles inherited via group assignment (e.g. Super Admin granted through the default admin group) |
+| `okta.logStreams.read` | Log Stream configuration (`/api/v1/logStreams`) |
+| `okta.idps.read` | Identity Providers, including Smart Card (X509) IdPs (`/api/v1/idps`) |
 
 ### Required Admin Role
 
@@ -68,7 +82,9 @@ Okta filters the first-party apps (`saasure`, `okta_enduser`) out of `/api/v1/ap
 
 A fifth check — `application_admin_console_session_idle_timeout_15min` (STIG V-273187) — also requires Super Administrator: it calls `GET /api/v1/first-party-app-settings/admin-console`, which returns `403 E0000006` for every role below Super Administrator.
 
-When the service app runs with Read-Only Administrator, the five checks listed in this section return **MANUAL** instead of PASS/FAIL — the rest of the scan keeps running.
+`user_inactivity_automation_35d_enabled` (STIG V-273188) reads `USER_LIFECYCLE` policies (`list_policies(type='USER_LIFECYCLE')`) using the `okta.policies.read` scope. The Read-Only Administrator role is enough to list them; no Super Administrator requirement.
+
+When the service app runs with Read-Only Administrator, the checks listed in this section return **MANUAL** instead of PASS/FAIL — the rest of the scan keeps running.
 
 <Note>
 Read-Only Administrator stays the recommended default for the least-privilege framing that aligns with DISA STIG. Assign Super Administrator on a separate run when full coverage of the first-party app checks is needed.
@@ -122,7 +138,7 @@ Okta displays the private key **only once**. If you close the modal without copy
 
 ### 5. Grant the required OAuth scopes
 
-On the app, open the **Okta API Scopes** tab and click **Grant** on every scope Prowler needs. The bundled checks require `okta.policies.read`, `okta.brands.read`, and `okta.apps.read`.
+On the app, open the **Okta API Scopes** tab and click **Grant** on every scope Prowler needs. The bundled checks require `okta.policies.read`, `okta.brands.read`, `okta.apps.read`, `okta.authenticators.read`, `okta.networkZones.read`, `okta.apiTokens.read`, `okta.roles.read`, `okta.groups.read`, `okta.logStreams.read`, and `okta.idps.read`.
 
 ![Okta — grant OAuth scopes](/user-guide/providers/okta/images/grant-permissions.png)
 
@@ -158,8 +174,8 @@ export OKTA_PRIVATE_KEY_FILE="/secure/path/to/prowler-okta.pem"
 # or
 export OKTA_PRIVATE_KEY="$(cat /secure/path/to/prowler-okta.pem)"
 
-# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read"
-export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read"
+# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read"
+export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read"
 
 uv run python prowler-cli.py okta
 ```
@@ -200,7 +216,7 @@ Prowler validates credentials at startup by listing one sign-on policy. This err
 
 Raised when the credential probe succeeds at the OAuth layer but the request is rejected because the service app lacks the required scope or admin role:
 
-- **`invalid_scope`** — one of the requested scopes (`okta.policies.read`, `okta.brands.read`, or `okta.apps.read`) is not granted on the service app. Grant the missing scope from **Okta API Scopes**.
+- **`invalid_scope`** — one of the requested scopes (`okta.policies.read`, `okta.brands.read`, `okta.apps.read`, `okta.authenticators.read`, `okta.networkZones.read`, `okta.apiTokens.read`, `okta.roles.read`, `okta.groups.read`, `okta.logStreams.read`, and `okta.idps.read`) is not granted on the service app. Grant the missing scope from **Okta API Scopes**.
 - **`Forbidden` / `not authorized`** — no admin role is assigned to the service app. Assign **Read-Only Administrator** (or **Super Administrator** for the first-party application checks) from **Admin roles**.
 
 ### Application-service checks return MANUAL on first-party apps
diff --git a/docs/user-guide/providers/okta/getting-started-okta.mdx b/docs/user-guide/providers/okta/getting-started-okta.mdx
index 66d3dd1808..e04e0d4a13 100644
--- a/docs/user-guide/providers/okta/getting-started-okta.mdx
+++ b/docs/user-guide/providers/okta/getting-started-okta.mdx
@@ -12,7 +12,7 @@ Set up authentication for Okta with the [Okta Authentication](/user-guide/provid
 
 - An Okta organization. The UI examples below use **Identity Engine** terminology such as **Global Session Policy**; Classic Engine exposes the equivalent sign-on policy concepts under older names.
 - A **Super Administrator** account on that organization for the one-time service-app setup.
-- An **API Services** app integration in the Okta Admin Console with the `okta.policies.read`, `okta.brands.read`, and `okta.apps.read` scopes granted and an admin role assigned. **Read-Only Administrator** covers every `signon` check and runs the per-app network-zone check against the apps the service app can see (under Read-Only Administrator that is typically only the service app's own row — the rest of the org's app inventory stays invisible). **Super Administrator** is required additionally to evaluate the five first-party application checks (Okta Admin Console / Okta Dashboard idle timeout, MFA, phishing-resistant authentication) and to widen the network-zone check to the full app inventory — see [Okta Authentication](/user-guide/providers/okta/authentication#required-admin-role) for the full breakdown.
+- An **API Services** app integration in the Okta Admin Console with the `okta.policies.read`, `okta.brands.read`, `okta.apps.read`, `okta.authenticators.read`, `okta.networkZones.read`, `okta.apiTokens.read`, `okta.roles.read`, `okta.groups.read`, `okta.logStreams.read`, and `okta.idps.read` scopes granted and an admin role assigned. **Read-Only Administrator** covers the Sign-On, Network, API Token, User, System Log, and Identity Provider checks, and runs the per-app application network-zone check against the apps the service app can see (under Read-Only Administrator that is typically only the service app's own row — the rest of the org's app inventory stays invisible). **Super Administrator** is required additionally to evaluate the five first-party application checks (Okta Admin Console / Okta Dashboard idle timeout, MFA, phishing-resistant authentication) and to widen the application network-zone check to the full app inventory — see [Okta Authentication](/user-guide/providers/okta/authentication#required-admin-role) for the full breakdown.
 - Python 3.10+ and Prowler 5.27.0 or later installed locally.
 
 <CardGroup cols={2}>
@@ -85,8 +85,8 @@ Follow the [Okta Authentication](/user-guide/providers/okta/authentication) guid
 export OKTA_ORG_DOMAIN="acme.okta.com"
 export OKTA_CLIENT_ID="0oa1234567890abcdef"
 export OKTA_PRIVATE_KEY_FILE="/secure/path/to/prowler-okta.pem"
-# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read"
-export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read"
+# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read"
+export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read"
 ```
 
 The private key file may contain either a PEM-encoded RSA key or a JWK JSON document.
@@ -143,10 +143,16 @@ prowler okta --config-file /path/to/config.yaml
 
 Prowler for Okta includes security checks across the following services:
 
-| Service         | Description                                                                                                                            |
-| --------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| **Sign-On**     | Global session policy controls (idle timeout, lifetime, rule priority and ordering)                                                    |
-| **Application** | Okta Admin Console sign-on settings plus Authentication Policy controls for Okta applications (session idle, MFA, phishing resistance, network zones) |
+| Service               | Description                                                                                                                                           |
+| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Sign-On**           | Global session policy controls (idle timeout, lifetime, rule priority and ordering)                                                                   |
+| **Application**       | Okta Admin Console sign-on settings plus Authentication Policy controls for Okta applications (session idle, MFA, phishing resistance, network zones) |
+| **Authenticator**     | Password Policy controls plus Okta Verify FIPS and Smart Card IdP authenticator status                                                                |
+| **Network**           | Network Zone blocklists for anonymized proxy sources                                                                                                  |
+| **API Token**         | API token owner-role validation and Network Zone restrictions                                                                                         |
+| **User**              | User lifecycle automations (inactivity-based deprovisioning)                                                                                          |
+| **System Log**        | Log Stream configuration that off-loads audit records to a central SIEM                                                                               |
+| **Identity Provider** | Identity Providers, including Smart Card (X509) IdP status and certificate-chain visibility                                                           |
 
 ## Troubleshooting
 
@@ -158,22 +164,29 @@ This is stricter than simply finding the same timeout value somewhere else in th
 
 ### Default Scopes
 
-Prowler requests a fixed set of OAuth scopes on every token exchange. The defaults cover every bundled check across the Sign-On and Application services:
+Prowler requests a fixed set of OAuth scopes on every token exchange. The defaults cover every bundled check across the Sign-On, Application, Authenticator, Network, API Token, User, System Log, and Identity Provider services:
 
 - `okta.policies.read`
 - `okta.brands.read`
 - `okta.apps.read`
+- `okta.authenticators.read`
+- `okta.networkZones.read`
+- `okta.apiTokens.read`
+- `okta.roles.read`
+- `okta.groups.read`
+- `okta.logStreams.read`
+- `okta.idps.read`
 
-The service app must have these scopes granted in the **Okta API Scopes** tab. When the granted set is narrower than the requested set, the token request fails with an `invalid_scope` error and the scan stops at provider initialization.
+The service app must have these scopes granted in the **Okta API Scopes** tab. `okta.groups.read` is required so the API token Super Admin check can resolve admin roles inherited via group membership; without it the check falls back to direct-only role assignments and emits a best-effort caveat. When the granted set is narrower than the requested set, the token request fails with an `invalid_scope` error and the scan stops at provider initialization.
 
 When additional checks are enabled — or when running against a service app that exposes a different scope set — override the default with `OKTA_SCOPES` (comma-separated string for the env var) or `--okta-scopes` (space-separated list for the CLI):
 
 ```bash
 # Environment variable — comma-separated
-export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read,okta.users.read"
+export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read,okta.users.read"
 
 # CLI flag — space-separated
-prowler okta --okta-scopes okta.policies.read okta.brands.read okta.apps.read okta.users.read
+prowler okta --okta-scopes okta.policies.read okta.brands.read okta.apps.read okta.authenticators.read okta.networkZones.read okta.apiTokens.read okta.roles.read okta.groups.read okta.logStreams.read okta.idps.read okta.users.read
 ```
 
 For the full catalog of OAuth scopes exposed by the Okta Management API, refer to the [Okta OAuth 2.0 scopes documentation](https://developer.okta.com/docs/api/oauth2/).
diff --git a/docs/user-guide/tutorials/prowler-app-rbac.mdx b/docs/user-guide/tutorials/prowler-app-rbac.mdx
index c6319591cf..cabea5bd35 100644
--- a/docs/user-guide/tutorials/prowler-app-rbac.mdx
+++ b/docs/user-guide/tutorials/prowler-app-rbac.mdx
@@ -47,7 +47,11 @@ Follow these steps to remove a user of your account:
 1. Navigate to **Users** from the side menu.
 2. Click the delete button of your current user.
 
-> **Note: Each user will be able to delete himself and not others, regardless of his permissions.**
+> **Note: Each user can only delete their own account, regardless of their permissions. For this reason, the delete button is only shown on your own row and not on other users' rows.**
+
+Deleting a user removes the **entire user account** from Prowler, not just its membership in your organization. Because a single account can belong to more than one tenant, allowing one administrator to delete it outright could affect organizations they don't manage and irreversibly remove another person's identity. To keep this destructive action under the control of the account owner, the API only permits a user to delete themselves (it rejects any other target with a `400` response), and the UI mirrors this by showing the delete button exclusively on your own row.
+
+To remove **another** user from your organization, use the [_Expel from organization_](/user-guide/tutorials/prowler-app-multi-tenant#expelling-a-user-from-an-organization) action instead. Expelling removes the user's membership, role grants, and active sessions for your tenant only, and deletes the underlying account just for that user if your organization was their last remaining membership. This action is reserved for tenant **owners**.
 
 <img src="/images/prowler-app/rbac/user_remove.png" alt="Remove User" width="700" />
 
diff --git a/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx b/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx
index 2a349c0204..2f10d443ae 100644
--- a/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx
+++ b/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx
@@ -108,10 +108,10 @@ Prowler App updates user attributes each time a user logs in. Any changes made i
 The `userType` attribute controls which Prowler role is assigned to the user:
 
 - If `userType` matches an existing Prowler role name, the user receives that role automatically.
-- If `userType` does not match any existing role, Prowler App creates a new role with that name **without permissions**.
-- If `userType` is not set, the user receives the `no_permissions` role.
+- If `userType` does not match any existing role, Prowler App creates a new role with that name **with read-only access** (visibility over all providers, no management permissions). A Prowler administrator can adjust its permissions afterward through the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab.
+- If `userType` is not set, the user's existing roles are left unchanged.
 
-In all cases where the resulting role has no permissions, a Prowler administrator must configure the appropriate permissions through the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab. The `userType` value is **case-sensitive** - for example, `Backend` and `backend` are treated as different roles.
+The `userType` value is **case-sensitive** - for example, `Backend` and `backend` are treated as different roles.
 
 </Warning>
 
@@ -223,9 +223,9 @@ To test the `userType` → role mapping, set the **Department** attribute in the
 After a successful SSO login, the user profile in Prowler App reflects the attributes sent by Google Workspace:
 
 - **Name**: Populated from the `firstName` and `lastName` attributes.
-- **Role**: Created automatically from the `userType` attribute (e.g., `Backend`). If the role did not exist previously, it is created with no permissions by default.
-- **Permissions**: In the screenshot below, the user has no permissions because the `Backend` role did not exist prior to login and was created automatically without any permissions. To resolve this, a Prowler administrator can either:
-  - Assign the appropriate permissions to the new role via the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab.
+- **Role**: Created automatically from the `userType` attribute (e.g., `Backend`). If the role did not exist previously, it is created with read-only access by default.
+- **Permissions**: If the assigned permissions need to be adjusted, a Prowler administrator can either:
+  - Edit the permissions of the new role via the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab.
   - Set the `userType` attribute in the IdP to match an existing Prowler role that already has the desired permissions. The updated role is applied on the next SAML login.
 
 For more details on role assignment behavior and attribute mapping, refer to the [SAML SSO Configuration](/user-guide/tutorials/prowler-app-sso#configure-attribute-mapping-in-the-idp) page.
diff --git a/docs/user-guide/tutorials/prowler-app-sso.mdx b/docs/user-guide/tutorials/prowler-app-sso.mdx
index d4d2c18d11..1e61ec1060 100644
--- a/docs/user-guide/tutorials/prowler-app-sso.mdx
+++ b/docs/user-guide/tutorials/prowler-app-sso.mdx
@@ -87,7 +87,7 @@ Choose a Method:
         |----------------|---------------------------------------------------------------------------------------------------------|----------|
         | `firstName`    | The user's first name.                                                                                  | Yes      |
         | `lastName`     | The user's last name.                                                                                   | Yes      |
-        | `userType`     | Determines which Prowler role the user receives (e.g., `admin`, `auditor`). If a role with that name already exists, the user receives it automatically; if it does not exist, Prowler App creates a new role with that name without permissions. If `userType` is not defined, the user is assigned the `no_permissions` role. Role permissions can be edited in the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac). | No       |
+        | `userType`     | Determines which Prowler role the user receives (e.g., `admin`, `auditor`). If a role with that name already exists, the user receives it automatically; if it does not exist, Prowler App creates a new role with that name with read-only access (visibility over all providers, no management permissions). If `userType` is not defined, the user's existing roles are left unchanged. Role permissions can be edited in the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac). | No       |
         | `organization` | The user's company name.                                                                                | No       |
 
         <Info>
@@ -140,7 +140,7 @@ Choose a Method:
             ![Okta User Profile — First Name and Last Name](/images/prowler-app/saml/okta-user-profile-name.png)
 
             * **Organization** (`organization`): Maps to the company name displayed in Prowler App. This attribute is optional.
-            * **User type** (`userType`): Determines the Prowler role assigned to the user. This attribute is **case-sensitive** and must match the exact name of an existing role in Prowler App.
+            * **User type** (`userType`): Determines the Prowler role assigned to the user. This attribute is **case-sensitive**: if it matches the exact name of an existing role in Prowler App the user receives that role; if no role with that name exists, a new one is created with read-only access.
 
             ![Okta User Profile — User Type and Organization](/images/prowler-app/saml/okta-user-profile-attributes.png)
 
@@ -152,14 +152,10 @@ Choose a Method:
             The `userType` attribute controls which Prowler role is assigned to the user:
 
             * If a role with the specified name already exists in Prowler App, the user automatically receives that role.
-            * If the role does not exist, Prowler App creates a new role with that exact name but without any permissions, preventing the user from performing any actions.
-            * If `userType` is not defined in the user's Okta profile, the user is assigned the `no_permissions` role.
+            * If the role does not exist, Prowler App creates a new role with that exact name with read-only access: the user can see all providers and their findings but cannot manage anything. A Prowler administrator (a user whose role includes the "Manage Account" permission) can adjust its permissions afterward through the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac).
+            * If `userType` is not defined in the user's Okta profile, the user's existing roles in Prowler App are left unchanged.
 
-            In all cases where the resulting role has no permissions, a Prowler administrator (a user whose role includes the "Manage Account" permission) must configure the appropriate permissions through the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac).
-
-            This behavior is intentional: by defaulting to no permissions, Prowler App ensures that a misconfiguration in Okta cannot inadvertently grant elevated access.
-
-            **Example:** To assign the `IT` role to a user, set the `userType` value to `IT` in Okta. If a role named `IT` already exists in Prowler App, the user receives it automatically upon login. If it does not exist, Prowler App creates a new role called `IT` without permissions, and a Prowler administrator must configure the desired permissions for it.
+            **Example:** To assign the `IT` role to a user, set the `userType` value to `IT` in Okta. If a role named `IT` already exists in Prowler App, the user receives it automatically upon login. If it does not exist, Prowler App creates a new role called `IT` with read-only access, and a Prowler administrator can adjust its permissions as needed.
 
             </Warning>
 
diff --git a/mcp_server/Dockerfile b/mcp_server/Dockerfile
index d8377a1762..c2759b20de 100644
--- a/mcp_server/Dockerfile
+++ b/mcp_server/Dockerfile
@@ -1,7 +1,7 @@
 # =============================================================================
 # Build stage - Install dependencies and build the application
 # =============================================================================
-FROM ghcr.io/astral-sh/uv:python3.13-alpine@sha256:8f53782bb232ab0b5558f3071e86e2bbfde884e18815f2b19cc57f2d336e9ee2 AS builder
+FROM ghcr.io/astral-sh/uv:0.11.21-python3.13-alpine3.23@sha256:f09cc61ffc001f202701fdeae14dbdd50f6ca4cfcf248f41fd3234a302c8534f AS builder
 
 WORKDIR /app
 
@@ -25,7 +25,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 # =============================================================================
 # Final stage - Minimal runtime environment
 # =============================================================================
-FROM python:3.13-alpine@sha256:bb1f2fdb1065c85468775c9d680dcd344f6442a2d1181ef7916b60a623f11d40
+FROM python:3.13.14-alpine3.23@sha256:b0513989fa9be54569cac73f48a60320b74bb0f9ffa886568eea7e48a2432c04
 
 LABEL maintainer="https://github.com/prowler-cloud"
 
diff --git a/mcp_server/uv.lock b/mcp_server/uv.lock
index fd0a9349f9..14b8dcf4f3 100644
--- a/mcp_server/uv.lock
+++ b/mcp_server/uv.lock
@@ -857,11 +857,11 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.12.1"
+version = "2.13.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c2/27/a3b6e5bf6ff856d2509292e95c8f57f0df7017cf5394921fc4e4ef40308a/pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b", size = 102564, upload-time = "2026-03-13T19:27:37.25Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
 ]
 
 [package.optional-dependencies]
@@ -1132,15 +1132,15 @@ wheels = [
 
 [[package]]
 name = "starlette"
-version = "1.0.0"
+version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/81/69/17425771797c36cded50b7fe44e850315d039f28b15901ab44839e70b593/starlette-1.0.0.tar.gz", hash = "sha256:6a4beaf1f81bb472fd19ea9b918b50dc3a77a6f2e190a12954b25e6ed5eea149", size = 2655289, upload-time = "2026-03-22T18:29:46.779Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/eb/e3/7c1dc7381d9f8ab7d854328ebfa884e62cb3f3d8549ddfd37c7814f42afa/starlette-1.3.1.tar.gz", hash = "sha256:05d0213193f2fbaae60e2ecb593b4add4262ad4e46536b54abe36f11a71724e0", size = 2703240, upload-time = "2026-06-12T09:23:11.602Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0b/c9/584bc9651441b4ba60cc4d557d8a547b5aff901af35bda3a4ee30c819b82/starlette-1.0.0-py3-none-any.whl", hash = "sha256:d3ec55e0bb321692d275455ddfd3df75fff145d009685eb40dc91fc66b03d38b", size = 72651, upload-time = "2026-03-22T18:29:45.111Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/bb/2799cc2ede3ed41131f8975621e7213dfc7ef4acbbaadfa440f32500c370/starlette-1.3.1-py3-none-any.whl", hash = "sha256:c7372aae11c3c3f26a42df7bd626cec2f47d03483d261d369516a615a53714c6", size = 73632, upload-time = "2026-06-12T09:23:10.017Z" },
 ]
 
 [[package]]
diff --git a/osv-scanner.toml b/osv-scanner.toml
index 5d029efdf6..59408b8709 100644
--- a/osv-scanner.toml
+++ b/osv-scanner.toml
@@ -12,8 +12,9 @@ reason = """
 CVE-2025-45768 is disputed by the pyjwt maintainers. The advisory describes
 weak encryption, but the underlying issue is that callers may pick a short
 HMAC secret — key-length enforcement is the application's responsibility, not
-a defect in the library. We are on pyjwt 2.12.1 (latest at pin time) and
-enforce key strength in our own auth code, so this advisory does not apply.
+a defect in the library. We are on pyjwt 2.13.0 (which now also emits an
+InsecureKeyLengthWarning for short HMAC secrets) and enforce key strength in
+our own auth code, so this advisory does not apply.
 Re-evaluate when a non-disputed advisory or upstream fix lands.
 """
 
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index ea1707c71b..c9bfa7a1c7 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -2,6 +2,122 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
+## [5.31.0] (Prowler UNRELEASED)
+
+### 🚀 Added
+
+- Support for Python 3.13 [(#9293)](https://github.com/prowler-cloud/prowler/pull/9293)
+- `securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
+- `config_delegated_admin_and_org_aggregator_all_regions` check for AWS provider, verifying that AWS Config has a delegated administrator and an organization aggregator covering all AWS regions [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
+- `sagemaker_clarify_exists` check for AWS provider [(#11211)](https://github.com/prowler-cloud/prowler/pull/11211)
+- `cloudsql_instance_high_availability_enabled` check for GCP provider, verifying Cloud SQL primary instances use `REGIONAL` availability for automatic zone failover [(#11024)](https://github.com/prowler-cloud/prowler/pull/11024)
+- `cloudfunction_function_inside_vpc` check for GCP provider, verifying Cloud Functions have a Serverless VPC Access connector for private egress [(#11021)](https://github.com/prowler-cloud/prowler/pull/11021)
+- `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
+- `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
+- `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
+- `cosmosdb_account_minimum_tls_version` check for Azure provider, verifying Cosmos DB accounts enforce TLS 1.2 or higher for client connections [(#11033)](https://github.com/prowler-cloud/prowler/pull/11033)
+- `cosmosdb_account_public_network_access_disabled` check for Azure provider, verifying Cosmos DB accounts have public network access disabled so connectivity is restricted to private endpoints or VNet service endpoints [(#11034)](https://github.com/prowler-cloud/prowler/pull/11034)
+- `databricks_workspace_public_network_access_disabled` check for Azure provider, verifying Databricks workspaces have public network access disabled so connectivity is restricted to Azure Private Link private endpoints [(#11035)](https://github.com/prowler-cloud/prowler/pull/11035)
+- `databricks_workspace_no_public_ip_enabled` check for Azure provider, verifying Databricks workspaces use secure cluster connectivity (no public IP) so compute nodes are not assigned public IP addresses [(#11036)](https://github.com/prowler-cloud/prowler/pull/11036)
+- `defender_ensure_defender_cspm_is_on` check for Azure provider, verifying Microsoft Defender Cloud Security Posture Management (CSPM) is enabled on the Standard tier [(#11037)](https://github.com/prowler-cloud/prowler/pull/11037)
+- `mysql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying MySQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11041)](https://github.com/prowler-cloud/prowler/pull/11041)
+- `mysql_flexible_server_high_availability_enabled` check for Azure provider, verifying MySQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11042)](https://github.com/prowler-cloud/prowler/pull/11042)
+- `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
+- Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
+- Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
+- TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
+- DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Azure provider, mapping existing Azure checks across the five DORA pillars [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
+- Rename DORA to DORA_2022_2554 to follow the naming <name>_<version> in compliance frameworks [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
+- `entra_directory_sync_object_takeover_blocked` check for the M365 provider, verifying that hybrid Entra tenants block cloud object takeover through both soft-match and hard-match directory synchronization [(#11098)](https://github.com/prowler-cloud/prowler/pull/11098)
+- `entra_conditional_access_policy_no_deleted_object_references` check for M365 provider [(#11236)](https://github.com/prowler-cloud/prowler/pull/11236)
+- `aks_cluster_defender_enabled` check for Azure provider, verifying that AKS clusters have Microsoft Defender security monitoring enabled [(#11028)](https://github.com/prowler-cloud/prowler/pull/11028)
+
+### 🔄 Changed
+
+- Replaced the unmaintained `awsipranges` dependency with a small standard-library helper for the `route53_dangling_ip_subdomain_takeover` check [(#9293)](https://github.com/prowler-cloud/prowler/pull/9293)
+
+### 🔐 Security
+
+- `pytest` from 8.3.5 to 9.0.3, patching a known vulnerability in the SDK test dependency [(#11291)](https://github.com/prowler-cloud/prowler/pull/11291)
+- `black` from 25.1.0 to 26.3.1, patching a known vulnerability in the SDK formatter dependency [(#11290)](https://github.com/prowler-cloud/prowler/pull/11290)
+- `microsoft-kiota-*` to 1.9.9 and `aiohttp` to 3.14.0, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
+- Container base image bumped to `python:3.12.13-slim-bookworm` (patches `libgnutls30` CVE-2026-33845 and CVE-2026-42010) and `trivy` bumped to 0.71.0 (patches embedded `golang.org/x/crypto` and Go stdlib CVEs); `.trivyignore` documents remaining bookworm criticals with no-fix or not-affected rationale [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
+
+---
+
+## [5.30.3] (Prowler UNRELEASED)
+
+### 🐞 Fixed
+
+- CLI compliance summary tables no longer undercount findings mapped to multiple sections nor double-count a single finding mapped to several requirements within the same group/split, and the Provider column no longer leaks a value from another framework [(#11567)](https://github.com/prowler-cloud/prowler/pull/11567)
+
+---
+
+## [5.30.2] (Prowler v5.30.2)
+
+### 🐞 Fixed
+
+- GCP `logging_log_metric_filter_and_alert_*` checks now credit org-level aggregated sinks filtered to the Admin Activity audit stream [(#11575)](https://github.com/prowler-cloud/prowler/pull/11575)
+- A broken built-in provider no longer aborts the CLI when a different provider was invoked [(#11618)](https://github.com/prowler-cloud/prowler/pull/11618)
+- GCP organization scans with `--organization-id` no longer silently fall back to the credentials' host project when the Cloud Asset API call fails [(#11280)](https://github.com/prowler-cloud/prowler/pull/11280)
+
+---
+
+## [5.30.0] (Prowler v5.30.0)
+
+### 🚀 Added
+
+- DISA Okta IDaaS STIG V1R2 compliance framework for the Okta provider, with a dedicated CSV output formatter and terminal summary table [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
+- `sagemaker_models_monitor_enabled` check for AWS provider, verifying that each SageMaker monitoring schedule is in the `Scheduled` state so data and model drift is actively detected [(#11278)](https://github.com/prowler-cloud/prowler/pull/11278)
+- DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) universal compliance framework with AWS provider coverage across the five DORA pillars [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
+- Okta authenticator and password policy checks for STIG-aligned hardening requirements [(#11465)](https://github.com/prowler-cloud/prowler/pull/11465)
+- Okta network zone check to detect whether anonymized proxy traffic is blocked [(#11463)](https://github.com/prowler-cloud/prowler/pull/11463)
+- Okta API token checks for super admin ownership and network zone restrictions [(#11464)](https://github.com/prowler-cloud/prowler/pull/11464)
+- Support for external/custom providers, checks, and compliance frameworks without modifying core code [(#10700)](https://github.com/prowler-cloud/prowler/pull/10700)
+- `elbv2_alb_drop_invalid_header_fields_enabled` check for AWS provider, verifying Application Load Balancers have `routing.http.drop_invalid_header_fields.enabled` set to `true` to mitigate HTTP desync attacks (AWS FSBP ELB.4) [(#11471)](https://github.com/prowler-cloud/prowler/pull/11471)
+- `user`, `systemlog` and `idp` service for Okta provider with `user_inactivity_automation_35d_enabled`, `systemlog_streaming_enabled` and `idp_smart_card_dod_approved_ca` checks [(#11496)](https://github.com/prowler-cloud/prowler/pull/11496)
+- External multi-provider compliance frameworks can be registered via the `prowler.compliance.universal` entry point group [(#11490)](https://github.com/prowler-cloud/prowler/pull/11490)
+- AWS AI Security Framework support in the CLI dashboard [(#11475)](https://github.com/prowler-cloud/prowler/pull/11475)
+- `entra_service_principal_privileged_role_no_owners` check for M365 provider, failing when a service principal with a permanent Tier 0 directory role has owners on the service principal or its parent app registration [(#11070)](https://github.com/prowler-cloud/prowler/issues/11070)
+- `kms_key_rotation_max_90_days` check for GCP provider, verifying KMS customer-managed keys are rotated every 90 days or less in line with the CIS Benchmark [(#11516)](https://github.com/prowler-cloud/prowler/pull/11516)
+- `exchange_mailbox_primary_smtp_uses_custom_domain` check for M365 provider [(#11215)](https://github.com/prowler-cloud/prowler/pull/11215)
+- `bedrock_agent_role_least_privilege` check for AWS provider, flagging Bedrock Agent execution roles with full-access managed policies, broad `Resource:*` inline statements, or missing permissions boundaries [(#11335)](https://github.com/prowler-cloud/prowler/pull/11335)
+- STACKIT ObjectStorage service with Object Lock, default retention policy, and access key expiration checks [(#11397)](https://github.com/prowler-cloud/prowler/pull/11397)
+
+### 🐞 Fixed
+
+- `load_and_validate_config_file` now unwraps namespaced config for every built-in and external provider, and no longer leaks the full file as the provider's config when the file is namespaced [(#10700)](https://github.com/prowler-cloud/prowler/pull/10700)
+- `entra_users_mfa_capable` no longer flags pre-provisioned users with future `employeeHireDate`; future-hire date comparisons now tolerate naive datetimes [(#11511)](https://github.com/prowler-cloud/prowler/pull/11511)
+- M365 Admin Center group enumeration now follows Microsoft Graph pagination so group-scoped checks include groups beyond the first page [(#11510)](https://github.com/prowler-cloud/prowler/pull/11510)
+- GCP `kms_key_rotation_enabled` check now only verifies that automatic key rotation is enabled (any interval) instead of enforcing a 90-day period, resolving the mismatch between the check and its documentation; the CIS, Prowler ThreatScore, and CCC requirements that mandate a 90-day maximum were remapped to the new `kms_key_rotation_max_90_days` check [(#11516)](https://github.com/prowler-cloud/prowler/pull/11516)
+- AWS CloudWatch log metric filter checks now validate `filterPattern` clauses regardless of order [(#11345)](https://github.com/prowler-cloud/prowler/pull/11345)
+- AWS `bedrock_api_key_no_long_term_credentials` now applies severity per finding (never-expires keys correctly flag as critical, no leak across findings) and aligns title and wording with AWS guidance to prefer short-term Bedrock API keys [(#11526)](https://github.com/prowler-cloud/prowler/pull/11526)
+
+### 🔐 Security
+
+- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
+
+---
+
+## [5.29.3] (Prowler v5.29.3)
+
+### 🐞 Fixed
+
+- GCP `logging_sink_created` now recognizes organization-level aggregated sinks with `includeChildren=True`, avoiding false failures for covered projects [(#11355)](https://github.com/prowler-cloud/prowler/pull/11355)
+- GCP `logging_log_metric_filter_and_alert_*` checks now recognize organization-level aggregated sinks with `includeChildren=True`, no longer false-failing projects covered by a central bucket-scoped metric + alert [(#11488)](https://github.com/prowler-cloud/prowler/pull/11488)
+- Jira integration no longer fails with `400 INVALID_INPUT` when a finding has empty fields [(#11474)](https://github.com/prowler-cloud/prowler/pull/11474)
+- GCP `iam_service_account_unused` now passes disabled service accounts instead of failing them, since a disabled account cannot authenticate or be used [(#11467)](https://github.com/prowler-cloud/prowler/pull/11467)
+
+---
+
+## [5.29.1] (Prowler v5.29.1)
+
+### 🐞 Fixed
+
+- OCSF output writer now re-raises I/O errors (e.g. `ENOSPC`) instead of logging them per finding and leaving a truncated file [(#11421)](https://github.com/prowler-cloud/prowler/pull/11421)
+
+---
+
 ## [5.29.0] (Prowler v5.29.0)
 
 ### 🚀 Added
diff --git a/prowler/__main__.py b/prowler/__main__.py
index a9d794c2d6..533a704359 100644
--- a/prowler/__main__.py
+++ b/prowler/__main__.py
@@ -10,7 +10,6 @@ from colorama import Fore, Style
 from colorama import init as colorama_init
 
 from prowler.config.config import (
-    EXTERNAL_TOOL_PROVIDERS,
     cloud_api_base_url,
     csv_file_suffix,
     get_available_compliance_frameworks,
@@ -20,7 +19,7 @@ from prowler.config.config import (
     orange_color,
     sarif_file_suffix,
 )
-from prowler.lib.banner import print_banner
+from prowler.lib.banner import print_banner, print_prowler_cloud_banner
 from prowler.lib.check.check import (
     exclude_checks_to_run,
     exclude_services_to_run,
@@ -85,11 +84,6 @@ from prowler.lib.outputs.compliance.compliance import (
     display_compliance_table,
     process_universal_compliance_frameworks,
 )
-from prowler.lib.outputs.compliance.csa.csa_alibabacloud import AlibabaCloudCSA
-from prowler.lib.outputs.compliance.csa.csa_aws import AWSCSA
-from prowler.lib.outputs.compliance.csa.csa_azure import AzureCSA
-from prowler.lib.outputs.compliance.csa.csa_gcp import GCPCSA
-from prowler.lib.outputs.compliance.csa.csa_oraclecloud import OracleCloudCSA
 from prowler.lib.outputs.compliance.ens.ens_aws import AWSENS
 from prowler.lib.outputs.compliance.ens.ens_azure import AzureENS
 from prowler.lib.outputs.compliance.ens.ens_gcp import GCPENS
@@ -108,6 +102,9 @@ from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_azure import (
     AzureMitreAttack,
 )
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_gcp import GCPMitreAttack
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta import (
+    OktaIDaaSSTIG,
+)
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_alibaba import (
     ProwlerThreatScoreAlibaba,
 )
@@ -205,14 +202,15 @@ def prowler():
 
     if not args.no_banner:
         legend = args.verbose or getattr(args, "fixer", None)
-        print_banner(legend)
+        print_banner(legend, provider)
 
     # We treat the compliance framework as another output format
     if compliance_framework:
         args.output_formats.extend(compliance_framework)
-    # If no input compliance framework, set all, unless a specific service or check is input
-    # Skip for IAC and LLM providers that don't use compliance frameworks
-    elif default_execution and provider not in ["iac", "llm"]:
+    # If no input compliance framework, set all, unless a specific service or check is input.
+    # Skip for tool-wrapper providers (iac, llm, image, and any external plug-in
+    # declaring `is_external_tool_provider = True`) — they don't use compliance frameworks.
+    elif default_execution and not Provider.is_tool_wrapper_provider(provider):
         args.output_formats.extend(get_available_compliance_frameworks(provider))
 
     # Set Logger configuration
@@ -250,7 +248,7 @@ def prowler():
     universal_frameworks = {}
 
     # Skip compliance frameworks for external-tool providers
-    if provider not in EXTERNAL_TOOL_PROVIDERS:
+    if not Provider.is_tool_wrapper_provider(provider):
         bulk_compliance_frameworks = Compliance.get_bulk(provider)
         # Complete checks metadata with the compliance framework specification
         bulk_checks_metadata = update_checks_metadata_with_compliance(
@@ -318,7 +316,7 @@ def prowler():
         sys.exit()
 
     # Skip service and check loading for external-tool providers
-    if provider not in EXTERNAL_TOOL_PROVIDERS:
+    if not Provider.is_tool_wrapper_provider(provider):
         # Import custom checks from folder
         if checks_folder:
             custom_checks = parse_checks_from_folder(global_provider, checks_folder)
@@ -441,6 +439,20 @@ def prowler():
         output_options = ScalewayOutputOptions(
             args, bulk_checks_metadata, global_provider.identity
         )
+    else:
+        # Dynamic fallback: any external/custom provider
+        try:
+            output_options = global_provider.get_output_options(
+                args, bulk_checks_metadata
+            )
+        except NotImplementedError:
+            # No provider-specific OutputOptions: use the generic default so the
+            # run still produces output instead of aborting.
+            from prowler.providers.common.models import default_output_options
+
+            output_options = default_output_options(
+                global_provider, args, bulk_checks_metadata
+            )
 
     # Run the quick inventory for the provider if available
     if hasattr(args, "quick_inventory") and args.quick_inventory:
@@ -450,7 +462,7 @@ def prowler():
     # Execute checks
     findings = []
 
-    if provider in EXTERNAL_TOOL_PROVIDERS:
+    if Provider.is_tool_wrapper_provider(provider):
         # For external-tool providers, run the scan directly
         if provider == "llm":
 
@@ -460,12 +472,19 @@ def prowler():
 
             findings = global_provider.run_scan(streaming_callback=streaming_callback)
         else:
-            # Original behavior for IAC and Image
-            try:
+            if provider == "image":
+                try:
+                    findings = global_provider.run()
+                except ImageBaseException as error:
+                    logger.critical(f"{error}")
+                    sys.exit(1)
+            else:
+                # IAC and external tool-wrapper providers registered via entry
+                # points. Unexpected failures propagate to the outer except
+                # Exception backstop further down in this file — keeping the
+                # branch free of an Image-specific catch that would otherwise
+                # mislead plug-in authors reading this code.
                 findings = global_provider.run()
-            except ImageBaseException as error:
-                logger.critical(f"{error}")
-                sys.exit(1)
             # Note: External tool providers don't support granular progress tracking since
             # they run external tools as a black box and return all findings at once.
             # Progress tracking would just be 0% → 100%.
@@ -806,18 +825,6 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(c5)
                 c5.batch_write_data_to_file()
-            elif compliance_name == "csa_ccm_4.0_aws":
-                filename = (
-                    f"{output_options.output_directory}/compliance/"
-                    f"{output_options.output_filename}_{compliance_name}.csv"
-                )
-                csa_ccm_4_0_aws = AWSCSA(
-                    findings=finding_outputs,
-                    compliance=bulk_compliance_frameworks[compliance_name],
-                    file_path=filename,
-                )
-                generated_outputs["compliance"].append(csa_ccm_4_0_aws)
-                csa_ccm_4_0_aws.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -921,18 +928,6 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(c5_azure)
                 c5_azure.batch_write_data_to_file()
-            elif compliance_name == "csa_ccm_4.0_azure":
-                filename = (
-                    f"{output_options.output_directory}/compliance/"
-                    f"{output_options.output_filename}_{compliance_name}.csv"
-                )
-                csa_ccm_4_0_azure = AzureCSA(
-                    findings=finding_outputs,
-                    compliance=bulk_compliance_frameworks[compliance_name],
-                    file_path=filename,
-                )
-                generated_outputs["compliance"].append(csa_ccm_4_0_azure)
-                csa_ccm_4_0_azure.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -1036,18 +1031,6 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(c5_gcp)
                 c5_gcp.batch_write_data_to_file()
-            elif compliance_name == "csa_ccm_4.0_gcp":
-                filename = (
-                    f"{output_options.output_directory}/compliance/"
-                    f"{output_options.output_filename}_{compliance_name}.csv"
-                )
-                csa_ccm_4_0_gcp = GCPCSA(
-                    findings=finding_outputs,
-                    compliance=bulk_compliance_frameworks[compliance_name],
-                    file_path=filename,
-                )
-                generated_outputs["compliance"].append(csa_ccm_4_0_gcp)
-                csa_ccm_4_0_gcp.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -1282,18 +1265,6 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(cis)
                 cis.batch_write_data_to_file()
-            elif compliance_name == "csa_ccm_4.0_oraclecloud":
-                filename = (
-                    f"{output_options.output_directory}/compliance/"
-                    f"{output_options.output_filename}_{compliance_name}.csv"
-                )
-                csa_ccm_4_0_oraclecloud = OracleCloudCSA(
-                    findings=finding_outputs,
-                    compliance=bulk_compliance_frameworks[compliance_name],
-                    file_path=filename,
-                )
-                generated_outputs["compliance"].append(csa_ccm_4_0_oraclecloud)
-                csa_ccm_4_0_oraclecloud.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -1322,18 +1293,6 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(cis)
                 cis.batch_write_data_to_file()
-            elif compliance_name == "csa_ccm_4.0_alibabacloud":
-                filename = (
-                    f"{output_options.output_directory}/compliance/"
-                    f"{output_options.output_filename}_{compliance_name}.csv"
-                )
-                csa_ccm_4_0_alibabacloud = AlibabaCloudCSA(
-                    findings=finding_outputs,
-                    compliance=bulk_compliance_frameworks[compliance_name],
-                    file_path=filename,
-                )
-                generated_outputs["compliance"].append(csa_ccm_4_0_alibabacloud)
-                csa_ccm_4_0_alibabacloud.batch_write_data_to_file()
             elif compliance_name == "prowler_threatscore_alibabacloud":
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -1358,6 +1317,57 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(generic_compliance)
                 generic_compliance.batch_write_data_to_file()
+    elif provider == "okta":
+        for compliance_name in input_compliance_frameworks:
+            if compliance_name.startswith("okta_idaas_stig"):
+                # Generate Okta IDaaS STIG Finding Object
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                okta_idaas_stig = OktaIDaaSSTIG(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(okta_idaas_stig)
+                okta_idaas_stig.batch_write_data_to_file()
+            else:
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                generic_compliance = GenericCompliance(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(generic_compliance)
+                generic_compliance.batch_write_data_to_file()
+    else:
+        # Dynamic fallback: any external/custom provider
+        try:
+            global_provider.generate_compliance_output(
+                finding_outputs,
+                bulk_compliance_frameworks,
+                input_compliance_frameworks,
+                output_options,
+                generated_outputs,
+            )
+        except NotImplementedError:
+            # Last resort: generic compliance
+            for compliance_name in input_compliance_frameworks:
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                generic_compliance = GenericCompliance(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(generic_compliance)
+                generic_compliance.batch_write_data_to_file()
 
     # AWS Security Hub Integration
     if provider == "aws":
@@ -1466,6 +1476,10 @@ def prowler():
                     f"\nDetailed compliance results are in {Fore.YELLOW}{output_options.output_directory}/compliance/{Style.RESET_ALL}\n"
                 )
 
+    # Promote Prowler Cloud as the last thing the user sees after the results
+    if not args.no_banner and not args.only_logs:
+        print_prowler_cloud_banner(provider)
+
     # If custom checks were passed, remove the modules
     if checks_folder:
         remove_custom_checks_module(checks_folder, provider)
diff --git a/prowler/compliance/alibabacloud/csa_ccm_4.0_alibabacloud.json b/prowler/compliance/alibabacloud/csa_ccm_4.0_alibabacloud.json
deleted file mode 100644
index 060b6e819e..0000000000
--- a/prowler/compliance/alibabacloud/csa_ccm_4.0_alibabacloud.json
+++ /dev/null
@@ -1,7305 +0,0 @@
-{
-  "Framework": "CSA-CCM",
-  "Name": "CSA Cloud Controls Matrix (CCM) v4.0.13",
-  "Version": "4.0",
-  "Provider": "alibabacloud",
-  "Description": "The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing, composed of 197 control objectives structured in 17 domains covering all key aspects of cloud technology. The CCM can be used as a tool for the systematic assessment of a cloud implementation, and provides guidance on which security controls should be implemented by which actor within the cloud supply chain.",
-  "Requirements": [
-    {
-      "Id": "A&A-02",
-      "Description": "Conduct independent audit and assurance assessments according to relevant standards at least annually.",
-      "Name": "Independent Assessments",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC4.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AAC-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.2",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.2.1",
-                "27002: 18.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.35",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-2",
-                "CA-2(1)",
-                "CA-2(2)",
-                "CA-7",
-                "CA-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_advanced_or_enterprise_edition"
-      ]
-    },
-    {
-      "Id": "A&A-04",
-      "Description": "Verify compliance with all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit.",
-      "Name": "Requirements Compliance",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01",
-                "GRM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.18.2.2",
-                "27002: 18.2.2",
-                "27001: A.18.2.3",
-                "27002: 18.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-3",
-                "DE.DP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_advanced_or_enterprise_edition"
-      ]
-    },
-    {
-      "Id": "AIS-04",
-      "Description": "Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.",
-      "Name": "Secure Application Design and Development",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27017: 14.1.1",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.14.2.1",
-                "27002: 14.2.1",
-                "27017: 14.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.8",
-                "27001: A.8.25",
-                "27001: A.8.26",
-                "27001: A.8.28"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PL-8",
-                "PL-8(1)",
-                "SA-3",
-                "SA-3(1)",
-                "SA-4",
-                "SA-4(2)",
-                "SA-4(3)",
-                "SA-4(8)",
-                "SA-4(9)",
-                "SA-5",
-                "SA-8",
-                "SA-8(1)-(7)",
-                "SA-8(9)-(13)",
-                "SA-8(15)-(20)",
-                "SA-8(22)",
-                "SA-8(24)-(28)",
-                "SA-8(30)-(33)",
-                "SA-17",
-                "SA-17(1)-(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-6",
-                "PR.DS-7",
-                "PR.IP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1",
-                "6.2.3",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "AIS-05",
-      "Description": "Implement a testing strategy, including criteria for acceptance of new information systems, upgrades and new versions, which provides application security assurance and maintains compliance while enabling organizational speed of delivery goals. Automate when applicable and possible.",
-      "Name": "Automated Application Security Testing",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.12",
-                "16.13"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.3",
-                "SD2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.8",
-                "27001: A.14.2.9",
-                "27001: A.12.1.2",
-                "27002: 12.1.2",
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.25",
-                "27001: A.8.29",
-                "27001: A.8.32",
-                "27002: 8.25 (e)",
-                "27002: 8.32 (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SA-11",
-                "SA-11(1)-(9)",
-                "SI-6",
-                "SI-6(2)",
-                "SI-6(3)",
-                "SI-10",
-                "SI-10(1)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.IP-12",
-                "DE.CM-8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "PR.PS-01",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A.3.2.2",
-                "A.3.2.2.1",
-                "6.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.4",
-                "6.4.1",
-                "6.4.2",
-                "6.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_vulnerability_scan_enabled"
-      ]
-    },
-    {
-      "Id": "AIS-07",
-      "Description": "Define and implement a process to remediate application security vulnerabilities, automating remediation when possible.",
-      "Name": "Application Vulnerability Remediation",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1",
-                "CC7.4",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.2",
-                "16.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27001: A.12.6.1",
-                "27002: 12.6.1",
-                "27017: 12.6.1",
-                "27018: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27002: 5.26 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-2",
-                "SI-2(2)-(6)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-15",
-                "SA-15(1)-(3)",
-                "SA-15(5)-(8)",
-                "SA-15(10)-(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.IP-12",
-                "DE.CM-8",
-                "RS.AN-5",
-                "RS.MI-3",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.2",
-                "6.5",
-                "6.5.1-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "11.3.1",
-                "11.3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_vulnerability_scan_enabled"
-      ]
-    },
-    {
-      "Id": "BCR-08",
-      "Description": "Periodically backup data stored in the cloud. Ensure the confidentiality, integrity and availability of the backup, and verify data restoration from backup for resiliency.",
-      "Name": "Backup",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "A1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "11.1",
-                "11.2",
-                "11.3",
-                "11.4",
-                "11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27017: 12.3",
-                "27018: 12.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.13",
-                "27001: A.5.23",
-                "27001: A.5.30",
-                "27002: 8.13",
-                "27002: 5.23 2nd (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-4",
-                "CP-4(4)",
-                "CP-6",
-                "CP-6(1)-(3)",
-                "CP-9",
-                "CP-9(1)",
-                "CP-9(2)",
-                "CP-10",
-                "CP-10(2)",
-                "CP-10(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-4",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-11",
-                "RC.RP-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.5.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "10.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "BCR-09",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain a disaster response plan to recover from natural and man-made disasters. Update the plan at least annually or upon significant changes.",
-      "Name": "Disaster Response Plan",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9",
-                "1.6.1",
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.4",
-                "BC2.1",
-                "BC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.29",
-                "27001: A.5.30",
-                "27002: 5.29",
-                "27002: 5.30"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2(1)",
-                "CP-2(2)",
-                "CP-2(3)",
-                "CP-2(5)",
-                "CP-2(6)",
-                "CP-2(7)",
-                "CP-2(8)",
-                "PE-13",
-                "PE-13(1)",
-                "PE-13(2)",
-                "PE-13(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-9",
-                "PR.IP-10",
-                "RC.IM-1",
-                "RC.IM-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "BCR-11",
-      "Description": "Supplement business-critical equipment with redundant equipment independently located at a reasonable minimum distance in accordance with applicable industry standards.",
-      "Name": "Equipment Redundancy",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-06"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.20",
-                "27001: A.7.11",
-                "27001: A.8.14",
-                "27002: 5.20 (t)",
-                "27002: 8.14 (c)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "CP-4(3)",
-                "CP-6",
-                "CP-6(1)",
-                "CP-7",
-                "CP-8",
-                "CP-8(1)-(3)",
-                "CP-9",
-                "CP-9(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.BE-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.OC-04",
-                "GV.OC-05",
-                "PR.IR-03"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "CCC-04",
-      "Description": "Restrict the unauthorized addition, removal, update, and management of organization assets.",
-      "Name": "Unauthorized Change Protection",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "CCC-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.1",
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4",
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.1.4",
-                "27002: 12.1.4",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27001: A.14.2.2",
-                "27017: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.3",
-                "27001: A.8.4",
-                "27001: A.8.15",
-                "27001: A.8.31",
-                "27001: A.8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(4)",
-                "CM-3",
-                "CM-3(1)",
-                "CM-3(5)",
-                "CM-3(7)",
-                "CM-3(8)",
-                "CM-5",
-                "CM-5(1)",
-                "CM-5(4)",
-                "CM-5(5)",
-                "CM-6",
-                "CM-6(1)",
-                "CM-6(2)",
-                "CM-7",
-                "CM-7(1)",
-                "CM-7(4)",
-                "CM-7(5)",
-                "CM-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.MA-1",
-                "PR.MA-2",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04",
-                "ID.AM-08",
-                "PR.PS-02",
-                "PR.PS-03",
-                "PR.PS-05",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.1",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "actiontrail_multi_region_enabled"
-      ]
-    },
-    {
-      "Id": "CCC-07",
-      "Description": "Implement detection measures with proactive notification in case of changes deviating from the established baseline.",
-      "Name": "Detection of Baseline Deviation",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.1",
-                "1.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.2",
-                "27001: A.14.2.4",
-                "27001: A.12.4.1",
-                "27002: 12.4.1 (g)",
-                "27001: A.5.1.1",
-                "27017: 5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.9",
-                "27001: A.8.15",
-                "27002: 8.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(2)",
-                "SI-2",
-                "SI-2(2)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.MA-1",
-                "PR.IP-1",
-                "DE.DP-4",
-                "PR.IP-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01",
-                "DE.CM-09",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.3",
-                "6.4.5.4",
-                "11.5",
-                "11.5.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "11.5.2",
-                "11.6.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_advanced_or_enterprise_edition",
-        "sls_security_group_changes_alert_enabled",
-        "sls_vpc_changes_alert_enabled",
-        "sls_vpc_network_route_changes_alert_enabled",
-        "sls_customer_created_cmk_changes_alert_enabled",
-        "sls_cloud_firewall_changes_alert_enabled",
-        "sls_management_console_authentication_failures_alert_enabled",
-        "sls_rds_instance_configuration_changes_alert_enabled"
-      ]
-    },
-    {
-      "Id": "CEK-03",
-      "Description": "Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.",
-      "Name": "Data Encryption",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-03",
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6",
-                "3.1",
-                "3.11",
-                "11.3",
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.1",
-                "27001: A.18.1.2",
-                "27001: A.18.1.3",
-                "27001: A.18.1.4",
-                "27001: A.18.1.5",
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.18",
-                "27002: 18",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27001: A.14.1.3",
-                "27002 14.1.3 c)",
-                "27001 - A.10.1.1",
-                "27017 - 10.1.1",
-                "27001 - A.10.1.2",
-                "27017 - 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.24",
-                "27002: 8.24 Other Information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19",
-                "AC-19(5)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-8(3)",
-                "SC-8(4)",
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)-(3)",
-                "SI-4",
-                "SI-4(10)",
-                "SI-7",
-                "SI-7(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "Requirement 3",
-                "2.2.3",
-                "2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ecs_attached_disk_encrypted",
-        "ecs_unattached_disk_encrypted",
-        "rds_instance_tde_enabled",
-        "rds_instance_ssl_enabled",
-        "oss_bucket_secure_transport_enabled"
-      ]
-    },
-    {
-      "Id": "CEK-04",
-      "Description": "Use encryption algorithms that are appropriate for data protection, considering the classification of data, associated risks, and usability of the encryption technology.",
-      "Name": "Encryption Algorithm",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.2",
-                "27002: 8.2",
-                "27001: A.8.3",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (b)",
-                "27001: A.10.1.2",
-                "27002: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.24",
-                "27001: A.5.12",
-                "27001: A.5.13",
-                "27002: 8.24 General (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A2",
-                "Requirement 3",
-                "2.3",
-                "2.2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "CEK-08",
-      "Description": "CSPs must provide the capability for CSCs to manage their own data encryption keys.",
-      "Name": "CSC Key Management Capability",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27017: 10.1",
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.23",
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-9",
-                "CP-9(8)",
-                "SA-9",
-                "SA-9(6)",
-                "SC-12",
-                "SC-12(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.AM-6",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-05"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "rds_instance_tde_key_custom"
-      ]
-    },
-    {
-      "Id": "CEK-10",
-      "Description": "Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.",
-      "Name": "Key Generation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "TS2.3",
-                "SY1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (e)",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2",
-                "27002: 10.1.2 (a)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24",
-                "27002: 8.24 (d), Key management (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2.3",
-                "3.6.1",
-                "PCI Glossary - Cryptographic Key Generation"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.6.1.1",
-                "3.7.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "rds_instance_tde_key_custom"
-      ]
-    },
-    {
-      "Id": "CEK-12",
-      "Description": "Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.",
-      "Name": "Key Rotation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 e)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (e,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_rotate_access_key_90_days"
-      ]
-    },
-    {
-      "Id": "CEK-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to destroy keys stored outside a secure environment and revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, which include provisions for legal and regulatory requirements.",
-      "Name": "Key Destruction",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27017: 10.1.2",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 (j)",
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (j,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.IP-6",
-                "ID.GV-3",
-                "PR.DS-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "ID.AM-08",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.6.4",
-                "3.6.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "DCS-06",
-      "Description": "Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.",
-      "Name": "Assets Cataloguing and Tracking",
-      "Attributes": [
-        {
-          "Section": "Datacenter Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DCS - 01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "1.1",
-                "2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27017: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-8",
-                "CM-8(1)",
-                "CM-8(2)",
-                "CM-8(4)",
-                "CM-8(7)",
-                "CM-8(8)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4",
-                "9.7.1",
-                "9.9.1",
-                "9.9.1.a",
-                "9.9.1.b",
-                "9.9.1.c",
-                "12.3.3",
-                "12.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1.1",
-                "6.3.2",
-                "9.4.2",
-                "9.4.3",
-                "12.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_all_assets_agent_installed"
-      ]
-    },
-    {
-      "Id": "DSP-02",
-      "Description": "Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.",
-      "Name": "Secure Disposal",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3",
-                "CC6.4",
-                "CC6.5",
-                "CC6.7",
-                "P4.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-07"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.3",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.3.2",
-                "27002: 8.3.2",
-                "27001: A.11.2.7",
-                "27002: 11.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.7.10",
-                "27001: A.7.14",
-                "27001: A.8.10",
-                "27002: 7.10 (Secure reuse or disposal)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-22",
-                "SI-12",
-                "SI-12(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-10",
-                "PR.PS-02",
-                "PR.PS-03",
-                "ID.AM-08"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1",
-                "9.8",
-                "9.8.1",
-                "9.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "3.7.5",
-                "9.4.7"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "DSP-03",
-      "Description": "Create and maintain a data inventory, at least for any sensitive data and personal data.",
-      "Name": "Data Inventory",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2",
-                "1.3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-12",
-                "CM-12(1)",
-                "PM-5",
-                "PM-5(1)",
-                "SI-12",
-                "SI-12(1)",
-                "SI-19",
-                "SI-19(1)",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "9.4.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_all_assets_agent_installed"
-      ]
-    },
-    {
-      "Id": "DSP-04",
-      "Description": "Classify data according to its type and sensitivity level.",
-      "Name": "Data Classification",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "C1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.2.1",
-                "27002: 8.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-16",
-                "AC-16(9)",
-                "PM-22",
-                "PM-23",
-                "PT-2",
-                "PT-2(1)",
-                "SI-18",
-                "SI-18(2)",
-                "SI-19",
-                "SI-19(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-05",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "9.4.2",
-                "9.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "DSP-07",
-      "Description": "Develop systems, products, and business practices based upon a principle of security by design and industry best practices.",
-      "Name": "Data Protection by Design and Default",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "PI1.2",
-                "PI1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.1",
-                "5.3.2",
-                "5.3.3",
-                "5.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.2",
-                "IM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002:14.1.1",
-                "27001: A.14.2.5",
-                "27002:14.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.27",
-                "27001: A.8.28",
-                "27001: A.8.29",
-                "27002: 5.8 (Information security requirements a-i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-17",
-                "PM-24",
-                "PM-25",
-                "PT-2",
-                "PT-2(2)",
-                "SA-3",
-                "SA-4",
-                "SA-5",
-                "SA-8",
-                "SA-8(9)",
-                "SA-8(13)",
-                "SA-8(18)",
-                "SA-8(20)",
-                "SA-8(22)",
-                "SA-8(23)",
-                "SA-8(33)",
-                "SA-15",
-                "SA-15(12)",
-                "SC-3",
-                "SC-3(3)",
-                "SC-7",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(4)",
-                "SC-28",
-                "SC-28(1)",
-                "SI-12",
-                "SI-12(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "oss_bucket_not_publicly_accessible",
-        "rds_instance_no_public_access_whitelist"
-      ]
-    },
-    {
-      "Id": "DSP-10",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.",
-      "Name": "Sensitive Data Transfer",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.12",
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "9.5.1",
-                "9.5.2",
-                "9.5.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.8.3.3",
-                "27002: 8.3.3",
-                "27001: A.13.2.3",
-                "27002: 13.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.7.10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-4",
-                "AC-4(23)-(25)",
-                "CA-3",
-                "CA-3(6)",
-                "CA-6",
-                "CA-6(1)",
-                "CA-6(2)",
-                "SC-4",
-                "SC-4(2)",
-                "SC-7",
-                "SC-7(10)",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-16",
-                "SC-16(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.DS-5",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.IR-01",
-                "ID.AM-03",
-                "GV.OC-03",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "4.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.1.1",
-                "4.2.1",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "oss_bucket_secure_transport_enabled",
-        "rds_instance_ssl_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-16",
-      "Description": "Data retention, archiving and deletion is managed in accordance with business requirements, applicable laws and regulations.",
-      "Name": "Data Retention and Deletion",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "C1.1",
-                "C1.2",
-                "CC3.1",
-                "P4.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.4",
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.10",
-                "27002: 5.33 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-12",
-                "SI-12(1)-(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)",
-                "SI-19",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-3",
-                "PR.IP-6",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "GV.OC-03",
-                "GV.SC-10",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "sls_logstore_retention_period",
-        "rds_instance_sql_audit_retention"
-      ]
-    },
-    {
-      "Id": "DSP-17",
-      "Description": "Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.",
-      "Name": "Sensitive Data Protection",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSC-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.1",
-                "CC6.1",
-                "CC6.3",
-                "CC6.7",
-                "CC8.1",
-                "C1.1",
-                "P2.0",
-                "P3.0",
-                "P4.0",
-                "P5.0",
-                "P6.0"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.1",
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.3",
-                "9.1.1",
-                "9.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001:A.18.1.4",
-                "27002:18.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.11",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PM-22",
-                "PM-24",
-                "PT-7",
-                "PT-7(1)",
-                "PT-7(2)",
-                "PT-8",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.0 (including all subsections)",
-                "4.0 (including all subsections)"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "oss_bucket_not_publicly_accessible",
-        "rds_instance_no_public_access_whitelist",
-        "ecs_attached_disk_encrypted",
-        "ecs_unattached_disk_encrypted",
-        "rds_instance_tde_enabled"
-      ]
-    },
-    {
-      "Id": "GRC-05",
-      "Description": "Develop and implement an Information Security Program, which includes programs for all the relevant domains of the CCM.",
-      "Name": "Information Security Program",
-      "Attributes": [
-        {
-          "Section": "Governance, Risk and Compliance",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "14.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SG2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-1",
-                "PM-3",
-                "PM-14",
-                "PL-2",
-                "PM-18",
-                "PM-31"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.4.1",
-                "A.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.4.1",
-                "A3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_advanced_or_enterprise_edition"
-      ]
-    },
-    {
-      "Id": "IAM-02",
-      "Description": "Establish, document, approve, communicate, implement, apply, evaluate and maintain strong password policies and procedures. Review and update the policies and procedures at least annually.",
-      "Name": "Strong Password Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-12",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "4.1.2",
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1",
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.7.2.2",
-                "27002: 7.2.2",
-                "27001: A.9.2.6",
-                "27002: 9.2.6",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.17",
-                "27001: A.6.3",
-                "27001: A.8.5",
-                "27001: A.5.37"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-3",
-                "AC-3(3)",
-                "AC-12",
-                "AC-12(1)",
-                "IA-2",
-                "IA-2(10)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.AC-1",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.4",
-                "12.1",
-                "12.1.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.1.1",
-                "8.3.8"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_password_policy_minimum_length",
-        "ram_password_policy_lowercase",
-        "ram_password_policy_uppercase",
-        "ram_password_policy_number",
-        "ram_password_policy_symbol",
-        "ram_password_policy_password_reuse_prevention",
-        "ram_password_policy_max_password_age",
-        "ram_password_policy_max_login_attempts"
-      ]
-    },
-    {
-      "Id": "IAM-03",
-      "Description": "Manage, store, and review the information of system identities, and level of access.",
-      "Name": "Identity Inventory",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-04",
-                "IAM-08",
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27001: A.9.4.1",
-                "27002: 9.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.5.15",
-                "27001: A.5.16",
-                "27001: A.5.18",
-                "27001: A.7.4",
-                "27001: A.8.15",
-                "27001: A.8.2",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "AU-16",
-                "AU-16(1)",
-                "IA-4",
-                "IA-4(8)",
-                "IA-4(9)",
-                "IA-5",
-                "IA-5(5)",
-                "IA-8",
-                "IA-8(4)",
-                "PM-5(1)",
-                "SA-8",
-                "SA-8(22)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-04",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4.a"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_user_console_access_unused"
-      ]
-    },
-    {
-      "Id": "IAM-04",
-      "Description": "Employ the separation of duties principle when implementing information system access.",
-      "Name": "Separation of Duties",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC1.3",
-                "CC5.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.2",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.6.1.2",
-                "27002: 6.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18",
-                "27001: A.5.3",
-                "27001: A.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-6",
-                "AC-6(1)-(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4",
-                "6.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_policy_attached_only_to_group_or_roles"
-      ]
-    },
-    {
-      "Id": "IAM-05",
-      "Description": "Employ the least privilege principle when implementing information system access.",
-      "Name": "Least Privilege",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-06",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.1",
-                "27002: 9.1.1",
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.8.2",
-                "27002:  5.15 (Other information 2nd (a))"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "IA-12",
-                "IA-12(2)",
-                "IA-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1",
-                "7.1.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2",
-                "7.2.5",
-                "7.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_policy_no_administrative_privileges"
-      ]
-    },
-    {
-      "Id": "IAM-07",
-      "Description": "De-provision or respectively modify access of movers / leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.",
-      "Name": "User Access Changes and Revocation",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.3",
-                "6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(1)",
-                "AC-2(2)",
-                "AC-2(6)",
-                "AC-2(8)",
-                "AC-3",
-                "AC-3(8)",
-                "AC-6",
-                "AC-6(7)",
-                "AU-10",
-                "AU-10(4)",
-                "AU-16",
-                "AU-16(1)",
-                "CM-7",
-                "CM-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.IP-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-04",
-                "GV.SC-10",
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.5",
-                "8.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_user_console_access_unused"
-      ]
-    },
-    {
-      "Id": "IAM-08",
-      "Description": "Review and revalidate user access for least privilege and separation of duties with a frequency that is commensurate with organizational risk tolerance.",
-      "Name": "User Access Review",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27001: A.9.2.6",
-                "27001: A.9.4.1",
-                "27017: 9.4.1",
-                "27001: A.6.1.2",
-                "27001: A 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.3",
-                "27001: A.5.18",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5.1",
-                "7.2.5",
-                "7.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_user_console_access_unused",
-        "ram_rotate_access_key_90_days"
-      ]
-    },
-    {
-      "Id": "IAM-09",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the segregation of privileged access roles such that administrative access to data, encryption and key management capabilities and logging capabilities are distinct and separated.",
-      "Name": "Segregation of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.1",
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-3(7)",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-5",
-                "IA-5(6)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.3",
-                "3.5.2",
-                "7.1.2",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.7.6",
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_policy_attached_only_to_group_or_roles",
-        "ram_no_root_access_key"
-      ]
-    },
-    {
-      "Id": "IAM-10",
-      "Description": "Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access.",
-      "Name": "Management of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "6.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3",
-                "27001: A.9.4.4",
-                "27002: 9.4.4",
-                "27017: 9.4.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(7)",
-                "AC-3",
-                "AC-3(4)",
-                "AC-3(11)",
-                "AC-3(13)",
-                "AC-3(14)",
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(5)",
-                "AC-6(8)",
-                "AC-12",
-                "AC-12(3)",
-                "AC-17",
-                "AC-17(4)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_no_root_access_key",
-        "ram_policy_no_administrative_privileges"
-      ]
-    },
-    {
-      "Id": "IAM-12",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the logging infrastructure is read-only for all with write access, including privileged access roles, and that the ability to disable it is controlled through a procedure that ensures the segregation of duties and break glass procedures.",
-      "Name": "Safeguard Logs Integrity",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1",
-                "27018: 12.4.1",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27017: 12.4.2",
-                "27018: 12.4.2",
-                "27001: A.12.4.3",
-                "27002: 12.4.3",
-                "27017: 12.4.3",
-                "27018: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.18",
-                "27002: 8.15 Protection of Logs"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(11)",
-                "AC-2(12)",
-                "IA-8",
-                "IA-8(4)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-34",
-                "SC-34(1)",
-                "SC-34(2)",
-                "SC-36",
-                "SI-4",
-                "SI-4(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "actiontrail_oss_bucket_not_publicly_accessible"
-      ]
-    },
-    {
-      "Id": "IAM-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure users are identifiable through unique IDs or which can associate individuals to the usage of user IDs.",
-      "Name": "Uniquely Identifiable Users",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.1",
-                "27002: 9.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(14)",
-                "AC-24",
-                "AC-24(2)",
-                "AU-10",
-                "AU-10(1)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-4",
-                "IA-4(1)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-23",
-                "SC-23(3)",
-                "SC-40(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1",
-                "8.2",
-                "8.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.1",
-                "8.2.2",
-                "8.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_user_mfa_enabled_console_access"
-      ]
-    },
-    {
-      "Id": "IAM-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for authenticating access to systems, application and data assets, including multifactor authentication for at least privileged user and sensitive data access. Adopt digital certificates or alternatives which achieve an equivalent level of security for system identities.",
-      "Name": "Strong Authentication",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.3",
-                "6.5",
-                "12.5",
-                "12.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4",
-                "SA1.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27017: 9.1.2",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.9.4.2",
-                "27002: 9.4.2",
-                "27017: 9.4.2",
-                "27018: 9.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.17",
-                "27001: A.8.5",
-                "27001: A.8.24",
-                "27002: 8.5",
-                "27002: 8.24 other information (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(5)",
-                "AC-7",
-                "AC-7(4)",
-                "AU-10",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(8)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5",
-                "IA-5(2)",
-                "IA-5(7)",
-                "IA-5(9)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-5(14)-(16)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(6)",
-                "SC-23",
-                "SC-23(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3",
-                "8.1.6",
-                "8.2",
-                "8.3",
-                "8.3.2",
-                "12.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "8.3.1",
-                "8.3.2",
-                "8.4.1",
-                "8.4.2",
-                "8.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_user_mfa_enabled_console_access"
-      ]
-    },
-    {
-      "Id": "IAM-15",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the secure management of passwords.",
-      "Name": "Passwords Management",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27018: 9.2.4",
-                "27001: A.9.3.1",
-                "27002: 9.3.1",
-                "27017: 9.3.1",
-                "27018: 9.3.1",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.17"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IA-4",
-                "IA-4(8)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(8)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.2",
-                "8.2.1-6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.2",
-                "2.3.1",
-                "8.3.5",
-                "8.3.6",
-                "8.3.7",
-                "8.3.8",
-                "8.3.9",
-                "8.3.10",
-                "8.3.10.1",
-                "8.6.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_password_policy_minimum_length",
-        "ram_password_policy_password_reuse_prevention",
-        "ram_password_policy_max_password_age"
-      ]
-    },
-    {
-      "Id": "IAM-16",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.",
-      "Name": "Authorization Mechanisms",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27002: 9.2.5",
-                "27017: 9.2.5",
-                "27018: 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(5)",
-                "AC-4",
-                "AC-4(17)",
-                "AC-4(21)",
-                "AC-4(22)",
-                "AC-6",
-                "AC-6(8)",
-                "AC-6(9)",
-                "AC-12",
-                "AC-12(1)",
-                "AC-20",
-                "AC-20(1)",
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5(1)",
-                "IA-5(2)",
-                "IA-5(5)",
-                "IA-5(8)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.AC-6",
-                "PR.AC-7",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03",
-                "PR.AA-04",
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.3",
-                "7.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.4",
-                "7.2.3",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ram_policy_no_administrative_privileges",
-        "cs_kubernetes_rbac_enabled"
-      ]
-    },
-    {
-      "Id": "IPY-03",
-      "Description": "Implement cryptographically secure and standardized network protocols for the management, import and export of data.",
-      "Name": "Secure Interoperability and Portability Management",
-      "Attributes": [
-        {
-          "Section": "Interoperability & Portability",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IPY-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.2",
-                "NC1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1",
-                "27001: A.15.1.1",
-                "27002: 15.1.1",
-                "27017: 15.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.19",
-                "27001: A.5.23",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PT-2",
-                "PT-2(2)",
-                "SA-4",
-                "SC-16",
-                "SC-16(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.1",
-                "1.2.5",
-                "1.2.6",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "oss_bucket_secure_transport_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-02",
-      "Description": "Plan and monitor the availability, quality, and adequate capacity of resources in order to deliver the required system performance as determined by the business.",
-      "Name": "Capacity and Resource Planning",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-04"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.3",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.12.1.3",
-                "27002: 12.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.3 (b)",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.8.6",
-                "27001: A.8.14"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "SC-5",
-                "SC-5(2)",
-                "SC-4",
-                "SI-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-04",
-                "GV.OC-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "IVS-03",
-      "Description": "Monitor, encrypt and restrict communications between environments to only authenticated and authorized connections, as justified by the business. Review these configurations at least annually, and support them by a documented justification of all allowed services, protocols, ports, and compensating controls.",
-      "Name": "Network Security",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-06"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.8",
-                "3.1",
-                "12.2",
-                "13.6",
-                "13.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: A.5.15 2nd c)",
-                "27002: 8.20",
-                "27002: 8.21",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-1",
-                "SC-4",
-                "SC-7",
-                "SC-7(4)",
-                "SC-7(5)",
-                "SC-7(8)",
-                "SC-7(9)",
-                "SC-7(11)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-11",
-                "SC-12",
-                "SC-16",
-                "SC-23",
-                "SC-29",
-                "SC-29(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-5",
-                "PR.AC-7",
-                "PR.PT-4",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-01",
-                "PR.AA-03",
-                "PR.AA-05",
-                "DE.CM-01",
-                "PR.DS-02",
-                "ID.AM-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "1.1.6",
-                "1.2",
-                "1.2.3",
-                "2.2",
-                "4.1.1",
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.5",
-                "1.2.6",
-                "1.2.7",
-                "1.4.2",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1",
-                "10.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "vpc_flow_logs_enabled",
-        "ecs_securitygroup_restrict_ssh_internet",
-        "ecs_securitygroup_restrict_rdp_internet"
-      ]
-    },
-    {
-      "Id": "IVS-04",
-      "Description": "Harden host and guest OS, hypervisor or infrastructure control plane according to their respective best practices, and supported by technical controls, as part of a security baseline.",
-      "Name": "OS Hardening and Base Controls",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.8",
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-07",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "4.1",
-                "4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.3",
-                "SY1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2",
-                "27001: A.14.2.3",
-                "27001 A.14.2.4",
-                "27018: 12.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: 8.20",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(1)",
-                "SC-29",
-                "SC-29(1)",
-                "SC-2",
-                "SC-7",
-                "SC-7(12)",
-                "SC-30",
-                "SC-34",
-                "SC-35",
-                "SC-39",
-                "SC-44"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-1",
-                "PR.PT-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ecs_instance_latest_os_patches_applied",
-        "ecs_instance_endpoint_protection_installed"
-      ]
-    },
-    {
-      "Id": "IVS-06",
-      "Description": "Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.",
-      "Name": "Segmentation and Segregation",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-09"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.3.4",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.20",
-                "27001: A.8.3",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.22",
-                "27002: 5.15 (b)",
-                "27002: 8.3 (b)",
-                "27002: 8.16 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-3",
-                "SC-7",
-                "SC-7(20)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.AC-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.6",
-                "8.3.1",
-                "10.8",
-                "11.3",
-                "A3.2.1",
-                "A3.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A1.1.1",
-                "A1.1.2",
-                "A1.1.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cs_kubernetes_network_policy_enabled",
-        "cs_kubernetes_private_cluster_enabled",
-        "ecs_instance_no_legacy_network"
-      ]
-    },
-    {
-      "Id": "IVS-07",
-      "Description": "Use secure and encrypted communication channels when migrating servers, services, applications, or data to cloud environments. Such channels must include only up-to-date and approved protocols.",
-      "Name": "Migration to Cloud Environments",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-10"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM1.4",
-                "NC1.4",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27017: 13.1.1",
-                "27018: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27017: 13.1.2",
-                "27018: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3",
-                "27018: 13.1.3",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27017: 13.2.1",
-                "27018: 13.2.1",
-                "27001: A.13.2.2",
-                "27002: 13.2.2",
-                "27017: 13.2.2",
-                "27018: 13.2.2",
-                "27001: A.13.2.3",
-                "27002: 13.2.3",
-                "27017: 13.2.3",
-                "27018: 13.2.3",
-                "27001: A.13.2.4",
-                "27002: 13.2.4",
-                "27017: 13.2.4",
-                "27018: 13.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.20",
-                "27001: A.8.24",
-                "27002: 8.20 (e)",
-                "27002: 8.24 Guidance (b,f), other information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-17",
-                "AC-20",
-                "SC-7",
-                "SC-7(28)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-12",
-                "SC-23",
-                "SC-29",
-                "SI-7",
-                "SI-7(1)-(3)",
-                "SI-7(5)-(10)",
-                "SI-7(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "rds_instance_ssl_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-09",
-      "Description": "Define, implement and evaluate processes, procedures and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.",
-      "Name": "Network Defense",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.6",
-                "CC6.8",
-                "CC7.1",
-                "CC7.2",
-                "CC7.5"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-13"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "13.3",
-                "13.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3",
-                "5.2.4",
-                "5.2.5",
-                "5.2.7",
-                "5.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.11.1.4",
-                "27002: 11.1.4",
-                "27017: 11.1.4",
-                "27018: 16.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.5.24",
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.26",
-                "27002: 8.8 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-8",
-                "PL-8(1)",
-                "SC-5",
-                "SC-5(1)",
-                "SC-5(3)",
-                "SC-7",
-                "SC-7(13)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.DP-1",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.AC-5",
-                "RS.MI-2",
-                "PR.DS-2",
-                "RS.RP-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "DE.CM-01",
-                "PR.IR-01",
-                "RS.MA-01",
-                "RS.MI-01",
-                "RS.MI-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.6",
-                "1.1",
-                "1.2",
-                "1.3",
-                "1.5",
-                "12.10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.3.1",
-                "1.3.2",
-                "1.3.3",
-                "1.4.1",
-                "1.4.2",
-                "1.4.3",
-                "1.4.4",
-                "1.4.5",
-                "1.5.1",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_advanced_or_enterprise_edition",
-        "sls_cloud_firewall_changes_alert_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-02",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.",
-      "Name": "Audit Logs Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1",
-                "8.9",
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.3",
-                "5.1.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-4",
-                "AU-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-08",
-                "PR.DS-11",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.7"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4",
-                "10.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "actiontrail_oss_bucket_not_publicly_accessible",
-        "sls_logstore_retention_period"
-      ]
-    },
-    {
-      "Id": "LOG-03",
-      "Description": "Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.",
-      "Name": "Security Monitoring and Alerting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03",
-                "SEF-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "5.2.7",
-                "1.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2",
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-3",
-                "DE.AE-5",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-4",
-                "DE.CM-5",
-                "DE.CM-6",
-                "DE.CM-7",
-                "DE.DP-1",
-                "DE.DP-4",
-                "DE.AE-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2",
-                "10.4.1.1",
-                "10.4.2.1",
-                "10.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_advanced_or_enterprise_edition",
-        "securitycenter_notification_enabled_high_risk",
-        "sls_unauthorized_api_calls_alert_enabled",
-        "sls_root_account_usage_alert_enabled",
-        "sls_management_console_signin_without_mfa_alert_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-04",
-      "Description": "Restrict audit logs access to authorized personnel and maintain records that provide unique access accountability.",
-      "Name": "Audit Logs Access and Accountability",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.2",
-                "4.1.3",
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27001: A.12.4.1",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(4)",
-                "AU-9(6)",
-                "AU-10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.1",
-                "10.2.1",
-                "10.2.3",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1.3",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "actiontrail_oss_bucket_not_publicly_accessible"
-      ]
-    },
-    {
-      "Id": "LOG-05",
-      "Description": "Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.",
-      "Name": "Audit Logs Monitoring and Response",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.8",
-                "8.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "1.6.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.3",
-                "27002: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-6",
-                "AU-6(1)",
-                "AU-6(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-3",
-                "PR.PT-1",
-                "RS.AN-1",
-                "RS.CO-1.",
-                "DE.AE-1",
-                "DE.AE-5",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6",
-                "10.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.1.1",
-                "10.4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "sls_unauthorized_api_calls_alert_enabled",
-        "sls_root_account_usage_alert_enabled",
-        "sls_management_console_signin_without_mfa_alert_enabled",
-        "sls_ram_role_changes_alert_enabled",
-        "sls_security_group_changes_alert_enabled",
-        "sls_vpc_changes_alert_enabled",
-        "sls_vpc_network_route_changes_alert_enabled",
-        "sls_management_console_authentication_failures_alert_enabled",
-        "sls_customer_created_cmk_changes_alert_enabled",
-        "sls_oss_bucket_policy_changes_alert_enabled",
-        "sls_oss_permission_changes_alert_enabled",
-        "sls_cloud_firewall_changes_alert_enabled",
-        "sls_rds_instance_configuration_changes_alert_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-07",
-      "Description": "Establish, document and implement which information meta/data system events should be logged. Review and update the scope at least annually or whenever there is a change in the threat environment.",
-      "Name": "Logging Scope",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-14",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.SC-4",
-                "PR.PT-1",
-                "ID.GV-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "actiontrail_multi_region_enabled",
-        "vpc_flow_logs_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-08",
-      "Description": "Generate audit records containing relevant security information.",
-      "Name": "Log Records",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-3",
-                "AU-3(1)",
-                "AU-3(3)",
-                "AU-6",
-                "AU-6(8)",
-                "AU-12",
-                "AU-12(1)",
-                "AU-12(2)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-6",
-                "DE.CM-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "actiontrail_multi_region_enabled",
-        "vpc_flow_logs_enabled",
-        "oss_bucket_logging_enabled",
-        "rds_instance_sql_audit_enabled",
-        "cs_kubernetes_log_service_enabled",
-        "rds_instance_postgresql_log_connections_enabled",
-        "rds_instance_postgresql_log_disconnections_enabled",
-        "rds_instance_postgresql_log_duration_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-09",
-      "Description": "The information system protects audit records from unauthorized access, modification, and deletion.",
-      "Name": "Log Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04",
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(2)",
-                "AU-9(3)",
-                "AU-9(4)",
-                "AU-12(3)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "actiontrail_oss_bucket_not_publicly_accessible"
-      ]
-    },
-    {
-      "Id": "LOG-10",
-      "Description": "Establish and maintain a monitoring and internal reporting capability over the operations of cryptographic, encryption and key management policies, processes, procedures, and controls.",
-      "Name": "Encryption Monitoring and Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.1.1",
-                "10.2.1",
-                "10.4.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "sls_customer_created_cmk_changes_alert_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-11",
-      "Description": "Log and monitor key lifecycle management events to enable auditing and reporting on usage of cryptographic keys.",
-      "Name": "Transaction/Activity Logging",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "actiontrail_multi_region_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the reporting of anomalies and failures of the monitoring system and provide immediate notification to the accountable party.",
-      "Name": "Failures and Anomalies Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.16.1.2",
-                "27017: 16.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.24",
-                "27001: A.6.8",
-                "27002: 6.8 (g)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-6",
-                "AU-6(3)",
-                "AU-6(4)",
-                "AU-6(5)",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-3",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.3",
-                "10.7.1",
-                "10.7.2",
-                "10.7.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_advanced_or_enterprise_edition",
-        "securitycenter_notification_enabled_high_risk"
-      ]
-    },
-    {
-      "Id": "SEF-03",
-      "Description": "'Establish, document, approve, communicate, apply, evaluate and maintain a security incident response plan, which includes but is not limited to: relevant internal departments, impacted CSCs, and other business critical relationships (such as supply-chain) that may be impacted.'",
-      "Name": "Incident Response Plans",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2",
-                "CC7.3",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2",
-                "17.4"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27017: CLD.12.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.5.26",
-                "27002: 5.26 (e,f)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-1",
-                "IR-2",
-                "IR-2(1)-(3)",
-                "IR-3",
-                "IR-3(1)-(3)",
-                "IR-4",
-                "IR-4(1)-(15)",
-                "IR-5",
-                "IR-5(1)",
-                "IR-6",
-                "IR-6(1)-(3)",
-                "IR-7",
-                "IR-7(1)",
-                "IR-7(2)",
-                "IR-8",
-                "IR-8(1)",
-                "IR-9",
-                "IR-9(1)-(4)",
-                "PM-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.CO-1",
-                "RS.CO-4",
-                "ID.AM-6",
-                "ID.GV-2",
-                "ID.SC-5",
-                "PR.IP-9",
-                "PR.IP10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AT-01",
-                "PR.AT-02",
-                "RS.MA-01",
-                "GV.SC-08",
-                "ID.IM-02",
-                "ID.IM-04",
-                "RC.RP-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "12.10.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "SEF-06",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.",
-      "Name": "Event Triage Processes",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.4",
-                "27002: 16.1.4",
-                "27017: 16.1.4",
-                "27018: 16.1.4",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.25"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(3)",
-                "CA-7(4)",
-                "CA-7(5)",
-                "CA-7(6)",
-                "IR-4",
-                "IR-4(1)",
-                "IR-4(3)",
-                "IR-4(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-4",
-                "RS.RP-1",
-                "RS.AN-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "RS.MA-02",
-                "RS.MA-03",
-                "RS.AN-03",
-                "DE.AE-02",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "RS.MI-02",
-                "RC.RP-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_advanced_or_enterprise_edition"
-      ]
-    },
-    {
-      "Id": "SEF-08",
-      "Description": "Maintain points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities.",
-      "Name": "Points of Contact Maintenance",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.2",
-                "27001: A.6.1.3",
-                "27002: 6.1.3",
-                "27017: 6.1.3",
-                "27018: 6.1.3",
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.18.1.1",
-                "27002: 18.1.1",
-                "27017: 18.1.1",
-                "27018: 18.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.5",
-                "27001: A.5.24",
-                "27002: 5.24 Incident management procedure (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-4",
-                "IR-4(8)",
-                "IR-6",
-                "IR-6(3)",
-                "IR-7",
-                "IR-7(2)",
-                "PM-21",
-                "PM-23",
-                "PM-26"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-2",
-                "RS.CO-3",
-                "RS.CO-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-02",
-                "RS.CO-02",
-                "RS.CO-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "TVM-02",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect against malware on managed assets. Review and update the policies and procedures at least annually.",
-      "Name": "Malware Protection Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.8"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-01",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "9.7",
-                "10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.2",
-                "TS1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.12.2.1",
-                "27001: A.6.2.1",
-                "27002: 6.2.1 (h)",
-                "27001: A.6.2.2",
-                "27002: 6.2.2 (j)",
-                "27001: A.7.2.2",
-                "27002: 7.2.2 (d)",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (g)",
-                "27001: A.13.2.1",
-                "27002: 13.2.1 (b)",
-                "27001: A.15.1.2",
-                "27017: 15.1.2",
-                "27001: A.12.2.1",
-                "27002: 12.2.1 (a),(d)",
-                "27017: CLD.9.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.7",
-                "27001: A.5.37",
-                "27001: A.8.7",
-                "27002: 5.7 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-3",
-                "RA-3(3)",
-                "RA-5",
-                "RA-5(3)",
-                "RA-5(5)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "DE.CM-4",
-                "DE.CM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "DE.CM-01",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.4",
-                "12.1",
-                "12.1.1",
-                "12.3.1",
-                "12.5.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.1.1",
-                "12.1.2",
-                "5.1.1",
-                "5.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ecs_instance_endpoint_protection_installed"
-      ]
-    },
-    {
-      "Id": "TVM-03",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.",
-      "Name": "Vulnerability Remediation Schedule",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC7.1",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.2",
-                "7.7",
-                "17.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "TM2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.2.1",
-                "27001: A.12.6.1",
-                "27002: 12.6.1(c)(d)(j)",
-                "27018: 12.6.1(k)(i)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.8.7",
-                "27001: A.8.8",
-                "27001: A.8.32",
-                "27002: 8.7",
-                "27002: 8.8",
-                "27002: 8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-31",
-                "RA-3",
-                "RA-3(1)",
-                "RA-5",
-                "RA-5(2)-(4)",
-                "RA-5(6)",
-                "SI-3",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.AN-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.1.a",
-                "6.1.b"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.1.1",
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ecs_instance_latest_os_patches_applied"
-      ]
-    },
-    {
-      "Id": "TVM-04",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to update detection tools, threat signatures, and indicators of compromise on a weekly, or more frequent basis.",
-      "Name": "Detection Updates",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.3",
-                "TS1.4",
-                "TM1.3",
-                "TM1.4",
-                "IM1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1.1",
-                "27002: 5.1.1 (h)",
-                "27001: A.12.6.1",
-                "27002: 12.6.1 (b),(c)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1",
-                "27001: A.8.8",
-                "27001: A.8.15",
-                "27001: A.8.16",
-                "27002: 5.1",
-                "27002: 5.37",
-                "27002: 8.8",
-                "27002: 8.15 (d)",
-                "27002: 8.16 (d,e)",
-                "27002: 8.31 2nd (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-7",
-                "CM-7(4)",
-                "RA-3",
-                "RA-3(3)",
-                "RA-5(2)",
-                "SA-10",
-                "SA-10(5)",
-                "SA-11",
-                "SA-11(2)",
-                "SI-2",
-                "SI-2(4)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-4",
-                "SI-4(9)",
-                "SI-4(24)",
-                "SI-8",
-                "SI-8(2)",
-                "SI-8(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-02",
-                "ID.RA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.2",
-                "5.2a",
-                "5.2b",
-                "5.2c"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "5.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_advanced_or_enterprise_edition",
-        "securitycenter_vulnerability_scan_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-05",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to identify updates for applications which use third party or open source libraries according to the organization's vulnerability management policy.",
-      "Name": "External Library Vulnerabilities",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "SD2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.6.2",
-                "27002: 12.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A 5.6",
-                "27001: A.8.19",
-                "27001: A.8.8",
-                "27001: A.8.28",
-                "27001: A.8.31",
-                "27002: 5.6 (c)",
-                "27001: 8.19",
-                "27001: 8.8",
-                "27001: 8.28",
-                "27001: 8.31"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(3)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-11(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-03",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.2",
-                "6.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_vulnerability_scan_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-07",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.",
-      "Name": "Vulnerability Identification",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.1",
-                "7.5",
-                "7.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.6",
-                "27001: A.12.6.1",
-                "27002: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.8",
-                "27002: 8.8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(4)",
-                "RA-5(5)",
-                "SA-11",
-                "SA-11(5)",
-                "SA-15(5)",
-                "SC-7",
-                "SC-7(10)",
-                "SI-3(8)",
-                "SI-3(10)",
-                "SI-7",
-                "SI-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.RA-1",
-                "DE.CM-8",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "11.2",
-                "11.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "11.3.2",
-                "11.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securitycenter_vulnerability_scan_enabled",
-        "securitycenter_advanced_or_enterprise_edition"
-      ]
-    },
-    {
-      "Id": "UEM-08",
-      "Description": "Protect information from unauthorized disclosure on managed endpoint devices with storage encryption.",
-      "Name": "Storage Encryption",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "MOS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "3.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "PA1.2",
-                "PA1.3",
-                "PA1.5",
-                "PA2.2",
-                "PM1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.11.2.7",
-                "27002: 11.2.7",
-                "27001: A.18.1.1",
-                "27017: 18.1.1",
-                "27001: A.12.3.1",
-                "27017: 12.3.1",
-                "27018: A.11.4",
-                "27018: A.11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.1",
-                "27002: 8.1 (h)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.4",
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.5.1",
-                "3.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ecs_attached_disk_encrypted",
-        "ecs_unattached_disk_encrypted"
-      ]
-    },
-    {
-      "Id": "UEM-11",
-      "Description": "Configure managed endpoints with Data Loss Prevention (DLP) technologies and rules in accordance with a risk assessment.",
-      "Name": "Data Loss Prevention",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.5",
-                "PA2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27002: 12.3",
-                "27001: A.8.3.1",
-                "27002: 8.3.1",
-                "27001: A.12.2",
-                "27002: 12.2",
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001: A.6.1.1",
-                "27017: 6.1.1",
-                "27018: 12.3.1",
-                "27018: 10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-7",
-                "SC-7(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.DS-10",
-                "PR.PS-01",
-                "ID.AM-08",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    }
-  ]
-}
diff --git a/prowler/compliance/aws/aws_foundational_security_best_practices_aws.json b/prowler/compliance/aws/aws_foundational_security_best_practices_aws.json
index a64a421c8a..cea7ad1655 100644
--- a/prowler/compliance/aws/aws_foundational_security_best_practices_aws.json
+++ b/prowler/compliance/aws/aws_foundational_security_best_practices_aws.json
@@ -1863,7 +1863,9 @@
       "Id": "ELB.4",
       "Name": "Application load balancers should be configured to drop HTTP headers",
       "Description": "This control evaluates AWS Application Load Balancers (ALB) to ensure they are configured to drop invalid HTTP headers. The control fails if the value of routing.http.drop_invalid_header_fields.enabled is set to false. By default, ALBs are not configured to drop invalid HTTP header values. Removing these header values prevents HTTP desync attacks.",
-      "Checks": [],
+      "Checks": [
+        "elbv2_alb_drop_invalid_header_fields_enabled"
+      ],
       "Attributes": [
         {
           "ItemId": "ELB.4",
diff --git a/prowler/compliance/aws/csa_ccm_4.0_aws.json b/prowler/compliance/aws/csa_ccm_4.0_aws.json
deleted file mode 100644
index 98d87112c9..0000000000
--- a/prowler/compliance/aws/csa_ccm_4.0_aws.json
+++ /dev/null
@@ -1,7617 +0,0 @@
-{
-  "Framework": "CSA-CCM",
-  "Name": "CSA Cloud Controls Matrix (CCM) v4.0.13",
-  "Version": "4.0",
-  "Provider": "AWS",
-  "Description": "The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing, composed of 197 control objectives structured in 17 domains covering all key aspects of cloud technology. The CCM can be used as a tool for the systematic assessment of a cloud implementation, and provides guidance on which security controls should be implemented by which actor within the cloud supply chain.",
-  "Requirements": [
-    {
-      "Id": "A&A-02",
-      "Description": "Conduct independent audit and assurance assessments according to relevant standards at least annually.",
-      "Name": "Independent Assessments",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC4.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AAC-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.2",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.2.1",
-                "27002: 18.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.35",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-2",
-                "CA-2(1)",
-                "CA-2(2)",
-                "CA-7",
-                "CA-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securityhub_enabled"
-      ]
-    },
-    {
-      "Id": "A&A-04",
-      "Description": "Verify compliance with all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit.",
-      "Name": "Requirements Compliance",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01",
-                "GRM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.18.2.2",
-                "27002: 18.2.2",
-                "27001: A.18.2.3",
-                "27002: 18.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-3",
-                "DE.DP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securityhub_enabled",
-        "config_recorder_all_regions_enabled"
-      ]
-    },
-    {
-      "Id": "AIS-04",
-      "Description": "Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.",
-      "Name": "Secure Application Design and Development",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27017: 14.1.1",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.14.2.1",
-                "27002: 14.2.1",
-                "27017: 14.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.8",
-                "27001: A.8.25",
-                "27001: A.8.26",
-                "27001: A.8.28"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PL-8",
-                "PL-8(1)",
-                "SA-3",
-                "SA-3(1)",
-                "SA-4",
-                "SA-4(2)",
-                "SA-4(3)",
-                "SA-4(8)",
-                "SA-4(9)",
-                "SA-5",
-                "SA-8",
-                "SA-8(1)-(7)",
-                "SA-8(9)-(13)",
-                "SA-8(15)-(20)",
-                "SA-8(22)",
-                "SA-8(24)-(28)",
-                "SA-8(30)-(33)",
-                "SA-17",
-                "SA-17(1)-(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-6",
-                "PR.DS-7",
-                "PR.IP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1",
-                "6.2.3",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "codebuild_project_source_repo_url_no_sensitive_credentials",
-        "codebuild_project_no_secrets_in_variables"
-      ]
-    },
-    {
-      "Id": "AIS-05",
-      "Description": "Implement a testing strategy, including criteria for acceptance of new information systems, upgrades and new versions, which provides application security assurance and maintains compliance while enabling organizational speed of delivery goals. Automate when applicable and possible.",
-      "Name": "Automated Application Security Testing",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.12",
-                "16.13"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.3",
-                "SD2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.8",
-                "27001: A.14.2.9",
-                "27001: A.12.1.2",
-                "27002: 12.1.2",
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.25",
-                "27001: A.8.29",
-                "27001: A.8.32",
-                "27002: 8.25 (e)",
-                "27002: 8.32 (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SA-11",
-                "SA-11(1)-(9)",
-                "SI-6",
-                "SI-6(2)",
-                "SI-6(3)",
-                "SI-10",
-                "SI-10(1)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.IP-12",
-                "DE.CM-8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "PR.PS-01",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A.3.2.2",
-                "A.3.2.2.1",
-                "6.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.4",
-                "6.4.1",
-                "6.4.2",
-                "6.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "inspector2_is_enabled",
-        "ecr_repositories_scan_vulnerabilities_in_latest_image",
-        "ecr_registry_scan_images_on_push_enabled"
-      ]
-    },
-    {
-      "Id": "AIS-07",
-      "Description": "Define and implement a process to remediate application security vulnerabilities, automating remediation when possible.",
-      "Name": "Application Vulnerability Remediation",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1",
-                "CC7.4",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.2",
-                "16.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27001: A.12.6.1",
-                "27002: 12.6.1",
-                "27017: 12.6.1",
-                "27018: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27002: 5.26 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-2",
-                "SI-2(2)-(6)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-15",
-                "SA-15(1)-(3)",
-                "SA-15(5)-(8)",
-                "SA-15(10)-(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.IP-12",
-                "DE.CM-8",
-                "RS.AN-5",
-                "RS.MI-3",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.2",
-                "6.5",
-                "6.5.1-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "11.3.1",
-                "11.3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "inspector2_is_enabled",
-        "inspector2_active_findings_exist"
-      ]
-    },
-    {
-      "Id": "BCR-08",
-      "Description": "Periodically backup data stored in the cloud. Ensure the confidentiality, integrity and availability of the backup, and verify data restoration from backup for resiliency.",
-      "Name": "Backup",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "A1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "11.1",
-                "11.2",
-                "11.3",
-                "11.4",
-                "11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27017: 12.3",
-                "27018: 12.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.13",
-                "27001: A.5.23",
-                "27001: A.5.30",
-                "27002: 8.13",
-                "27002: 5.23 2nd (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-4",
-                "CP-4(4)",
-                "CP-6",
-                "CP-6(1)-(3)",
-                "CP-9",
-                "CP-9(1)",
-                "CP-9(2)",
-                "CP-10",
-                "CP-10(2)",
-                "CP-10(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-4",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-11",
-                "RC.RP-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.5.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "10.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "backup_plans_exist",
-        "backup_vaults_exist",
-        "backup_vaults_encrypted",
-        "backup_recovery_point_encrypted",
-        "dynamodb_tables_pitr_enabled",
-        "dynamodb_table_protected_by_backup_plan",
-        "ec2_ebs_volume_snapshots_exists",
-        "ec2_ebs_volume_protected_by_backup_plan",
-        "efs_have_backup_enabled",
-        "rds_instance_backup_enabled",
-        "rds_instance_protected_by_backup_plan",
-        "rds_cluster_protected_by_backup_plan",
-        "redshift_cluster_automated_snapshot",
-        "s3_bucket_object_versioning",
-        "documentdb_cluster_backup_enabled",
-        "neptune_cluster_backup_enabled",
-        "elasticache_redis_cluster_backup_enabled",
-        "fsx_file_system_copy_tags_to_backups_enabled",
-        "lightsail_instance_automated_snapshots",
-        "dlm_ebs_snapshot_lifecycle_policy_exists"
-      ]
-    },
-    {
-      "Id": "BCR-09",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain a disaster response plan to recover from natural and man-made disasters. Update the plan at least annually or upon significant changes.",
-      "Name": "Disaster Response Plan",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9",
-                "1.6.1",
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.4",
-                "BC2.1",
-                "BC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.29",
-                "27001: A.5.30",
-                "27002: 5.29",
-                "27002: 5.30"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2(1)",
-                "CP-2(2)",
-                "CP-2(3)",
-                "CP-2(5)",
-                "CP-2(6)",
-                "CP-2(7)",
-                "CP-2(8)",
-                "PE-13",
-                "PE-13(1)",
-                "PE-13(2)",
-                "PE-13(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-9",
-                "PR.IP-10",
-                "RC.IM-1",
-                "RC.IM-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "drs_job_exist",
-        "ssmincidents_enabled_with_plans"
-      ]
-    },
-    {
-      "Id": "BCR-11",
-      "Description": "Supplement business-critical equipment with redundant equipment independently located at a reasonable minimum distance in accordance with applicable industry standards.",
-      "Name": "Equipment Redundancy",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-06"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.20",
-                "27001: A.7.11",
-                "27001: A.8.14",
-                "27002: 5.20 (t)",
-                "27002: 8.14 (c)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "CP-4(3)",
-                "CP-6",
-                "CP-6(1)",
-                "CP-7",
-                "CP-8",
-                "CP-8(1)-(3)",
-                "CP-9",
-                "CP-9(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.BE-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.OC-04",
-                "GV.OC-05",
-                "PR.IR-03"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "rds_instance_multi_az",
-        "rds_cluster_multi_az",
-        "elbv2_is_in_multiple_az",
-        "elb_is_in_multiple_az",
-        "autoscaling_group_multiple_az",
-        "autoscaling_group_multiple_instance_types",
-        "ec2_ebs_volume_protected_by_backup_plan",
-        "elasticache_redis_cluster_multi_az_enabled",
-        "elasticache_redis_cluster_automatic_failover_enabled",
-        "opensearch_service_domains_fault_tolerant_data_nodes",
-        "opensearch_service_domains_fault_tolerant_master_nodes",
-        "dynamodb_accelerator_cluster_multi_az",
-        "documentdb_cluster_multi_az_enabled",
-        "neptune_cluster_multi_az",
-        "efs_multi_az_enabled",
-        "vpc_vpn_connection_tunnels_up",
-        "directconnect_connection_redundancy",
-        "directconnect_virtual_interface_redundancy",
-        "networkfirewall_multi_az",
-        "vpc_endpoint_multi_az_enabled",
-        "awslambda_function_vpc_multi_az",
-        "redshift_cluster_multi_az_enabled"
-      ]
-    },
-    {
-      "Id": "CCC-04",
-      "Description": "Restrict the unauthorized addition, removal, update, and management of organization assets.",
-      "Name": "Unauthorized Change Protection",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "CCC-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.1",
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4",
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.1.4",
-                "27002: 12.1.4",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27001: A.14.2.2",
-                "27017: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.3",
-                "27001: A.8.4",
-                "27001: A.8.15",
-                "27001: A.8.31",
-                "27001: A.8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(4)",
-                "CM-3",
-                "CM-3(1)",
-                "CM-3(5)",
-                "CM-3(7)",
-                "CM-3(8)",
-                "CM-5",
-                "CM-5(1)",
-                "CM-5(4)",
-                "CM-5(5)",
-                "CM-6",
-                "CM-6(1)",
-                "CM-6(2)",
-                "CM-7",
-                "CM-7(1)",
-                "CM-7(4)",
-                "CM-7(5)",
-                "CM-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.MA-1",
-                "PR.MA-2",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04",
-                "ID.AM-08",
-                "PR.PS-02",
-                "PR.PS-03",
-                "PR.PS-05",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.1",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudtrail_multi_region_enabled",
-        "cloudtrail_log_file_validation_enabled",
-        "s3_bucket_object_lock",
-        "cloudwatch_log_metric_filter_aws_organizations_changes",
-        "servicecatalog_portfolio_shared_within_organization_only"
-      ]
-    },
-    {
-      "Id": "CCC-07",
-      "Description": "Implement detection measures with proactive notification in case of changes deviating from the established baseline.",
-      "Name": "Detection of Baseline Deviation",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.1",
-                "1.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.2",
-                "27001: A.14.2.4",
-                "27001: A.12.4.1",
-                "27002: 12.4.1 (g)",
-                "27001: A.5.1.1",
-                "27017: 5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.9",
-                "27001: A.8.15",
-                "27002: 8.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(2)",
-                "SI-2",
-                "SI-2(2)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.MA-1",
-                "PR.IP-1",
-                "DE.DP-4",
-                "PR.IP-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01",
-                "DE.CM-09",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.3",
-                "6.4.5.4",
-                "11.5",
-                "11.5.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "11.5.2",
-                "11.6.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "config_recorder_all_regions_enabled",
-        "guardduty_is_enabled",
-        "securityhub_enabled",
-        "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled",
-        "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled",
-        "cloudwatch_changes_to_network_acls_alarm_configured",
-        "cloudwatch_changes_to_network_gateways_alarm_configured",
-        "cloudwatch_changes_to_network_route_tables_alarm_configured",
-        "cloudwatch_log_metric_filter_authentication_failures",
-        "cloudwatch_log_metric_filter_aws_organizations_changes",
-        "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk"
-      ]
-    },
-    {
-      "Id": "CEK-03",
-      "Description": "Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.",
-      "Name": "Data Encryption",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-03",
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6",
-                "3.1",
-                "3.11",
-                "11.3",
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.1",
-                "27001: A.18.1.2",
-                "27001: A.18.1.3",
-                "27001: A.18.1.4",
-                "27001: A.18.1.5",
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.18",
-                "27002: 18",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27001: A.14.1.3",
-                "27002 14.1.3 c)",
-                "27001 - A.10.1.1",
-                "27017 - 10.1.1",
-                "27001 - A.10.1.2",
-                "27017 - 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.24",
-                "27002: 8.24 Other Information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19",
-                "AC-19(5)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-8(3)",
-                "SC-8(4)",
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)-(3)",
-                "SI-4",
-                "SI-4(10)",
-                "SI-7",
-                "SI-7(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "Requirement 3",
-                "2.2.3",
-                "2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ec2_ebs_volume_encryption",
-        "ec2_ebs_default_encryption",
-        "ec2_ebs_snapshots_encrypted",
-        "s3_bucket_default_encryption",
-        "s3_bucket_kms_encryption",
-        "s3_bucket_secure_transport_policy",
-        "rds_instance_storage_encrypted",
-        "rds_cluster_storage_encrypted",
-        "rds_instance_transport_encrypted",
-        "rds_snapshots_encrypted",
-        "efs_encryption_at_rest_enabled",
-        "dynamodb_tables_kms_cmk_encryption_enabled",
-        "dynamodb_accelerator_cluster_encryption_enabled",
-        "dynamodb_accelerator_cluster_in_transit_encryption_enabled",
-        "kinesis_stream_encrypted_at_rest",
-        "firehose_stream_encrypted_at_rest",
-        "sns_topics_kms_encryption_at_rest_enabled",
-        "sqs_queues_server_side_encryption_enabled",
-        "cloudtrail_kms_encryption_enabled",
-        "cloudwatch_log_group_kms_encryption_enabled",
-        "opensearch_service_domains_encryption_at_rest_enabled",
-        "opensearch_service_domains_node_to_node_encryption_enabled",
-        "opensearch_service_domains_https_communications_enforced",
-        "redshift_cluster_encrypted_at_rest",
-        "redshift_cluster_in_transit_encryption_enabled",
-        "documentdb_cluster_storage_encrypted",
-        "neptune_cluster_storage_encrypted",
-        "neptune_cluster_snapshot_encrypted",
-        "elasticache_redis_cluster_rest_encryption_enabled",
-        "elasticache_redis_cluster_in_transit_encryption_enabled",
-        "kafka_cluster_in_transit_encryption_enabled",
-        "kafka_cluster_encryption_at_rest_uses_cmk",
-        "kafka_connector_in_transit_encryption_enabled",
-        "dms_endpoint_ssl_enabled",
-        "dms_endpoint_redis_in_transit_encryption_enabled",
-        "elb_ssl_listeners",
-        "elbv2_ssl_listeners",
-        "elbv2_insecure_ssl_ciphers",
-        "elbv2_nlb_tls_termination_enabled",
-        "cloudfront_distributions_https_enabled",
-        "cloudfront_distributions_origin_traffic_encrypted",
-        "cloudfront_distributions_custom_ssl_certificate",
-        "transfer_server_in_transit_encryption_enabled",
-        "sagemaker_notebook_instance_encryption_enabled",
-        "sagemaker_training_jobs_volume_and_output_encryption_enabled",
-        "workspaces_volume_encryption_enabled",
-        "storagegateway_fileshare_encryption_enabled",
-        "backup_vaults_encrypted",
-        "backup_recovery_point_encrypted",
-        "athena_workgroup_encryption",
-        "glue_data_catalogs_connection_passwords_encryption_enabled",
-        "glue_data_catalogs_metadata_encryption_enabled",
-        "glue_etl_jobs_amazon_s3_encryption_enabled",
-        "glue_etl_jobs_cloudwatch_logs_encryption_enabled",
-        "glue_etl_jobs_job_bookmark_encryption_enabled",
-        "glue_development_endpoints_s3_encryption_enabled",
-        "glue_development_endpoints_cloudwatch_logs_encryption_enabled",
-        "glue_development_endpoints_job_bookmark_encryption_enabled",
-        "glue_ml_transform_encrypted_at_rest",
-        "bedrock_model_invocation_logs_encryption_enabled",
-        "bedrock_prompt_encrypted_with_cmk",
-        "codebuild_project_s3_logs_encrypted",
-        "codebuild_report_group_export_encrypted"
-      ]
-    },
-    {
-      "Id": "CEK-04",
-      "Description": "Use encryption algorithms that are appropriate for data protection, considering the classification of data, associated risks, and usability of the encryption technology.",
-      "Name": "Encryption Algorithm",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.2",
-                "27002: 8.2",
-                "27001: A.8.3",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (b)",
-                "27001: A.10.1.2",
-                "27002: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.24",
-                "27001: A.5.12",
-                "27001: A.5.13",
-                "27002: 8.24 General (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A2",
-                "Requirement 3",
-                "2.3",
-                "2.2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "acm_certificates_with_secure_key_algorithms",
-        "elb_insecure_ssl_ciphers",
-        "elbv2_insecure_ssl_ciphers",
-        "cloudfront_distributions_using_deprecated_ssl_protocols"
-      ]
-    },
-    {
-      "Id": "CEK-08",
-      "Description": "CSPs must provide the capability for CSCs to manage their own data encryption keys.",
-      "Name": "CSC Key Management Capability",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27017: 10.1",
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.23",
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-9",
-                "CP-9(8)",
-                "SA-9",
-                "SA-9(6)",
-                "SC-12",
-                "SC-12(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.AM-6",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-05"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "kms_cmk_are_used",
-        "s3_bucket_kms_encryption",
-        "dynamodb_tables_kms_cmk_encryption_enabled",
-        "kms_key_not_publicly_accessible",
-        "kms_cmk_not_multi_region"
-      ]
-    },
-    {
-      "Id": "CEK-10",
-      "Description": "Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.",
-      "Name": "Key Generation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "TS2.3",
-                "SY1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (e)",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2",
-                "27002: 10.1.2 (a)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24",
-                "27002: 8.24 (d), Key management (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2.3",
-                "3.6.1",
-                "PCI Glossary - Cryptographic Key Generation"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.6.1.1",
-                "3.7.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "kms_cmk_are_used"
-      ]
-    },
-    {
-      "Id": "CEK-12",
-      "Description": "Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.",
-      "Name": "Key Rotation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 e)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (e,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "kms_cmk_rotation_enabled",
-        "iam_rotate_access_key_90_days",
-        "secretsmanager_automatic_rotation_enabled",
-        "secretsmanager_secret_rotated_periodically"
-      ]
-    },
-    {
-      "Id": "CEK-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to destroy keys stored outside a secure environment and revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, which include provisions for legal and regulatory requirements.",
-      "Name": "Key Destruction",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27017: 10.1.2",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 (j)",
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (j,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.IP-6",
-                "ID.GV-3",
-                "PR.DS-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "ID.AM-08",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.6.4",
-                "3.6.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "kms_cmk_not_deleted_unintentionally"
-      ]
-    },
-    {
-      "Id": "DCS-06",
-      "Description": "Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.",
-      "Name": "Assets Cataloguing and Tracking",
-      "Attributes": [
-        {
-          "Section": "Datacenter Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DCS - 01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "1.1",
-                "2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27017: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-8",
-                "CM-8(1)",
-                "CM-8(2)",
-                "CM-8(4)",
-                "CM-8(7)",
-                "CM-8(8)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4",
-                "9.7.1",
-                "9.9.1",
-                "9.9.1.a",
-                "9.9.1.b",
-                "9.9.1.c",
-                "12.3.3",
-                "12.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1.1",
-                "6.3.2",
-                "9.4.2",
-                "9.4.3",
-                "12.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "config_recorder_all_regions_enabled",
-        "resourceexplorer2_indexes_found"
-      ]
-    },
-    {
-      "Id": "DSP-02",
-      "Description": "Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.",
-      "Name": "Secure Disposal",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3",
-                "CC6.4",
-                "CC6.5",
-                "CC6.7",
-                "P4.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-07"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.3",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.3.2",
-                "27002: 8.3.2",
-                "27001: A.11.2.7",
-                "27002: 11.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.7.10",
-                "27001: A.7.14",
-                "27001: A.8.10",
-                "27002: 7.10 (Secure reuse or disposal)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-22",
-                "SI-12",
-                "SI-12(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-10",
-                "PR.PS-02",
-                "PR.PS-03",
-                "ID.AM-08"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1",
-                "9.8",
-                "9.8.1",
-                "9.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "3.7.5",
-                "9.4.7"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "s3_bucket_lifecycle_enabled",
-        "dlm_ebs_snapshot_lifecycle_policy_exists",
-        "ecr_repositories_lifecycle_policy_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-03",
-      "Description": "Create and maintain a data inventory, at least for any sensitive data and personal data.",
-      "Name": "Data Inventory",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2",
-                "1.3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-12",
-                "CM-12(1)",
-                "PM-5",
-                "PM-5(1)",
-                "SI-12",
-                "SI-12(1)",
-                "SI-19",
-                "SI-19(1)",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "9.4.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "macie_is_enabled",
-        "macie_automated_sensitive_data_discovery_enabled",
-        "config_recorder_all_regions_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-04",
-      "Description": "Classify data according to its type and sensitivity level.",
-      "Name": "Data Classification",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "C1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.2.1",
-                "27002: 8.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-16",
-                "AC-16(9)",
-                "PM-22",
-                "PM-23",
-                "PT-2",
-                "PT-2(1)",
-                "SI-18",
-                "SI-18(2)",
-                "SI-19",
-                "SI-19(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-05",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "9.4.2",
-                "9.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "macie_is_enabled",
-        "macie_automated_sensitive_data_discovery_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-07",
-      "Description": "Develop systems, products, and business practices based upon a principle of security by design and industry best practices.",
-      "Name": "Data Protection by Design and Default",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "PI1.2",
-                "PI1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.1",
-                "5.3.2",
-                "5.3.3",
-                "5.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.2",
-                "IM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002:14.1.1",
-                "27001: A.14.2.5",
-                "27002:14.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.27",
-                "27001: A.8.28",
-                "27001: A.8.29",
-                "27002: 5.8 (Information security requirements a-i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-17",
-                "PM-24",
-                "PM-25",
-                "PT-2",
-                "PT-2(2)",
-                "SA-3",
-                "SA-4",
-                "SA-5",
-                "SA-8",
-                "SA-8(9)",
-                "SA-8(13)",
-                "SA-8(18)",
-                "SA-8(20)",
-                "SA-8(22)",
-                "SA-8(23)",
-                "SA-8(33)",
-                "SA-15",
-                "SA-15(12)",
-                "SC-3",
-                "SC-3(3)",
-                "SC-7",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(4)",
-                "SC-28",
-                "SC-28(1)",
-                "SI-12",
-                "SI-12(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ec2_ebs_default_encryption",
-        "s3_account_level_public_access_blocks",
-        "s3_bucket_level_public_access_block",
-        "ec2_ebs_snapshot_account_block_public_access",
-        "rds_instance_no_public_access",
-        "rds_snapshots_public_access"
-      ]
-    },
-    {
-      "Id": "DSP-10",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.",
-      "Name": "Sensitive Data Transfer",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.12",
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "9.5.1",
-                "9.5.2",
-                "9.5.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.8.3.3",
-                "27002: 8.3.3",
-                "27001: A.13.2.3",
-                "27002: 13.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.7.10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-4",
-                "AC-4(23)-(25)",
-                "CA-3",
-                "CA-3(6)",
-                "CA-6",
-                "CA-6(1)",
-                "CA-6(2)",
-                "SC-4",
-                "SC-4(2)",
-                "SC-7",
-                "SC-7(10)",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-16",
-                "SC-16(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.DS-5",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.IR-01",
-                "ID.AM-03",
-                "GV.OC-03",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "4.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.1.1",
-                "4.2.1",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "s3_bucket_secure_transport_policy",
-        "opensearch_service_domains_https_communications_enforced",
-        "redshift_cluster_in_transit_encryption_enabled",
-        "rds_instance_transport_encrypted",
-        "transfer_server_in_transit_encryption_enabled",
-        "kafka_cluster_mutual_tls_authentication_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-16",
-      "Description": "Data retention, archiving and deletion is managed in accordance with business requirements, applicable laws and regulations.",
-      "Name": "Data Retention and Deletion",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "C1.1",
-                "C1.2",
-                "CC3.1",
-                "P4.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.4",
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.10",
-                "27002: 5.33 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-12",
-                "SI-12(1)-(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)",
-                "SI-19",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-3",
-                "PR.IP-6",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "GV.OC-03",
-                "GV.SC-10",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "s3_bucket_lifecycle_enabled",
-        "cloudwatch_log_group_retention_policy_specific_days_enabled",
-        "kinesis_stream_data_retention_period",
-        "ecr_repositories_lifecycle_policy_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-17",
-      "Description": "Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.",
-      "Name": "Sensitive Data Protection",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSC-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.1",
-                "CC6.1",
-                "CC6.3",
-                "CC6.7",
-                "CC8.1",
-                "C1.1",
-                "P2.0",
-                "P3.0",
-                "P4.0",
-                "P5.0",
-                "P6.0"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.1",
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.3",
-                "9.1.1",
-                "9.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001:A.18.1.4",
-                "27002:18.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.11",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PM-22",
-                "PM-24",
-                "PT-7",
-                "PT-7(1)",
-                "PT-7(2)",
-                "PT-8",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.0 (including all subsections)",
-                "4.0 (including all subsections)"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "s3_account_level_public_access_blocks",
-        "s3_bucket_public_access",
-        "s3_bucket_policy_public_write_access",
-        "ec2_ebs_public_snapshot",
-        "rds_snapshots_public_access",
-        "rds_instance_no_public_access",
-        "ec2_ebs_volume_encryption",
-        "s3_bucket_default_encryption",
-        "rds_instance_storage_encrypted",
-        "secretsmanager_not_publicly_accessible",
-        "macie_is_enabled"
-      ]
-    },
-    {
-      "Id": "GRC-05",
-      "Description": "Develop and implement an Information Security Program, which includes programs for all the relevant domains of the CCM.",
-      "Name": "Information Security Program",
-      "Attributes": [
-        {
-          "Section": "Governance, Risk and Compliance",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "14.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SG2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-1",
-                "PM-3",
-                "PM-14",
-                "PL-2",
-                "PM-18",
-                "PM-31"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.4.1",
-                "A.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.4.1",
-                "A3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "securityhub_enabled",
-        "guardduty_is_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-02",
-      "Description": "Establish, document, approve, communicate, implement, apply, evaluate and maintain strong password policies and procedures. Review and update the policies and procedures at least annually.",
-      "Name": "Strong Password Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-12",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "4.1.2",
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1",
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.7.2.2",
-                "27002: 7.2.2",
-                "27001: A.9.2.6",
-                "27002: 9.2.6",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.17",
-                "27001: A.6.3",
-                "27001: A.8.5",
-                "27001: A.5.37"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-3",
-                "AC-3(3)",
-                "AC-12",
-                "AC-12(1)",
-                "IA-2",
-                "IA-2(10)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.AC-1",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.4",
-                "12.1",
-                "12.1.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.1.1",
-                "8.3.8"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_password_policy_minimum_length_14",
-        "iam_password_policy_lowercase",
-        "iam_password_policy_uppercase",
-        "iam_password_policy_number",
-        "iam_password_policy_symbol",
-        "iam_password_policy_reuse_24",
-        "iam_password_policy_expires_passwords_within_90_days_or_less",
-        "cognito_user_pool_password_policy_minimum_length_14",
-        "cognito_user_pool_password_policy_lowercase",
-        "cognito_user_pool_password_policy_uppercase",
-        "cognito_user_pool_password_policy_number",
-        "cognito_user_pool_password_policy_symbol"
-      ]
-    },
-    {
-      "Id": "IAM-03",
-      "Description": "Manage, store, and review the information of system identities, and level of access.",
-      "Name": "Identity Inventory",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-04",
-                "IAM-08",
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27001: A.9.4.1",
-                "27002: 9.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.5.15",
-                "27001: A.5.16",
-                "27001: A.5.18",
-                "27001: A.7.4",
-                "27001: A.8.15",
-                "27001: A.8.2",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "AU-16",
-                "AU-16(1)",
-                "IA-4",
-                "IA-4(8)",
-                "IA-4(9)",
-                "IA-5",
-                "IA-5(5)",
-                "IA-8",
-                "IA-8(4)",
-                "PM-5(1)",
-                "SA-8",
-                "SA-8(22)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-04",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4.a"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_role_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_sagemaker",
-        "iam_user_accesskey_unused",
-        "iam_user_console_access_unused",
-        "iam_user_two_active_access_key"
-      ]
-    },
-    {
-      "Id": "IAM-04",
-      "Description": "Employ the separation of duties principle when implementing information system access.",
-      "Name": "Separation of Duties",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC1.3",
-                "CC5.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.2",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.6.1.2",
-                "27002: 6.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18",
-                "27001: A.5.3",
-                "27001: A.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-6",
-                "AC-6(1)-(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4",
-                "6.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_policy_attached_only_to_group_or_roles",
-        "iam_securityaudit_role_created",
-        "iam_support_role_created"
-      ]
-    },
-    {
-      "Id": "IAM-05",
-      "Description": "Employ the least privilege principle when implementing information system access.",
-      "Name": "Least Privilege",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-06",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.1",
-                "27002: 9.1.1",
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.8.2",
-                "27002:  5.15 (Other information 2nd (a))"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "IA-12",
-                "IA-12(2)",
-                "IA-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1",
-                "7.1.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2",
-                "7.2.5",
-                "7.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_inline_policy_no_wildcard_marketplace_subscribe",
-        "iam_policy_no_wildcard_marketplace_subscribe",
-        "iam_aws_attached_policy_no_administrative_privileges",
-        "iam_customer_attached_policy_no_administrative_privileges",
-        "iam_inline_policy_no_administrative_privileges",
-        "iam_customer_unattached_policy_no_administrative_privileges",
-        "iam_policy_allows_privilege_escalation",
-        "iam_inline_policy_allows_privilege_escalation",
-        "iam_no_custom_policy_permissive_role_assumption",
-        "iam_role_administratoraccess_policy",
-        "iam_user_administrator_access_policy",
-        "iam_group_administrator_access_policy",
-        "iam_administrator_access_with_mfa"
-      ]
-    },
-    {
-      "Id": "IAM-07",
-      "Description": "De-provision or respectively modify access of movers / leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.",
-      "Name": "User Access Changes and Revocation",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.3",
-                "6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(1)",
-                "AC-2(2)",
-                "AC-2(6)",
-                "AC-2(8)",
-                "AC-3",
-                "AC-3(8)",
-                "AC-6",
-                "AC-6(7)",
-                "AU-10",
-                "AU-10(4)",
-                "AU-16",
-                "AU-16(1)",
-                "CM-7",
-                "CM-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.IP-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-04",
-                "GV.SC-10",
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.5",
-                "8.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_role_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_sagemaker",
-        "iam_user_accesskey_unused",
-        "iam_user_console_access_unused",
-        "iam_user_no_setup_initial_access_key"
-      ]
-    },
-    {
-      "Id": "IAM-08",
-      "Description": "Review and revalidate user access for least privilege and separation of duties with a frequency that is commensurate with organizational risk tolerance.",
-      "Name": "User Access Review",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27001: A.9.2.6",
-                "27001: A.9.4.1",
-                "27017: 9.4.1",
-                "27001: A.6.1.2",
-                "27001: A 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.3",
-                "27001: A.5.18",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5.1",
-                "7.2.5",
-                "7.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_role_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_sagemaker",
-        "iam_user_accesskey_unused",
-        "iam_user_console_access_unused",
-        "iam_rotate_access_key_90_days",
-        "secretsmanager_secret_unused"
-      ]
-    },
-    {
-      "Id": "IAM-09",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the segregation of privileged access roles such that administrative access to data, encryption and key management capabilities and logging capabilities are distinct and separated.",
-      "Name": "Segregation of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.1",
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-3(7)",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-5",
-                "IA-5(6)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.3",
-                "3.5.2",
-                "7.1.2",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.7.6",
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_policy_attached_only_to_group_or_roles",
-        "iam_role_administratoraccess_policy",
-        "iam_avoid_root_usage",
-        "iam_no_root_access_key"
-      ]
-    },
-    {
-      "Id": "IAM-10",
-      "Description": "Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access.",
-      "Name": "Management of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "6.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3",
-                "27001: A.9.4.4",
-                "27002: 9.4.4",
-                "27017: 9.4.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(7)",
-                "AC-3",
-                "AC-3(4)",
-                "AC-3(11)",
-                "AC-3(13)",
-                "AC-3(14)",
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(5)",
-                "AC-6(8)",
-                "AC-12",
-                "AC-12(3)",
-                "AC-17",
-                "AC-17(4)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_avoid_root_usage",
-        "iam_no_root_access_key",
-        "iam_role_cross_account_readonlyaccess_policy",
-        "iam_role_cross_service_confused_deputy_prevention",
-        "iam_inline_policy_allows_privilege_escalation",
-        "iam_policy_allows_privilege_escalation"
-      ]
-    },
-    {
-      "Id": "IAM-12",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the logging infrastructure is read-only for all with write access, including privileged access roles, and that the ability to disable it is controlled through a procedure that ensures the segregation of duties and break glass procedures.",
-      "Name": "Safeguard Logs Integrity",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1",
-                "27018: 12.4.1",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27017: 12.4.2",
-                "27018: 12.4.2",
-                "27001: A.12.4.3",
-                "27002: 12.4.3",
-                "27017: 12.4.3",
-                "27018: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.18",
-                "27002: 8.15 Protection of Logs"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(11)",
-                "AC-2(12)",
-                "IA-8",
-                "IA-8(4)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-34",
-                "SC-34(1)",
-                "SC-34(2)",
-                "SC-36",
-                "SI-4",
-                "SI-4(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudtrail_log_file_validation_enabled",
-        "cloudtrail_logs_s3_bucket_is_not_publicly_accessible",
-        "cloudtrail_logs_s3_bucket_access_logging_enabled",
-        "cloudtrail_kms_encryption_enabled",
-        "cloudtrail_bucket_requires_mfa_delete"
-      ]
-    },
-    {
-      "Id": "IAM-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure users are identifiable through unique IDs or which can associate individuals to the usage of user IDs.",
-      "Name": "Uniquely Identifiable Users",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.1",
-                "27002: 9.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(14)",
-                "AC-24",
-                "AC-24(2)",
-                "AU-10",
-                "AU-10(1)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-4",
-                "IA-4(1)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-23",
-                "SC-23(3)",
-                "SC-40(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1",
-                "8.2",
-                "8.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.1",
-                "8.2.2",
-                "8.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_user_mfa_enabled_console_access",
-        "iam_check_saml_providers_sts"
-      ]
-    },
-    {
-      "Id": "IAM-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for authenticating access to systems, application and data assets, including multifactor authentication for at least privileged user and sensitive data access. Adopt digital certificates or alternatives which achieve an equivalent level of security for system identities.",
-      "Name": "Strong Authentication",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.3",
-                "6.5",
-                "12.5",
-                "12.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4",
-                "SA1.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27017: 9.1.2",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.9.4.2",
-                "27002: 9.4.2",
-                "27017: 9.4.2",
-                "27018: 9.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.17",
-                "27001: A.8.5",
-                "27001: A.8.24",
-                "27002: 8.5",
-                "27002: 8.24 other information (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(5)",
-                "AC-7",
-                "AC-7(4)",
-                "AU-10",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(8)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5",
-                "IA-5(2)",
-                "IA-5(7)",
-                "IA-5(9)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-5(14)-(16)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(6)",
-                "SC-23",
-                "SC-23(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3",
-                "8.1.6",
-                "8.2",
-                "8.3",
-                "8.3.2",
-                "12.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "8.3.1",
-                "8.3.2",
-                "8.4.1",
-                "8.4.2",
-                "8.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_root_mfa_enabled",
-        "iam_root_hardware_mfa_enabled",
-        "iam_user_mfa_enabled_console_access",
-        "iam_user_hardware_mfa_enabled",
-        "cognito_user_pool_mfa_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-15",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the secure management of passwords.",
-      "Name": "Passwords Management",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27018: 9.2.4",
-                "27001: A.9.3.1",
-                "27002: 9.3.1",
-                "27017: 9.3.1",
-                "27018: 9.3.1",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.17"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IA-4",
-                "IA-4(8)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(8)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.2",
-                "8.2.1-6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.2",
-                "2.3.1",
-                "8.3.5",
-                "8.3.6",
-                "8.3.7",
-                "8.3.8",
-                "8.3.9",
-                "8.3.10",
-                "8.3.10.1",
-                "8.6.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_password_policy_minimum_length_14",
-        "iam_password_policy_reuse_24",
-        "iam_password_policy_expires_passwords_within_90_days_or_less",
-        "cognito_user_pool_password_policy_minimum_length_14",
-        "cognito_user_pool_temporary_password_expiration"
-      ]
-    },
-    {
-      "Id": "IAM-16",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.",
-      "Name": "Authorization Mechanisms",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27002: 9.2.5",
-                "27017: 9.2.5",
-                "27018: 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(5)",
-                "AC-4",
-                "AC-4(17)",
-                "AC-4(21)",
-                "AC-4(22)",
-                "AC-6",
-                "AC-6(8)",
-                "AC-6(9)",
-                "AC-12",
-                "AC-12(1)",
-                "AC-20",
-                "AC-20(1)",
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5(1)",
-                "IA-5(2)",
-                "IA-5(5)",
-                "IA-5(8)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.AC-6",
-                "PR.AC-7",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03",
-                "PR.AA-04",
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.3",
-                "7.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.4",
-                "7.2.3",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_aws_attached_policy_no_administrative_privileges",
-        "iam_customer_attached_policy_no_administrative_privileges",
-        "iam_inline_policy_no_administrative_privileges",
-        "apigateway_restapi_authorizers_enabled",
-        "apigatewayv2_api_authorizers_enabled",
-        "awslambda_function_not_publicly_accessible",
-        "awslambda_function_url_public",
-        "cognito_user_pool_waf_acl_attached"
-      ]
-    },
-    {
-      "Id": "IPY-03",
-      "Description": "Implement cryptographically secure and standardized network protocols for the management, import and export of data.",
-      "Name": "Secure Interoperability and Portability Management",
-      "Attributes": [
-        {
-          "Section": "Interoperability & Portability",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IPY-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.2",
-                "NC1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1",
-                "27001: A.15.1.1",
-                "27002: 15.1.1",
-                "27017: 15.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.19",
-                "27001: A.5.23",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PT-2",
-                "PT-2(2)",
-                "SA-4",
-                "SC-16",
-                "SC-16(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.1",
-                "1.2.5",
-                "1.2.6",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "s3_bucket_secure_transport_policy"
-      ]
-    },
-    {
-      "Id": "IVS-02",
-      "Description": "Plan and monitor the availability, quality, and adequate capacity of resources in order to deliver the required system performance as determined by the business.",
-      "Name": "Capacity and Resource Planning",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-04"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.3",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.12.1.3",
-                "27002: 12.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.3 (b)",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.8.6",
-                "27001: A.8.14"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "SC-5",
-                "SC-5(2)",
-                "SC-4",
-                "SI-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-04",
-                "GV.OC-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "autoscaling_group_multiple_az",
-        "autoscaling_group_multiple_instance_types"
-      ]
-    },
-    {
-      "Id": "IVS-03",
-      "Description": "Monitor, encrypt and restrict communications between environments to only authenticated and authorized connections, as justified by the business. Review these configurations at least annually, and support them by a documented justification of all allowed services, protocols, ports, and compensating controls.",
-      "Name": "Network Security",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-06"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.8",
-                "3.1",
-                "12.2",
-                "13.6",
-                "13.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: A.5.15 2nd c)",
-                "27002: 8.20",
-                "27002: 8.21",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-1",
-                "SC-4",
-                "SC-7",
-                "SC-7(4)",
-                "SC-7(5)",
-                "SC-7(8)",
-                "SC-7(9)",
-                "SC-7(11)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-11",
-                "SC-12",
-                "SC-16",
-                "SC-23",
-                "SC-29",
-                "SC-29(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-5",
-                "PR.AC-7",
-                "PR.PT-4",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-01",
-                "PR.AA-03",
-                "PR.AA-05",
-                "DE.CM-01",
-                "PR.DS-02",
-                "ID.AM-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "1.1.6",
-                "1.2",
-                "1.2.3",
-                "2.2",
-                "4.1.1",
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.5",
-                "1.2.6",
-                "1.2.7",
-                "1.4.2",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1",
-                "10.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "vpc_flow_logs_enabled",
-        "ec2_securitygroup_default_restrict_traffic",
-        "ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
-        "ec2_securitygroup_allow_ingress_from_internet_to_any_port",
-        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
-        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389",
-        "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports",
-        "ec2_networkacl_allow_ingress_any_port",
-        "ec2_networkacl_allow_ingress_tcp_port_22",
-        "ec2_networkacl_allow_ingress_tcp_port_3389",
-        "ec2_securitygroup_allow_wide_open_public_ipv4",
-        "vpc_peering_routing_tables_with_least_privilege",
-        "vpc_subnet_no_public_ip_by_default"
-      ]
-    },
-    {
-      "Id": "IVS-04",
-      "Description": "Harden host and guest OS, hypervisor or infrastructure control plane according to their respective best practices, and supported by technical controls, as part of a security baseline.",
-      "Name": "OS Hardening and Base Controls",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.8",
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-07",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "4.1",
-                "4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.3",
-                "SY1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2",
-                "27001: A.14.2.3",
-                "27001 A.14.2.4",
-                "27018: 12.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: 8.20",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(1)",
-                "SC-29",
-                "SC-29(1)",
-                "SC-2",
-                "SC-7",
-                "SC-7(12)",
-                "SC-30",
-                "SC-34",
-                "SC-35",
-                "SC-39",
-                "SC-44"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-1",
-                "PR.PT-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ec2_instance_imdsv2_enabled",
-        "ec2_instance_account_imdsv2_enabled",
-        "ec2_launch_template_imdsv2_required",
-        "ec2_instance_managed_by_ssm",
-        "ssm_managed_compliant_patching"
-      ]
-    },
-    {
-      "Id": "IVS-06",
-      "Description": "Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.",
-      "Name": "Segmentation and Segregation",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-09"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.3.4",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.20",
-                "27001: A.8.3",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.22",
-                "27002: 5.15 (b)",
-                "27002: 8.3 (b)",
-                "27002: 8.16 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-3",
-                "SC-7",
-                "SC-7(20)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.AC-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.6",
-                "8.3.1",
-                "10.8",
-                "11.3",
-                "A3.2.1",
-                "A3.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A1.1.1",
-                "A1.1.2",
-                "A1.1.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ec2_securitygroup_default_restrict_traffic",
-        "vpc_subnet_separate_private_public",
-        "vpc_peering_routing_tables_with_least_privilege",
-        "ec2_instance_public_ip",
-        "awslambda_function_inside_vpc",
-        "sagemaker_notebook_instance_vpc_settings_configured",
-        "sagemaker_models_vpc_settings_configured",
-        "sagemaker_training_jobs_vpc_settings_configured"
-      ]
-    },
-    {
-      "Id": "IVS-07",
-      "Description": "Use secure and encrypted communication channels when migrating servers, services, applications, or data to cloud environments. Such channels must include only up-to-date and approved protocols.",
-      "Name": "Migration to Cloud Environments",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-10"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM1.4",
-                "NC1.4",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27017: 13.1.1",
-                "27018: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27017: 13.1.2",
-                "27018: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3",
-                "27018: 13.1.3",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27017: 13.2.1",
-                "27018: 13.2.1",
-                "27001: A.13.2.2",
-                "27002: 13.2.2",
-                "27017: 13.2.2",
-                "27018: 13.2.2",
-                "27001: A.13.2.3",
-                "27002: 13.2.3",
-                "27017: 13.2.3",
-                "27018: 13.2.3",
-                "27001: A.13.2.4",
-                "27002: 13.2.4",
-                "27017: 13.2.4",
-                "27018: 13.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.20",
-                "27001: A.8.24",
-                "27002: 8.20 (e)",
-                "27002: 8.24 Guidance (b,f), other information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-17",
-                "AC-20",
-                "SC-7",
-                "SC-7(28)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-12",
-                "SC-23",
-                "SC-29",
-                "SI-7",
-                "SI-7(1)-(3)",
-                "SI-7(5)-(10)",
-                "SI-7(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "dms_endpoint_ssl_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-09",
-      "Description": "Define, implement and evaluate processes, procedures and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.",
-      "Name": "Network Defense",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.6",
-                "CC6.8",
-                "CC7.1",
-                "CC7.2",
-                "CC7.5"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-13"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "13.3",
-                "13.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3",
-                "5.2.4",
-                "5.2.5",
-                "5.2.7",
-                "5.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.11.1.4",
-                "27002: 11.1.4",
-                "27017: 11.1.4",
-                "27018: 16.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.5.24",
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.26",
-                "27002: 8.8 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-8",
-                "PL-8(1)",
-                "SC-5",
-                "SC-5(1)",
-                "SC-5(3)",
-                "SC-7",
-                "SC-7(13)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.DP-1",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.AC-5",
-                "RS.MI-2",
-                "PR.DS-2",
-                "RS.RP-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "DE.CM-01",
-                "PR.IR-01",
-                "RS.MA-01",
-                "RS.MI-01",
-                "RS.MI-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.6",
-                "1.1",
-                "1.2",
-                "1.3",
-                "1.5",
-                "12.10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.3.1",
-                "1.3.2",
-                "1.3.3",
-                "1.4.1",
-                "1.4.2",
-                "1.4.3",
-                "1.4.4",
-                "1.4.5",
-                "1.5.1",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "networkfirewall_in_all_vpc",
-        "networkfirewall_logging_enabled",
-        "networkfirewall_policy_rule_group_associated",
-        "wafv2_webacl_with_rules",
-        "wafv2_webacl_logging_enabled",
-        "elbv2_waf_acl_attached",
-        "cloudfront_distributions_using_waf",
-        "guardduty_is_enabled",
-        "shield_advanced_protection_in_cloudfront_distributions",
-        "shield_advanced_protection_in_internet_facing_load_balancers"
-      ]
-    },
-    {
-      "Id": "LOG-02",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.",
-      "Name": "Audit Logs Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1",
-                "8.9",
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.3",
-                "5.1.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-4",
-                "AU-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-08",
-                "PR.DS-11",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.7"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4",
-                "10.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudtrail_log_file_validation_enabled",
-        "cloudtrail_kms_encryption_enabled",
-        "cloudtrail_logs_s3_bucket_is_not_publicly_accessible",
-        "cloudtrail_logs_s3_bucket_access_logging_enabled",
-        "cloudtrail_bucket_requires_mfa_delete",
-        "cloudwatch_log_group_kms_encryption_enabled",
-        "cloudwatch_log_group_not_publicly_accessible",
-        "s3_bucket_object_lock"
-      ]
-    },
-    {
-      "Id": "LOG-03",
-      "Description": "Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.",
-      "Name": "Security Monitoring and Alerting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03",
-                "SEF-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "5.2.7",
-                "1.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2",
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-3",
-                "DE.AE-5",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-4",
-                "DE.CM-5",
-                "DE.CM-6",
-                "DE.CM-7",
-                "DE.DP-1",
-                "DE.DP-4",
-                "DE.AE-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2",
-                "10.4.1.1",
-                "10.4.2.1",
-                "10.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "guardduty_is_enabled",
-        "securityhub_enabled",
-        "cloudwatch_alarm_actions_enabled",
-        "cloudwatch_alarm_actions_alarm_state_configured",
-        "cloudwatch_log_metric_filter_unauthorized_api_calls",
-        "cloudwatch_log_metric_filter_root_usage",
-        "cloudwatch_log_metric_filter_sign_in_without_mfa"
-      ]
-    },
-    {
-      "Id": "LOG-04",
-      "Description": "Restrict audit logs access to authorized personnel and maintain records that provide unique access accountability.",
-      "Name": "Audit Logs Access and Accountability",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.2",
-                "4.1.3",
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27001: A.12.4.1",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(4)",
-                "AU-9(6)",
-                "AU-10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.1",
-                "10.2.1",
-                "10.2.3",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1.3",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudtrail_logs_s3_bucket_is_not_publicly_accessible",
-        "cloudwatch_log_group_not_publicly_accessible"
-      ]
-    },
-    {
-      "Id": "LOG-05",
-      "Description": "Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.",
-      "Name": "Audit Logs Monitoring and Response",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.8",
-                "8.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "1.6.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.3",
-                "27002: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-6",
-                "AU-6(1)",
-                "AU-6(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-3",
-                "PR.PT-1",
-                "RS.AN-1",
-                "RS.CO-1.",
-                "DE.AE-1",
-                "DE.AE-5",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6",
-                "10.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.1.1",
-                "10.4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudwatch_log_metric_filter_unauthorized_api_calls",
-        "cloudwatch_log_metric_filter_root_usage",
-        "cloudwatch_log_metric_filter_sign_in_without_mfa",
-        "cloudwatch_log_metric_filter_policy_changes",
-        "cloudwatch_log_metric_filter_security_group_changes",
-        "cloudwatch_changes_to_network_acls_alarm_configured",
-        "cloudwatch_changes_to_network_gateways_alarm_configured",
-        "cloudwatch_changes_to_network_route_tables_alarm_configured",
-        "cloudwatch_changes_to_vpcs_alarm_configured",
-        "cloudwatch_log_metric_filter_authentication_failures",
-        "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk",
-        "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes",
-        "cloudwatch_log_metric_filter_aws_organizations_changes",
-        "guardduty_no_high_severity_findings"
-      ]
-    },
-    {
-      "Id": "LOG-07",
-      "Description": "Establish, document and implement which information meta/data system events should be logged. Review and update the scope at least annually or whenever there is a change in the threat environment.",
-      "Name": "Logging Scope",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-14",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.SC-4",
-                "PR.PT-1",
-                "ID.GV-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudtrail_bedrock_logging_enabled",
-        "cloudtrail_multi_region_enabled",
-        "cloudtrail_multi_region_enabled_logging_management_events",
-        "cloudtrail_s3_dataevents_read_enabled",
-        "cloudtrail_s3_dataevents_write_enabled",
-        "vpc_flow_logs_enabled",
-        "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-08",
-      "Description": "Generate audit records containing relevant security information.",
-      "Name": "Log Records",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-3",
-                "AU-3(1)",
-                "AU-3(3)",
-                "AU-6",
-                "AU-6(8)",
-                "AU-12",
-                "AU-12(1)",
-                "AU-12(2)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-6",
-                "DE.CM-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudtrail_multi_region_enabled",
-        "cloudtrail_cloudwatch_logging_enabled",
-        "vpc_flow_logs_enabled",
-        "s3_bucket_server_access_logging_enabled",
-        "elb_logging_enabled",
-        "elbv2_logging_enabled",
-        "cloudfront_distributions_logging_enabled",
-        "route53_public_hosted_zones_cloudwatch_logging_enabled",
-        "wafv2_webacl_logging_enabled",
-        "redshift_cluster_audit_logging",
-        "rds_cluster_integration_cloudwatch_logs",
-        "rds_instance_integration_cloudwatch_logs",
-        "opensearch_service_domains_audit_logging_enabled",
-        "eks_control_plane_logging_all_types_enabled",
-        "apigateway_restapi_logging_enabled",
-        "apigatewayv2_api_access_logging_enabled",
-        "networkfirewall_logging_enabled",
-        "mq_broker_logging_enabled",
-        "documentdb_cluster_cloudwatch_log_export",
-        "neptune_cluster_integration_cloudwatch_logs",
-        "codebuild_project_logging_enabled",
-        "glue_etl_jobs_logging_enabled",
-        "stepfunctions_statemachine_logging_enabled",
-        "datasync_task_logging_enabled",
-        "ec2_client_vpn_endpoint_connection_logging_enabled",
-        "elasticbeanstalk_environment_cloudwatch_logging_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-09",
-      "Description": "The information system protects audit records from unauthorized access, modification, and deletion.",
-      "Name": "Log Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04",
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(2)",
-                "AU-9(3)",
-                "AU-9(4)",
-                "AU-12(3)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudtrail_log_file_validation_enabled",
-        "cloudtrail_kms_encryption_enabled",
-        "cloudtrail_logs_s3_bucket_is_not_publicly_accessible",
-        "cloudwatch_log_group_kms_encryption_enabled",
-        "cloudwatch_log_group_not_publicly_accessible"
-      ]
-    },
-    {
-      "Id": "LOG-10",
-      "Description": "Establish and maintain a monitoring and internal reporting capability over the operations of cryptographic, encryption and key management policies, processes, procedures, and controls.",
-      "Name": "Encryption Monitoring and Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.1.1",
-                "10.2.1",
-                "10.4.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "kms_cmk_rotation_enabled",
-        "acm_certificates_expiration_check"
-      ]
-    },
-    {
-      "Id": "LOG-11",
-      "Description": "Log and monitor key lifecycle management events to enable auditing and reporting on usage of cryptographic keys.",
-      "Name": "Transaction/Activity Logging",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudtrail_s3_dataevents_read_enabled",
-        "cloudtrail_s3_dataevents_write_enabled",
-        "cloudtrail_multi_region_enabled_logging_management_events"
-      ]
-    },
-    {
-      "Id": "LOG-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the reporting of anomalies and failures of the monitoring system and provide immediate notification to the accountable party.",
-      "Name": "Failures and Anomalies Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.16.1.2",
-                "27017: 16.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.24",
-                "27001: A.6.8",
-                "27002: 6.8 (g)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-6",
-                "AU-6(3)",
-                "AU-6(4)",
-                "AU-6(5)",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-3",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.3",
-                "10.7.1",
-                "10.7.2",
-                "10.7.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "guardduty_is_enabled",
-        "guardduty_no_high_severity_findings",
-        "cloudwatch_alarm_actions_enabled",
-        "cloudwatch_alarm_actions_alarm_state_configured"
-      ]
-    },
-    {
-      "Id": "SEF-03",
-      "Description": "'Establish, document, approve, communicate, apply, evaluate and maintain a security incident response plan, which includes but is not limited to: relevant internal departments, impacted CSCs, and other business critical relationships (such as supply-chain) that may be impacted.'",
-      "Name": "Incident Response Plans",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2",
-                "CC7.3",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2",
-                "17.4"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27017: CLD.12.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.5.26",
-                "27002: 5.26 (e,f)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-1",
-                "IR-2",
-                "IR-2(1)-(3)",
-                "IR-3",
-                "IR-3(1)-(3)",
-                "IR-4",
-                "IR-4(1)-(15)",
-                "IR-5",
-                "IR-5(1)",
-                "IR-6",
-                "IR-6(1)-(3)",
-                "IR-7",
-                "IR-7(1)",
-                "IR-7(2)",
-                "IR-8",
-                "IR-8(1)",
-                "IR-9",
-                "IR-9(1)-(4)",
-                "PM-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.CO-1",
-                "RS.CO-4",
-                "ID.AM-6",
-                "ID.GV-2",
-                "ID.SC-5",
-                "PR.IP-9",
-                "PR.IP10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AT-01",
-                "PR.AT-02",
-                "RS.MA-01",
-                "GV.SC-08",
-                "ID.IM-02",
-                "ID.IM-04",
-                "RC.RP-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "12.10.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ssmincidents_enabled_with_plans"
-      ]
-    },
-    {
-      "Id": "SEF-06",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.",
-      "Name": "Event Triage Processes",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.4",
-                "27002: 16.1.4",
-                "27017: 16.1.4",
-                "27018: 16.1.4",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.25"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(3)",
-                "CA-7(4)",
-                "CA-7(5)",
-                "CA-7(6)",
-                "IR-4",
-                "IR-4(1)",
-                "IR-4(3)",
-                "IR-4(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-4",
-                "RS.RP-1",
-                "RS.AN-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "RS.MA-02",
-                "RS.MA-03",
-                "RS.AN-03",
-                "DE.AE-02",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "RS.MI-02",
-                "RC.RP-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "guardduty_is_enabled",
-        "securityhub_enabled"
-      ]
-    },
-    {
-      "Id": "SEF-08",
-      "Description": "Maintain points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities.",
-      "Name": "Points of Contact Maintenance",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.2",
-                "27001: A.6.1.3",
-                "27002: 6.1.3",
-                "27017: 6.1.3",
-                "27018: 6.1.3",
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.18.1.1",
-                "27002: 18.1.1",
-                "27017: 18.1.1",
-                "27018: 18.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.5",
-                "27001: A.5.24",
-                "27002: 5.24 Incident management procedure (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-4",
-                "IR-4(8)",
-                "IR-6",
-                "IR-6(3)",
-                "IR-7",
-                "IR-7(2)",
-                "PM-21",
-                "PM-23",
-                "PM-26"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-2",
-                "RS.CO-3",
-                "RS.CO-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-02",
-                "RS.CO-02",
-                "RS.CO-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "account_maintain_current_contact_details",
-        "account_security_contact_information_is_registered",
-        "account_maintain_different_contact_details_to_security_billing_and_operations"
-      ]
-    },
-    {
-      "Id": "TVM-02",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect against malware on managed assets. Review and update the policies and procedures at least annually.",
-      "Name": "Malware Protection Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.8"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-01",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "9.7",
-                "10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.2",
-                "TS1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.12.2.1",
-                "27001: A.6.2.1",
-                "27002: 6.2.1 (h)",
-                "27001: A.6.2.2",
-                "27002: 6.2.2 (j)",
-                "27001: A.7.2.2",
-                "27002: 7.2.2 (d)",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (g)",
-                "27001: A.13.2.1",
-                "27002: 13.2.1 (b)",
-                "27001: A.15.1.2",
-                "27017: 15.1.2",
-                "27001: A.12.2.1",
-                "27002: 12.2.1 (a),(d)",
-                "27017: CLD.9.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.7",
-                "27001: A.5.37",
-                "27001: A.8.7",
-                "27002: 5.7 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-3",
-                "RA-3(3)",
-                "RA-5",
-                "RA-5(3)",
-                "RA-5(5)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "DE.CM-4",
-                "DE.CM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "DE.CM-01",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.4",
-                "12.1",
-                "12.1.1",
-                "12.3.1",
-                "12.5.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.1.1",
-                "12.1.2",
-                "5.1.1",
-                "5.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "guardduty_ec2_malware_protection_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-03",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.",
-      "Name": "Vulnerability Remediation Schedule",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC7.1",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.2",
-                "7.7",
-                "17.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "TM2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.2.1",
-                "27001: A.12.6.1",
-                "27002: 12.6.1(c)(d)(j)",
-                "27018: 12.6.1(k)(i)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.8.7",
-                "27001: A.8.8",
-                "27001: A.8.32",
-                "27002: 8.7",
-                "27002: 8.8",
-                "27002: 8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-31",
-                "RA-3",
-                "RA-3(1)",
-                "RA-5",
-                "RA-5(2)-(4)",
-                "RA-5(6)",
-                "SI-3",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.AN-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.1.a",
-                "6.1.b"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.1.1",
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ssm_managed_compliant_patching",
-        "rds_instance_minor_version_upgrade_enabled",
-        "rds_cluster_minor_version_upgrade_enabled",
-        "redshift_cluster_automatic_upgrades",
-        "elasticbeanstalk_environment_managed_updates_enabled",
-        "dms_instance_minor_version_upgrade_enabled",
-        "elasticache_redis_cluster_auto_minor_version_upgrades",
-        "memorydb_cluster_auto_minor_version_upgrades",
-        "mq_broker_auto_minor_version_upgrades",
-        "opensearch_service_domains_updated_to_the_latest_service_software_version",
-        "kafka_cluster_uses_latest_version"
-      ]
-    },
-    {
-      "Id": "TVM-04",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to update detection tools, threat signatures, and indicators of compromise on a weekly, or more frequent basis.",
-      "Name": "Detection Updates",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.3",
-                "TS1.4",
-                "TM1.3",
-                "TM1.4",
-                "IM1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1.1",
-                "27002: 5.1.1 (h)",
-                "27001: A.12.6.1",
-                "27002: 12.6.1 (b),(c)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1",
-                "27001: A.8.8",
-                "27001: A.8.15",
-                "27001: A.8.16",
-                "27002: 5.1",
-                "27002: 5.37",
-                "27002: 8.8",
-                "27002: 8.15 (d)",
-                "27002: 8.16 (d,e)",
-                "27002: 8.31 2nd (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-7",
-                "CM-7(4)",
-                "RA-3",
-                "RA-3(3)",
-                "RA-5(2)",
-                "SA-10",
-                "SA-10(5)",
-                "SA-11",
-                "SA-11(2)",
-                "SI-2",
-                "SI-2(4)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-4",
-                "SI-4(9)",
-                "SI-4(24)",
-                "SI-8",
-                "SI-8(2)",
-                "SI-8(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-02",
-                "ID.RA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.2",
-                "5.2a",
-                "5.2b",
-                "5.2c"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "5.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "guardduty_is_enabled",
-        "inspector2_is_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-05",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to identify updates for applications which use third party or open source libraries according to the organization's vulnerability management policy.",
-      "Name": "External Library Vulnerabilities",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "SD2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.6.2",
-                "27002: 12.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A 5.6",
-                "27001: A.8.19",
-                "27001: A.8.8",
-                "27001: A.8.28",
-                "27001: A.8.31",
-                "27002: 5.6 (c)",
-                "27001: 8.19",
-                "27001: 8.8",
-                "27001: 8.28",
-                "27001: 8.31"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(3)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-11(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-03",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.2",
-                "6.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "inspector2_is_enabled",
-        "ecr_repositories_scan_vulnerabilities_in_latest_image",
-        "ecr_registry_scan_images_on_push_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-07",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.",
-      "Name": "Vulnerability Identification",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.1",
-                "7.5",
-                "7.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.6",
-                "27001: A.12.6.1",
-                "27002: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.8",
-                "27002: 8.8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(4)",
-                "RA-5(5)",
-                "SA-11",
-                "SA-11(5)",
-                "SA-15(5)",
-                "SC-7",
-                "SC-7(10)",
-                "SI-3(8)",
-                "SI-3(10)",
-                "SI-7",
-                "SI-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.RA-1",
-                "DE.CM-8",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "11.2",
-                "11.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "11.3.2",
-                "11.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "inspector2_is_enabled",
-        "inspector2_active_findings_exist",
-        "guardduty_is_enabled",
-        "ecr_repositories_scan_vulnerabilities_in_latest_image"
-      ]
-    },
-    {
-      "Id": "UEM-08",
-      "Description": "Protect information from unauthorized disclosure on managed endpoint devices with storage encryption.",
-      "Name": "Storage Encryption",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "MOS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "3.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "PA1.2",
-                "PA1.3",
-                "PA1.5",
-                "PA2.2",
-                "PM1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.11.2.7",
-                "27002: 11.2.7",
-                "27001: A.18.1.1",
-                "27017: 18.1.1",
-                "27001: A.12.3.1",
-                "27017: 12.3.1",
-                "27018: A.11.4",
-                "27018: A.11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.1",
-                "27002: 8.1 (h)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.4",
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.5.1",
-                "3.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "ec2_ebs_volume_encryption",
-        "ec2_ebs_default_encryption",
-        "workspaces_volume_encryption_enabled"
-      ]
-    },
-    {
-      "Id": "UEM-11",
-      "Description": "Configure managed endpoints with Data Loss Prevention (DLP) technologies and rules in accordance with a risk assessment.",
-      "Name": "Data Loss Prevention",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.5",
-                "PA2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27002: 12.3",
-                "27001: A.8.3.1",
-                "27002: 8.3.1",
-                "27001: A.12.2",
-                "27002: 12.2",
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001: A.6.1.1",
-                "27017: 6.1.1",
-                "27018: 12.3.1",
-                "27018: 10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-7",
-                "SC-7(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.DS-10",
-                "PR.PS-01",
-                "ID.AM-08",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "macie_is_enabled",
-        "macie_automated_sensitive_data_discovery_enabled"
-      ]
-    }
-  ]
-}
diff --git a/prowler/compliance/azure/cis_5.0_azure.json b/prowler/compliance/azure/cis_5.0_azure.json
index 21785d92b6..086320fecd 100644
--- a/prowler/compliance/azure/cis_5.0_azure.json
+++ b/prowler/compliance/azure/cis_5.0_azure.json
@@ -2094,7 +2094,9 @@
     {
       "Id": "8.1.1.1",
       "Description": "Ensure Microsoft Defender CSPM is set to 'On'",
-      "Checks": [],
+      "Checks": [
+        "defender_ensure_defender_cspm_is_on"
+      ],
       "Attributes": [
         {
           "Section": "8 Security Services",
diff --git a/prowler/compliance/azure/csa_ccm_4.0_azure.json b/prowler/compliance/azure/csa_ccm_4.0_azure.json
deleted file mode 100644
index b4505ac089..0000000000
--- a/prowler/compliance/azure/csa_ccm_4.0_azure.json
+++ /dev/null
@@ -1,7548 +0,0 @@
-{
-  "Framework": "CSA-CCM",
-  "Name": "CSA Cloud Controls Matrix (CCM) v4.0.13",
-  "Version": "4.0",
-  "Provider": "Azure",
-  "Description": "The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing, composed of 197 control objectives structured in 17 domains covering all key aspects of cloud technology. The CCM can be used as a tool for the systematic assessment of a cloud implementation, and provides guidance on which security controls should be implemented by which actor within the cloud supply chain.",
-  "Requirements": [
-    {
-      "Id": "A&A-02",
-      "Description": "Conduct independent audit and assurance assessments according to relevant standards at least annually.",
-      "Name": "Independent Assessments",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC4.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AAC-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.2",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.2.1",
-                "27002: 18.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.35",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-2",
-                "CA-2(1)",
-                "CA-2(2)",
-                "CA-7",
-                "CA-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_app_services_is_on",
-        "defender_ensure_defender_for_azure_sql_databases_is_on",
-        "defender_ensure_defender_for_databases_is_on",
-        "defender_ensure_defender_for_keyvault_is_on",
-        "defender_ensure_defender_for_server_is_on"
-      ]
-    },
-    {
-      "Id": "A&A-04",
-      "Description": "Verify compliance with all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit.",
-      "Name": "Requirements Compliance",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01",
-                "GRM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.18.2.2",
-                "27002: 18.2.2",
-                "27001: A.18.2.3",
-                "27002: 18.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-3",
-                "DE.DP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_app_services_is_on",
-        "defender_ensure_defender_for_azure_sql_databases_is_on",
-        "defender_ensure_defender_for_databases_is_on",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_mcas_is_enabled",
-        "monitor_diagnostic_settings_exists",
-        "policy_ensure_asc_enforcement_enabled"
-      ]
-    },
-    {
-      "Id": "AIS-04",
-      "Description": "Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.",
-      "Name": "Secure Application Design and Development",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27017: 14.1.1",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.14.2.1",
-                "27002: 14.2.1",
-                "27017: 14.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.8",
-                "27001: A.8.25",
-                "27001: A.8.26",
-                "27001: A.8.28"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PL-8",
-                "PL-8(1)",
-                "SA-3",
-                "SA-3(1)",
-                "SA-4",
-                "SA-4(2)",
-                "SA-4(3)",
-                "SA-4(8)",
-                "SA-4(9)",
-                "SA-5",
-                "SA-8",
-                "SA-8(1)-(7)",
-                "SA-8(9)-(13)",
-                "SA-8(15)-(20)",
-                "SA-8(22)",
-                "SA-8(24)-(28)",
-                "SA-8(30)-(33)",
-                "SA-17",
-                "SA-17(1)-(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-6",
-                "PR.DS-7",
-                "PR.IP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1",
-                "6.2.3",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "app_ensure_auth_is_set_up",
-        "app_ftp_deployment_disabled",
-        "app_function_access_keys_configured",
-        "app_function_ftps_deployment_disabled",
-        "app_register_with_identity"
-      ]
-    },
-    {
-      "Id": "AIS-05",
-      "Description": "Implement a testing strategy, including criteria for acceptance of new information systems, upgrades and new versions, which provides application security assurance and maintains compliance while enabling organizational speed of delivery goals. Automate when applicable and possible.",
-      "Name": "Automated Application Security Testing",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.12",
-                "16.13"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.3",
-                "SD2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.8",
-                "27001: A.14.2.9",
-                "27001: A.12.1.2",
-                "27002: 12.1.2",
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.25",
-                "27001: A.8.29",
-                "27001: A.8.32",
-                "27002: 8.25 (e)",
-                "27002: 8.32 (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SA-11",
-                "SA-11(1)-(9)",
-                "SI-6",
-                "SI-6(2)",
-                "SI-6(3)",
-                "SI-10",
-                "SI-10(1)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.IP-12",
-                "DE.CM-8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "PR.PS-01",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A.3.2.2",
-                "A.3.2.2.1",
-                "6.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.4",
-                "6.4.1",
-                "6.4.2",
-                "6.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
-        "defender_container_images_resolved_vulnerabilities",
-        "defender_container_images_scan_enabled",
-        "defender_ensure_defender_for_containers_is_on",
-        "sqlserver_va_periodic_recurring_scans_enabled",
-        "sqlserver_vulnerability_assessment_enabled"
-      ]
-    },
-    {
-      "Id": "AIS-07",
-      "Description": "Define and implement a process to remediate application security vulnerabilities, automating remediation when possible.",
-      "Name": "Application Vulnerability Remediation",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1",
-                "CC7.4",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.2",
-                "16.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27001: A.12.6.1",
-                "27002: 12.6.1",
-                "27017: 12.6.1",
-                "27018: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27002: 5.26 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-2",
-                "SI-2(2)-(6)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-15",
-                "SA-15(1)-(3)",
-                "SA-15(5)-(8)",
-                "SA-15(10)-(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.IP-12",
-                "DE.CM-8",
-                "RS.AN-5",
-                "RS.MI-3",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.2",
-                "6.5",
-                "6.5.1-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "11.3.1",
-                "11.3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_container_images_resolved_vulnerabilities",
-        "defender_container_images_scan_enabled",
-        "defender_ensure_defender_for_containers_is_on",
-        "sqlserver_va_scan_reports_configured",
-        "sqlserver_vulnerability_assessment_enabled"
-      ]
-    },
-    {
-      "Id": "BCR-08",
-      "Description": "Periodically backup data stored in the cloud. Ensure the confidentiality, integrity and availability of the backup, and verify data restoration from backup for resiliency.",
-      "Name": "Backup",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "A1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "11.1",
-                "11.2",
-                "11.3",
-                "11.4",
-                "11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27017: 12.3",
-                "27018: 12.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.13",
-                "27001: A.5.23",
-                "27001: A.5.30",
-                "27002: 8.13",
-                "27002: 5.23 2nd (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-4",
-                "CP-4(4)",
-                "CP-6",
-                "CP-6(1)-(3)",
-                "CP-9",
-                "CP-9(1)",
-                "CP-9(2)",
-                "CP-10",
-                "CP-10(2)",
-                "CP-10(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-4",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-11",
-                "RC.RP-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.5.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "10.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "storage_ensure_encryption_with_customer_managed_keys",
-        "vm_backup_enabled",
-        "vm_sufficient_daily_backup_retention_period"
-      ]
-    },
-    {
-      "Id": "BCR-09",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain a disaster response plan to recover from natural and man-made disasters. Update the plan at least annually or upon significant changes.",
-      "Name": "Disaster Response Plan",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9",
-                "1.6.1",
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.4",
-                "BC2.1",
-                "BC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.29",
-                "27001: A.5.30",
-                "27002: 5.29",
-                "27002: 5.30"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2(1)",
-                "CP-2(2)",
-                "CP-2(3)",
-                "CP-2(5)",
-                "CP-2(6)",
-                "CP-2(7)",
-                "CP-2(8)",
-                "PE-13",
-                "PE-13(1)",
-                "PE-13(2)",
-                "PE-13(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-9",
-                "PR.IP-10",
-                "RC.IM-1",
-                "RC.IM-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_server_is_on",
-        "vm_backup_enabled"
-      ]
-    },
-    {
-      "Id": "BCR-11",
-      "Description": "Supplement business-critical equipment with redundant equipment independently located at a reasonable minimum distance in accordance with applicable industry standards.",
-      "Name": "Equipment Redundancy",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-06"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.20",
-                "27001: A.7.11",
-                "27001: A.8.14",
-                "27002: 5.20 (t)",
-                "27002: 8.14 (c)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "CP-4(3)",
-                "CP-6",
-                "CP-6(1)",
-                "CP-7",
-                "CP-8",
-                "CP-8(1)-(3)",
-                "CP-9",
-                "CP-9(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.BE-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.OC-04",
-                "GV.OC-05",
-                "PR.IR-03"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "storage_blob_versioning_is_enabled",
-        "storage_geo_redundant_enabled",
-        "vm_scaleset_associated_with_load_balancer",
-        "vm_scaleset_not_empty"
-      ]
-    },
-    {
-      "Id": "CCC-04",
-      "Description": "Restrict the unauthorized addition, removal, update, and management of organization assets.",
-      "Name": "Unauthorized Change Protection",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "CCC-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.1",
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4",
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.1.4",
-                "27002: 12.1.4",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27001: A.14.2.2",
-                "27017: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.3",
-                "27001: A.8.4",
-                "27001: A.8.15",
-                "27001: A.8.31",
-                "27001: A.8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(4)",
-                "CM-3",
-                "CM-3(1)",
-                "CM-3(5)",
-                "CM-3(7)",
-                "CM-3(8)",
-                "CM-5",
-                "CM-5(1)",
-                "CM-5(4)",
-                "CM-5(5)",
-                "CM-6",
-                "CM-6(1)",
-                "CM-6(2)",
-                "CM-7",
-                "CM-7(1)",
-                "CM-7(4)",
-                "CM-7(5)",
-                "CM-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.MA-1",
-                "PR.MA-2",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04",
-                "ID.AM-08",
-                "PR.PS-02",
-                "PR.PS-03",
-                "PR.PS-05",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.1",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_custom_role_has_permissions_to_administer_resource_locks",
-        "monitor_alert_create_policy_assignment",
-        "monitor_diagnostic_setting_with_appropriate_categories",
-        "monitor_diagnostic_settings_exists",
-        "policy_ensure_asc_enforcement_enabled",
-        "storage_ensure_soft_delete_is_enabled"
-      ]
-    },
-    {
-      "Id": "CCC-07",
-      "Description": "Implement detection measures with proactive notification in case of changes deviating from the established baseline.",
-      "Name": "Detection of Baseline Deviation",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.1",
-                "1.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.2",
-                "27001: A.14.2.4",
-                "27001: A.12.4.1",
-                "27002: 12.4.1 (g)",
-                "27001: A.5.1.1",
-                "27017: 5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.9",
-                "27001: A.8.15",
-                "27002: 8.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(2)",
-                "SI-2",
-                "SI-2(2)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.MA-1",
-                "PR.IP-1",
-                "DE.DP-4",
-                "PR.IP-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01",
-                "DE.CM-09",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.3",
-                "6.4.5.4",
-                "11.5",
-                "11.5.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "11.5.2",
-                "11.6.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_app_services_is_on",
-        "defender_ensure_defender_for_azure_sql_databases_is_on",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_wdatp_is_enabled",
-        "monitor_alert_create_policy_assignment",
-        "monitor_alert_create_update_nsg",
-        "monitor_alert_create_update_public_ip_address_rule",
-        "monitor_alert_create_update_security_solution",
-        "monitor_alert_create_update_sqlserver_fr",
-        "monitor_alert_delete_nsg",
-        "monitor_alert_delete_policy_assignment",
-        "monitor_alert_delete_public_ip_address_rule",
-        "monitor_alert_delete_security_solution",
-        "monitor_alert_delete_sqlserver_fr",
-        "monitor_diagnostic_settings_exists",
-        "policy_ensure_asc_enforcement_enabled"
-      ]
-    },
-    {
-      "Id": "CEK-03",
-      "Description": "Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.",
-      "Name": "Data Encryption",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-03",
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6",
-                "3.1",
-                "3.11",
-                "11.3",
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.1",
-                "27001: A.18.1.2",
-                "27001: A.18.1.3",
-                "27001: A.18.1.4",
-                "27001: A.18.1.5",
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.18",
-                "27002: 18",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27001: A.14.1.3",
-                "27002 14.1.3 c)",
-                "27001 - A.10.1.1",
-                "27017 - 10.1.1",
-                "27001 - A.10.1.2",
-                "27017 - 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.24",
-                "27002: 8.24 Other Information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19",
-                "AC-19(5)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-8(3)",
-                "SC-8(4)",
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)-(3)",
-                "SI-4",
-                "SI-4(10)",
-                "SI-7",
-                "SI-7(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "Requirement 3",
-                "2.2.3",
-                "2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "app_minimum_tls_version_12",
-        "databricks_workspace_cmk_encryption_enabled",
-        "mysql_flexible_server_ssl_connection_enabled",
-        "postgresql_flexible_server_enforce_ssl_enabled",
-        "sqlserver_tde_encrypted_with_cmk",
-        "sqlserver_tde_encryption_enabled",
-        "storage_ensure_encryption_with_customer_managed_keys",
-        "storage_infrastructure_encryption_is_enabled",
-        "storage_secure_transfer_required_is_enabled",
-        "storage_smb_channel_encryption_with_secure_algorithm",
-        "vm_ensure_attached_disks_encrypted_with_cmk",
-        "vm_ensure_unattached_disks_encrypted_with_cmk"
-      ]
-    },
-    {
-      "Id": "CEK-04",
-      "Description": "Use encryption algorithms that are appropriate for data protection, considering the classification of data, associated risks, and usability of the encryption technology.",
-      "Name": "Encryption Algorithm",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.2",
-                "27002: 8.2",
-                "27001: A.8.3",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (b)",
-                "27001: A.10.1.2",
-                "27002: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.24",
-                "27001: A.5.12",
-                "27001: A.5.13",
-                "27002: 8.24 General (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A2",
-                "Requirement 3",
-                "2.3",
-                "2.2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "app_minimum_tls_version_12",
-        "keyvault_key_rotation_enabled",
-        "mysql_flexible_server_minimum_tls_version_12",
-        "postgresql_flexible_server_enforce_ssl_enabled",
-        "sqlserver_recommended_minimal_tls_version",
-        "storage_ensure_minimum_tls_version_12",
-        "storage_smb_protocol_version_is_latest"
-      ]
-    },
-    {
-      "Id": "CEK-08",
-      "Description": "CSPs must provide the capability for CSCs to manage their own data encryption keys.",
-      "Name": "CSC Key Management Capability",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27017: 10.1",
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.23",
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-9",
-                "CP-9(8)",
-                "SA-9",
-                "SA-9(6)",
-                "SC-12",
-                "SC-12(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.AM-6",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-05"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "databricks_workspace_cmk_encryption_enabled",
-        "keyvault_access_only_through_private_endpoints",
-        "keyvault_private_endpoints",
-        "keyvault_rbac_enabled",
-        "storage_ensure_encryption_with_customer_managed_keys"
-      ]
-    },
-    {
-      "Id": "CEK-10",
-      "Description": "Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.",
-      "Name": "Key Generation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "TS2.3",
-                "SY1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (e)",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2",
-                "27002: 10.1.2 (a)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24",
-                "27002: 8.24 (d), Key management (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2.3",
-                "3.6.1",
-                "PCI Glossary - Cryptographic Key Generation"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.6.1.1",
-                "3.7.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "keyvault_rbac_enabled",
-        "storage_ensure_encryption_with_customer_managed_keys"
-      ]
-    },
-    {
-      "Id": "CEK-12",
-      "Description": "Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.",
-      "Name": "Key Rotation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 e)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (e,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "keyvault_key_expiration_set_in_non_rbac",
-        "keyvault_key_rotation_enabled",
-        "keyvault_non_rbac_secret_expiration_set",
-        "keyvault_rbac_key_expiration_set",
-        "keyvault_rbac_secret_expiration_set",
-        "storage_key_rotation_90_days"
-      ]
-    },
-    {
-      "Id": "CEK-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to destroy keys stored outside a secure environment and revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, which include provisions for legal and regulatory requirements.",
-      "Name": "Key Destruction",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27017: 10.1.2",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 (j)",
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (j,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.IP-6",
-                "ID.GV-3",
-                "PR.DS-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "ID.AM-08",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.6.4",
-                "3.6.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "keyvault_recoverable"
-      ]
-    },
-    {
-      "Id": "DCS-06",
-      "Description": "Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.",
-      "Name": "Assets Cataloguing and Tracking",
-      "Attributes": [
-        {
-          "Section": "Datacenter Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DCS - 01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "1.1",
-                "2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27017: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-8",
-                "CM-8(1)",
-                "CM-8(2)",
-                "CM-8(4)",
-                "CM-8(7)",
-                "CM-8(8)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4",
-                "9.7.1",
-                "9.9.1",
-                "9.9.1.a",
-                "9.9.1.b",
-                "9.9.1.c",
-                "12.3.3",
-                "12.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1.1",
-                "6.3.2",
-                "9.4.2",
-                "9.4.3",
-                "12.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_mcas_is_enabled",
-        "monitor_diagnostic_settings_exists",
-        "policy_ensure_asc_enforcement_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-02",
-      "Description": "Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.",
-      "Name": "Secure Disposal",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3",
-                "CC6.4",
-                "CC6.5",
-                "CC6.7",
-                "P4.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-07"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.3",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.3.2",
-                "27002: 8.3.2",
-                "27001: A.11.2.7",
-                "27002: 11.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.7.10",
-                "27001: A.7.14",
-                "27001: A.8.10",
-                "27002: 7.10 (Secure reuse or disposal)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-22",
-                "SI-12",
-                "SI-12(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-10",
-                "PR.PS-02",
-                "PR.PS-03",
-                "ID.AM-08"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1",
-                "9.8",
-                "9.8.1",
-                "9.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "3.7.5",
-                "9.4.7"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "storage_ensure_file_shares_soft_delete_is_enabled",
-        "storage_ensure_soft_delete_is_enabled",
-        "vm_sufficient_daily_backup_retention_period"
-      ]
-    },
-    {
-      "Id": "DSP-03",
-      "Description": "Create and maintain a data inventory, at least for any sensitive data and personal data.",
-      "Name": "Data Inventory",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2",
-                "1.3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-12",
-                "CM-12(1)",
-                "PM-5",
-                "PM-5(1)",
-                "SI-12",
-                "SI-12(1)",
-                "SI-19",
-                "SI-19(1)",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "9.4.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_storage_is_on",
-        "defender_ensure_mcas_is_enabled",
-        "monitor_diagnostic_settings_exists",
-        "policy_ensure_asc_enforcement_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-04",
-      "Description": "Classify data according to its type and sensitivity level.",
-      "Name": "Data Classification",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "C1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.2.1",
-                "27002: 8.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-16",
-                "AC-16(9)",
-                "PM-22",
-                "PM-23",
-                "PT-2",
-                "PT-2(1)",
-                "SI-18",
-                "SI-18(2)",
-                "SI-19",
-                "SI-19(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-05",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "9.4.2",
-                "9.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_storage_is_on"
-      ]
-    },
-    {
-      "Id": "DSP-07",
-      "Description": "Develop systems, products, and business practices based upon a principle of security by design and industry best practices.",
-      "Name": "Data Protection by Design and Default",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "PI1.2",
-                "PI1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.1",
-                "5.3.2",
-                "5.3.3",
-                "5.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.2",
-                "IM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002:14.1.1",
-                "27001: A.14.2.5",
-                "27002:14.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.27",
-                "27001: A.8.28",
-                "27001: A.8.29",
-                "27002: 5.8 (Information security requirements a-i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-17",
-                "PM-24",
-                "PM-25",
-                "PT-2",
-                "PT-2(2)",
-                "SA-3",
-                "SA-4",
-                "SA-5",
-                "SA-8",
-                "SA-8(9)",
-                "SA-8(13)",
-                "SA-8(18)",
-                "SA-8(20)",
-                "SA-8(22)",
-                "SA-8(23)",
-                "SA-8(33)",
-                "SA-15",
-                "SA-15(12)",
-                "SC-3",
-                "SC-3(3)",
-                "SC-7",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(4)",
-                "SC-28",
-                "SC-28(1)",
-                "SI-12",
-                "SI-12(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "aisearch_service_not_publicly_accessible",
-        "aks_clusters_public_access_disabled",
-        "containerregistry_not_publicly_accessible",
-        "cosmosdb_account_firewall_use_selected_networks",
-        "sqlserver_unrestricted_inbound_access",
-        "storage_blob_public_access_level_is_disabled",
-        "storage_default_network_access_rule_is_denied",
-        "storage_ensure_private_endpoints_in_storage_accounts",
-        "vm_ensure_attached_disks_encrypted_with_cmk",
-        "vm_ensure_unattached_disks_encrypted_with_cmk"
-      ]
-    },
-    {
-      "Id": "DSP-10",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.",
-      "Name": "Sensitive Data Transfer",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.12",
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "9.5.1",
-                "9.5.2",
-                "9.5.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.8.3.3",
-                "27002: 8.3.3",
-                "27001: A.13.2.3",
-                "27002: 13.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.7.10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-4",
-                "AC-4(23)-(25)",
-                "CA-3",
-                "CA-3(6)",
-                "CA-6",
-                "CA-6(1)",
-                "CA-6(2)",
-                "SC-4",
-                "SC-4(2)",
-                "SC-7",
-                "SC-7(10)",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-16",
-                "SC-16(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.DS-5",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.IR-01",
-                "ID.AM-03",
-                "GV.OC-03",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "4.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.1.1",
-                "4.2.1",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "app_ensure_http_is_redirected_to_https",
-        "app_ensure_using_http20",
-        "sqlserver_recommended_minimal_tls_version",
-        "storage_ensure_minimum_tls_version_12",
-        "storage_secure_transfer_required_is_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-16",
-      "Description": "Data retention, archiving and deletion is managed in accordance with business requirements, applicable laws and regulations.",
-      "Name": "Data Retention and Deletion",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "C1.1",
-                "C1.2",
-                "CC3.1",
-                "P4.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.4",
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.10",
-                "27002: 5.33 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-12",
-                "SI-12(1)-(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)",
-                "SI-19",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-3",
-                "PR.IP-6",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "GV.OC-03",
-                "GV.SC-10",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "monitor_storage_account_with_activity_logs_cmk_encrypted",
-        "monitor_storage_account_with_activity_logs_is_private",
-        "postgresql_flexible_server_log_retention_days_greater_3",
-        "sqlserver_auditing_retention_90_days",
-        "storage_ensure_file_shares_soft_delete_is_enabled",
-        "storage_ensure_soft_delete_is_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-17",
-      "Description": "Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.",
-      "Name": "Sensitive Data Protection",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSC-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.1",
-                "CC6.1",
-                "CC6.3",
-                "CC6.7",
-                "CC8.1",
-                "C1.1",
-                "P2.0",
-                "P3.0",
-                "P4.0",
-                "P5.0",
-                "P6.0"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.1",
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.3",
-                "9.1.1",
-                "9.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001:A.18.1.4",
-                "27002:18.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.11",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PM-22",
-                "PM-24",
-                "PT-7",
-                "PT-7(1)",
-                "PT-7(2)",
-                "PT-8",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.0 (including all subsections)",
-                "4.0 (including all subsections)"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "containerregistry_not_publicly_accessible",
-        "cosmosdb_account_firewall_use_selected_networks",
-        "defender_ensure_defender_for_storage_is_on",
-        "sqlserver_tde_encrypted_with_cmk",
-        "sqlserver_tde_encryption_enabled",
-        "sqlserver_unrestricted_inbound_access",
-        "storage_account_key_access_disabled",
-        "storage_blob_public_access_level_is_disabled",
-        "storage_cross_tenant_replication_disabled",
-        "storage_default_network_access_rule_is_denied",
-        "storage_default_to_entra_authorization_enabled",
-        "storage_ensure_encryption_with_customer_managed_keys",
-        "vm_ensure_attached_disks_encrypted_with_cmk"
-      ]
-    },
-    {
-      "Id": "GRC-05",
-      "Description": "Develop and implement an Information Security Program, which includes programs for all the relevant domains of the CCM.",
-      "Name": "Information Security Program",
-      "Attributes": [
-        {
-          "Section": "Governance, Risk and Compliance",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "14.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SG2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-1",
-                "PM-3",
-                "PM-14",
-                "PL-2",
-                "PM-18",
-                "PM-31"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.4.1",
-                "A.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.4.1",
-                "A3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_app_services_is_on",
-        "defender_ensure_defender_for_arm_is_on",
-        "defender_ensure_defender_for_azure_sql_databases_is_on",
-        "defender_ensure_defender_for_databases_is_on",
-        "defender_ensure_defender_for_dns_is_on",
-        "defender_ensure_defender_for_keyvault_is_on",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_mcas_is_enabled",
-        "defender_ensure_wdatp_is_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-02",
-      "Description": "Establish, document, approve, communicate, implement, apply, evaluate and maintain strong password policies and procedures. Review and update the policies and procedures at least annually.",
-      "Name": "Strong Password Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-12",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "4.1.2",
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1",
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.7.2.2",
-                "27002: 7.2.2",
-                "27001: A.9.2.6",
-                "27002: 9.2.6",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.17",
-                "27001: A.6.3",
-                "27001: A.8.5",
-                "27001: A.5.37"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-3",
-                "AC-3(3)",
-                "AC-12",
-                "AC-12(1)",
-                "IA-2",
-                "IA-2(10)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.AC-1",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.4",
-                "12.1",
-                "12.1.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.1.1",
-                "8.3.8"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_privileged_user_has_mfa",
-        "entra_security_defaults_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-03",
-      "Description": "Manage, store, and review the information of system identities, and level of access.",
-      "Name": "Identity Inventory",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-04",
-                "IAM-08",
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27001: A.9.4.1",
-                "27002: 9.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.5.15",
-                "27001: A.5.16",
-                "27001: A.5.18",
-                "27001: A.7.4",
-                "27001: A.8.15",
-                "27001: A.8.2",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "AU-16",
-                "AU-16(1)",
-                "IA-4",
-                "IA-4(8)",
-                "IA-4(9)",
-                "IA-5",
-                "IA-5(5)",
-                "IA-8",
-                "IA-8(4)",
-                "PM-5(1)",
-                "SA-8",
-                "SA-8(22)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-04",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4.a"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_global_admin_in_less_than_five_users"
-      ]
-    },
-    {
-      "Id": "IAM-04",
-      "Description": "Employ the separation of duties principle when implementing information system access.",
-      "Name": "Separation of Duties",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC1.3",
-                "CC5.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.2",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.6.1.2",
-                "27002: 6.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18",
-                "27001: A.5.3",
-                "27001: A.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-6",
-                "AC-6(1)-(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4",
-                "6.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_policy_default_users_cannot_create_security_groups",
-        "entra_policy_ensure_default_user_cannot_create_apps",
-        "iam_role_user_access_admin_restricted",
-        "iam_subscription_roles_owner_custom_not_created"
-      ]
-    },
-    {
-      "Id": "IAM-05",
-      "Description": "Employ the least privilege principle when implementing information system access.",
-      "Name": "Least Privilege",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-06",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.1",
-                "27002: 9.1.1",
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.8.2",
-                "27002:  5.15 (Other information 2nd (a))"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "IA-12",
-                "IA-12(2)",
-                "IA-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1",
-                "7.1.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2",
-                "7.2.5",
-                "7.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "app_function_identity_without_admin_privileges",
-        "entra_policy_ensure_default_user_cannot_create_apps",
-        "entra_policy_ensure_default_user_cannot_create_tenants",
-        "entra_policy_restricts_user_consent_for_apps",
-        "iam_custom_role_has_permissions_to_administer_resource_locks",
-        "iam_subscription_roles_owner_custom_not_created"
-      ]
-    },
-    {
-      "Id": "IAM-07",
-      "Description": "De-provision or respectively modify access of movers / leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.",
-      "Name": "User Access Changes and Revocation",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.3",
-                "6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(1)",
-                "AC-2(2)",
-                "AC-2(6)",
-                "AC-2(8)",
-                "AC-3",
-                "AC-3(8)",
-                "AC-6",
-                "AC-6(7)",
-                "AU-10",
-                "AU-10(4)",
-                "AU-16",
-                "AU-16(1)",
-                "CM-7",
-                "CM-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.IP-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-04",
-                "GV.SC-10",
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.5",
-                "8.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_global_admin_in_less_than_five_users"
-      ]
-    },
-    {
-      "Id": "IAM-08",
-      "Description": "Review and revalidate user access for least privilege and separation of duties with a frequency that is commensurate with organizational risk tolerance.",
-      "Name": "User Access Review",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27001: A.9.2.6",
-                "27001: A.9.4.1",
-                "27017: 9.4.1",
-                "27001: A.6.1.2",
-                "27001: A 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.3",
-                "27001: A.5.18",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5.1",
-                "7.2.5",
-                "7.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_global_admin_in_less_than_five_users",
-        "keyvault_non_rbac_secret_expiration_set",
-        "keyvault_rbac_secret_expiration_set",
-        "storage_key_rotation_90_days"
-      ]
-    },
-    {
-      "Id": "IAM-09",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the segregation of privileged access roles such that administrative access to data, encryption and key management capabilities and logging capabilities are distinct and separated.",
-      "Name": "Segregation of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.1",
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-3(7)",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-5",
-                "IA-5(6)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.3",
-                "3.5.2",
-                "7.1.2",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.7.6",
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_global_admin_in_less_than_five_users",
-        "entra_policy_guest_invite_only_for_admin_roles",
-        "entra_policy_guest_users_access_restrictions",
-        "iam_custom_role_has_permissions_to_administer_resource_locks",
-        "iam_subscription_roles_owner_custom_not_created"
-      ]
-    },
-    {
-      "Id": "IAM-10",
-      "Description": "Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access.",
-      "Name": "Management of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "6.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3",
-                "27001: A.9.4.4",
-                "27002: 9.4.4",
-                "27017: 9.4.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(7)",
-                "AC-3",
-                "AC-3(4)",
-                "AC-3(11)",
-                "AC-3(13)",
-                "AC-3(14)",
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(5)",
-                "AC-6(8)",
-                "AC-12",
-                "AC-12(3)",
-                "AC-17",
-                "AC-17(4)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_conditional_access_policy_require_mfa_for_management_api",
-        "entra_global_admin_in_less_than_five_users",
-        "entra_user_with_vm_access_has_mfa",
-        "iam_role_user_access_admin_restricted",
-        "iam_subscription_roles_owner_custom_not_created",
-        "vm_jit_access_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-12",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the logging infrastructure is read-only for all with write access, including privileged access roles, and that the ability to disable it is controlled through a procedure that ensures the segregation of duties and break glass procedures.",
-      "Name": "Safeguard Logs Integrity",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1",
-                "27018: 12.4.1",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27017: 12.4.2",
-                "27018: 12.4.2",
-                "27001: A.12.4.3",
-                "27002: 12.4.3",
-                "27017: 12.4.3",
-                "27018: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.18",
-                "27002: 8.15 Protection of Logs"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(11)",
-                "AC-2(12)",
-                "IA-8",
-                "IA-8(4)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-34",
-                "SC-34(1)",
-                "SC-34(2)",
-                "SC-36",
-                "SI-4",
-                "SI-4(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_trusted_named_locations_exists",
-        "keyvault_logging_enabled",
-        "monitor_diagnostic_setting_with_appropriate_categories",
-        "monitor_storage_account_with_activity_logs_is_private"
-      ]
-    },
-    {
-      "Id": "IAM-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure users are identifiable through unique IDs or which can associate individuals to the usage of user IDs.",
-      "Name": "Uniquely Identifiable Users",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.1",
-                "27002: 9.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(14)",
-                "AC-24",
-                "AC-24(2)",
-                "AU-10",
-                "AU-10(1)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-4",
-                "IA-4(1)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-23",
-                "SC-23(3)",
-                "SC-40(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1",
-                "8.2",
-                "8.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.1",
-                "8.2.2",
-                "8.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_conditional_access_policy_require_mfa_for_management_api",
-        "entra_non_privileged_user_has_mfa",
-        "entra_privileged_user_has_mfa",
-        "entra_security_defaults_enabled",
-        "postgresql_flexible_server_entra_id_authentication_enabled",
-        "sqlserver_azuread_administrator_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for authenticating access to systems, application and data assets, including multifactor authentication for at least privileged user and sensitive data access. Adopt digital certificates or alternatives which achieve an equivalent level of security for system identities.",
-      "Name": "Strong Authentication",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.3",
-                "6.5",
-                "12.5",
-                "12.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4",
-                "SA1.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27017: 9.1.2",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.9.4.2",
-                "27002: 9.4.2",
-                "27017: 9.4.2",
-                "27018: 9.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.17",
-                "27001: A.8.5",
-                "27001: A.8.24",
-                "27002: 8.5",
-                "27002: 8.24 other information (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(5)",
-                "AC-7",
-                "AC-7(4)",
-                "AU-10",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(8)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5",
-                "IA-5(2)",
-                "IA-5(7)",
-                "IA-5(9)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-5(14)-(16)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(6)",
-                "SC-23",
-                "SC-23(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3",
-                "8.1.6",
-                "8.2",
-                "8.3",
-                "8.3.2",
-                "12.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "8.3.1",
-                "8.3.2",
-                "8.4.1",
-                "8.4.2",
-                "8.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_non_privileged_user_has_mfa",
-        "entra_privileged_user_has_mfa",
-        "entra_security_defaults_enabled",
-        "entra_user_with_vm_access_has_mfa"
-      ]
-    },
-    {
-      "Id": "IAM-15",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the secure management of passwords.",
-      "Name": "Passwords Management",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27018: 9.2.4",
-                "27001: A.9.3.1",
-                "27002: 9.3.1",
-                "27017: 9.3.1",
-                "27018: 9.3.1",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.17"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IA-4",
-                "IA-4(8)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(8)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.2",
-                "8.2.1-6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.2",
-                "2.3.1",
-                "8.3.5",
-                "8.3.6",
-                "8.3.7",
-                "8.3.8",
-                "8.3.9",
-                "8.3.10",
-                "8.3.10.1",
-                "8.6.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "entra_privileged_user_has_mfa",
-        "entra_security_defaults_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-16",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.",
-      "Name": "Authorization Mechanisms",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27002: 9.2.5",
-                "27017: 9.2.5",
-                "27018: 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(5)",
-                "AC-4",
-                "AC-4(17)",
-                "AC-4(21)",
-                "AC-4(22)",
-                "AC-6",
-                "AC-6(8)",
-                "AC-6(9)",
-                "AC-12",
-                "AC-12(1)",
-                "AC-20",
-                "AC-20(1)",
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5(1)",
-                "IA-5(2)",
-                "IA-5(5)",
-                "IA-5(8)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.AC-6",
-                "PR.AC-7",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03",
-                "PR.AA-04",
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.3",
-                "7.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.4",
-                "7.2.3",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "aks_cluster_rbac_enabled",
-        "app_function_identity_is_configured",
-        "app_function_identity_without_admin_privileges",
-        "app_function_not_publicly_accessible",
-        "entra_policy_user_consent_for_verified_apps",
-        "iam_subscription_roles_owner_custom_not_created"
-      ]
-    },
-    {
-      "Id": "IPY-03",
-      "Description": "Implement cryptographically secure and standardized network protocols for the management, import and export of data.",
-      "Name": "Secure Interoperability and Portability Management",
-      "Attributes": [
-        {
-          "Section": "Interoperability & Portability",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IPY-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.2",
-                "NC1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1",
-                "27001: A.15.1.1",
-                "27002: 15.1.1",
-                "27017: 15.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.19",
-                "27001: A.5.23",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PT-2",
-                "PT-2(2)",
-                "SA-4",
-                "SC-16",
-                "SC-16(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.1",
-                "1.2.5",
-                "1.2.6",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "storage_ensure_azure_services_are_trusted_to_access_is_enabled",
-        "storage_secure_transfer_required_is_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-02",
-      "Description": "Plan and monitor the availability, quality, and adequate capacity of resources in order to deliver the required system performance as determined by the business.",
-      "Name": "Capacity and Resource Planning",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-04"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.3",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.12.1.3",
-                "27002: 12.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.3 (b)",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.8.6",
-                "27001: A.8.14"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "SC-5",
-                "SC-5(2)",
-                "SC-4",
-                "SI-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-04",
-                "GV.OC-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "vm_scaleset_associated_with_load_balancer",
-        "vm_scaleset_not_empty"
-      ]
-    },
-    {
-      "Id": "IVS-03",
-      "Description": "Monitor, encrypt and restrict communications between environments to only authenticated and authorized connections, as justified by the business. Review these configurations at least annually, and support them by a documented justification of all allowed services, protocols, ports, and compensating controls.",
-      "Name": "Network Security",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-06"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.8",
-                "3.1",
-                "12.2",
-                "13.6",
-                "13.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: A.5.15 2nd c)",
-                "27002: 8.20",
-                "27002: 8.21",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-1",
-                "SC-4",
-                "SC-7",
-                "SC-7(4)",
-                "SC-7(5)",
-                "SC-7(8)",
-                "SC-7(9)",
-                "SC-7(11)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-11",
-                "SC-12",
-                "SC-16",
-                "SC-23",
-                "SC-29",
-                "SC-29(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-5",
-                "PR.AC-7",
-                "PR.PT-4",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-01",
-                "PR.AA-03",
-                "PR.AA-05",
-                "DE.CM-01",
-                "PR.DS-02",
-                "ID.AM-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "1.1.6",
-                "1.2",
-                "1.2.3",
-                "2.2",
-                "4.1.1",
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.5",
-                "1.2.6",
-                "1.2.7",
-                "1.4.2",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1",
-                "10.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "aks_clusters_created_with_private_nodes",
-        "aks_clusters_public_access_disabled",
-        "aks_network_policy_enabled",
-        "network_bastion_host_exists",
-        "network_flow_log_captured_sent",
-        "network_flow_log_more_than_90_days",
-        "network_http_internet_access_restricted",
-        "network_rdp_internet_access_restricted",
-        "network_ssh_internet_access_restricted",
-        "network_udp_internet_access_restricted",
-        "network_watcher_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-04",
-      "Description": "Harden host and guest OS, hypervisor or infrastructure control plane according to their respective best practices, and supported by technical controls, as part of a security baseline.",
-      "Name": "OS Hardening and Base Controls",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.8",
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-07",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "4.1",
-                "4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.3",
-                "SY1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2",
-                "27001: A.14.2.3",
-                "27001 A.14.2.4",
-                "27018: 12.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: 8.20",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(1)",
-                "SC-29",
-                "SC-29(1)",
-                "SC-2",
-                "SC-7",
-                "SC-7(12)",
-                "SC-30",
-                "SC-34",
-                "SC-35",
-                "SC-39",
-                "SC-44"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-1",
-                "PR.PT-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_assessments_vm_endpoint_protection_installed",
-        "defender_ensure_system_updates_are_applied",
-        "vm_ensure_using_managed_disks",
-        "vm_linux_enforce_ssh_authentication",
-        "vm_trusted_launch_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-06",
-      "Description": "Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.",
-      "Name": "Segmentation and Segregation",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-09"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.3.4",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.20",
-                "27001: A.8.3",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.22",
-                "27002: 5.15 (b)",
-                "27002: 8.3 (b)",
-                "27002: 8.16 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-3",
-                "SC-7",
-                "SC-7(20)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.AC-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.6",
-                "8.3.1",
-                "10.8",
-                "11.3",
-                "A3.2.1",
-                "A3.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A1.1.1",
-                "A1.1.2",
-                "A1.1.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "app_function_not_publicly_accessible",
-        "app_function_vnet_integration_enabled",
-        "containerregistry_uses_private_link",
-        "cosmosdb_account_use_private_endpoints",
-        "databricks_workspace_vnet_injection_enabled",
-        "network_http_internet_access_restricted",
-        "storage_ensure_private_endpoints_in_storage_accounts"
-      ]
-    },
-    {
-      "Id": "IVS-07",
-      "Description": "Use secure and encrypted communication channels when migrating servers, services, applications, or data to cloud environments. Such channels must include only up-to-date and approved protocols.",
-      "Name": "Migration to Cloud Environments",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-10"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM1.4",
-                "NC1.4",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27017: 13.1.1",
-                "27018: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27017: 13.1.2",
-                "27018: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3",
-                "27018: 13.1.3",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27017: 13.2.1",
-                "27018: 13.2.1",
-                "27001: A.13.2.2",
-                "27002: 13.2.2",
-                "27017: 13.2.2",
-                "27018: 13.2.2",
-                "27001: A.13.2.3",
-                "27002: 13.2.3",
-                "27017: 13.2.3",
-                "27018: 13.2.3",
-                "27001: A.13.2.4",
-                "27002: 13.2.4",
-                "27017: 13.2.4",
-                "27018: 13.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.20",
-                "27001: A.8.24",
-                "27002: 8.20 (e)",
-                "27002: 8.24 Guidance (b,f), other information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-17",
-                "AC-20",
-                "SC-7",
-                "SC-7(28)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-12",
-                "SC-23",
-                "SC-29",
-                "SI-7",
-                "SI-7(1)-(3)",
-                "SI-7(5)-(10)",
-                "SI-7(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "mysql_flexible_server_ssl_connection_enabled",
-        "postgresql_flexible_server_enforce_ssl_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-09",
-      "Description": "Define, implement and evaluate processes, procedures and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.",
-      "Name": "Network Defense",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.6",
-                "CC6.8",
-                "CC7.1",
-                "CC7.2",
-                "CC7.5"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-13"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "13.3",
-                "13.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3",
-                "5.2.4",
-                "5.2.5",
-                "5.2.7",
-                "5.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.11.1.4",
-                "27002: 11.1.4",
-                "27017: 11.1.4",
-                "27018: 16.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.5.24",
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.26",
-                "27002: 8.8 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-8",
-                "PL-8(1)",
-                "SC-5",
-                "SC-5(1)",
-                "SC-5(3)",
-                "SC-7",
-                "SC-7(13)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.DP-1",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.AC-5",
-                "RS.MI-2",
-                "PR.DS-2",
-                "RS.RP-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "DE.CM-01",
-                "PR.IR-01",
-                "RS.MA-01",
-                "RS.MI-01",
-                "RS.MI-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.6",
-                "1.1",
-                "1.2",
-                "1.3",
-                "1.5",
-                "12.10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.3.1",
-                "1.3.2",
-                "1.3.3",
-                "1.4.1",
-                "1.4.2",
-                "1.4.3",
-                "1.4.4",
-                "1.4.5",
-                "1.5.1",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_arm_is_on",
-        "defender_ensure_defender_for_dns_is_on",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_iot_hub_defender_is_on",
-        "defender_ensure_wdatp_is_enabled",
-        "network_flow_log_captured_sent",
-        "network_watcher_enabled",
-        "sqlserver_microsoft_defender_enabled",
-        "vm_jit_access_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-02",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.",
-      "Name": "Audit Logs Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1",
-                "8.9",
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.3",
-                "5.1.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-4",
-                "AU-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-08",
-                "PR.DS-11",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.7"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4",
-                "10.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "keyvault_logging_enabled",
-        "monitor_diagnostic_setting_with_appropriate_categories",
-        "monitor_storage_account_with_activity_logs_cmk_encrypted",
-        "monitor_storage_account_with_activity_logs_is_private",
-        "storage_ensure_encryption_with_customer_managed_keys",
-        "storage_ensure_soft_delete_is_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-03",
-      "Description": "Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.",
-      "Name": "Security Monitoring and Alerting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03",
-                "SEF-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "5.2.7",
-                "1.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2",
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-3",
-                "DE.AE-5",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-4",
-                "DE.CM-5",
-                "DE.CM-6",
-                "DE.CM-7",
-                "DE.DP-1",
-                "DE.DP-4",
-                "DE.AE-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2",
-                "10.4.1.1",
-                "10.4.2.1",
-                "10.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_attack_path_notifications_properly_configured",
-        "defender_ensure_defender_for_app_services_is_on",
-        "defender_ensure_defender_for_azure_sql_databases_is_on",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_notify_alerts_severity_is_high",
-        "defender_ensure_notify_emails_to_owners",
-        "defender_ensure_wdatp_is_enabled",
-        "monitor_alert_create_update_security_solution",
-        "monitor_alert_service_health_exists"
-      ]
-    },
-    {
-      "Id": "LOG-04",
-      "Description": "Restrict audit logs access to authorized personnel and maintain records that provide unique access accountability.",
-      "Name": "Audit Logs Access and Accountability",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.2",
-                "4.1.3",
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27001: A.12.4.1",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(4)",
-                "AU-9(6)",
-                "AU-10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.1",
-                "10.2.1",
-                "10.2.3",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1.3",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "monitor_storage_account_with_activity_logs_is_private"
-      ]
-    },
-    {
-      "Id": "LOG-05",
-      "Description": "Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.",
-      "Name": "Audit Logs Monitoring and Response",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.8",
-                "8.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "1.6.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.3",
-                "27002: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-6",
-                "AU-6(1)",
-                "AU-6(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-3",
-                "PR.PT-1",
-                "RS.AN-1",
-                "RS.CO-1.",
-                "DE.AE-1",
-                "DE.AE-5",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6",
-                "10.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.1.1",
-                "10.4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "monitor_alert_create_policy_assignment",
-        "monitor_alert_create_update_nsg",
-        "monitor_alert_create_update_public_ip_address_rule",
-        "monitor_alert_create_update_security_solution",
-        "monitor_alert_create_update_sqlserver_fr",
-        "monitor_alert_delete_nsg",
-        "monitor_alert_delete_policy_assignment",
-        "monitor_alert_delete_public_ip_address_rule",
-        "monitor_alert_delete_security_solution",
-        "monitor_alert_delete_sqlserver_fr",
-        "monitor_alert_service_health_exists"
-      ]
-    },
-    {
-      "Id": "LOG-07",
-      "Description": "Establish, document and implement which information meta/data system events should be logged. Review and update the scope at least annually or whenever there is a change in the threat environment.",
-      "Name": "Logging Scope",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-14",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.SC-4",
-                "PR.PT-1",
-                "ID.GV-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "app_function_application_insights_enabled",
-        "appinsights_ensure_is_configured",
-        "monitor_diagnostic_setting_with_appropriate_categories",
-        "monitor_diagnostic_settings_exists",
-        "network_flow_log_captured_sent",
-        "network_flow_log_more_than_90_days"
-      ]
-    },
-    {
-      "Id": "LOG-08",
-      "Description": "Generate audit records containing relevant security information.",
-      "Name": "Log Records",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-3",
-                "AU-3(1)",
-                "AU-3(3)",
-                "AU-6",
-                "AU-6(8)",
-                "AU-12",
-                "AU-12(1)",
-                "AU-12(2)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-6",
-                "DE.CM-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "app_function_application_insights_enabled",
-        "app_http_logs_enabled",
-        "appinsights_ensure_is_configured",
-        "keyvault_logging_enabled",
-        "monitor_diagnostic_setting_with_appropriate_categories",
-        "monitor_diagnostic_settings_exists",
-        "mysql_flexible_server_audit_log_connection_activated",
-        "mysql_flexible_server_audit_log_enabled",
-        "network_flow_log_captured_sent",
-        "network_flow_log_more_than_90_days",
-        "postgresql_flexible_server_log_checkpoints_on",
-        "postgresql_flexible_server_log_connections_on",
-        "postgresql_flexible_server_log_disconnections_on",
-        "postgresql_flexible_server_log_retention_days_greater_3",
-        "sqlserver_auditing_enabled",
-        "sqlserver_auditing_retention_90_days"
-      ]
-    },
-    {
-      "Id": "LOG-09",
-      "Description": "The information system protects audit records from unauthorized access, modification, and deletion.",
-      "Name": "Log Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04",
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(2)",
-                "AU-9(3)",
-                "AU-9(4)",
-                "AU-12(3)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "keyvault_logging_enabled",
-        "monitor_diagnostic_setting_with_appropriate_categories",
-        "monitor_storage_account_with_activity_logs_cmk_encrypted",
-        "monitor_storage_account_with_activity_logs_is_private",
-        "storage_ensure_encryption_with_customer_managed_keys"
-      ]
-    },
-    {
-      "Id": "LOG-10",
-      "Description": "Establish and maintain a monitoring and internal reporting capability over the operations of cryptographic, encryption and key management policies, processes, procedures, and controls.",
-      "Name": "Encryption Monitoring and Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.1.1",
-                "10.2.1",
-                "10.4.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "keyvault_key_expiration_set_in_non_rbac",
-        "keyvault_key_rotation_enabled",
-        "keyvault_rbac_key_expiration_set"
-      ]
-    },
-    {
-      "Id": "LOG-11",
-      "Description": "Log and monitor key lifecycle management events to enable auditing and reporting on usage of cryptographic keys.",
-      "Name": "Transaction/Activity Logging",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "monitor_diagnostic_setting_with_appropriate_categories",
-        "monitor_diagnostic_settings_exists"
-      ]
-    },
-    {
-      "Id": "LOG-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the reporting of anomalies and failures of the monitoring system and provide immediate notification to the accountable party.",
-      "Name": "Failures and Anomalies Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.16.1.2",
-                "27017: 16.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.24",
-                "27001: A.6.8",
-                "27002: 6.8 (g)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-6",
-                "AU-6(3)",
-                "AU-6(4)",
-                "AU-6(5)",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-3",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.3",
-                "10.7.1",
-                "10.7.2",
-                "10.7.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_container_images_resolved_vulnerabilities",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_notify_alerts_severity_is_high",
-        "defender_ensure_notify_emails_to_owners",
-        "defender_ensure_wdatp_is_enabled",
-        "monitor_alert_service_health_exists"
-      ]
-    },
-    {
-      "Id": "SEF-03",
-      "Description": "'Establish, document, approve, communicate, apply, evaluate and maintain a security incident response plan, which includes but is not limited to: relevant internal departments, impacted CSCs, and other business critical relationships (such as supply-chain) that may be impacted.'",
-      "Name": "Incident Response Plans",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2",
-                "CC7.3",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2",
-                "17.4"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27017: CLD.12.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.5.26",
-                "27002: 5.26 (e,f)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-1",
-                "IR-2",
-                "IR-2(1)-(3)",
-                "IR-3",
-                "IR-3(1)-(3)",
-                "IR-4",
-                "IR-4(1)-(15)",
-                "IR-5",
-                "IR-5(1)",
-                "IR-6",
-                "IR-6(1)-(3)",
-                "IR-7",
-                "IR-7(1)",
-                "IR-7(2)",
-                "IR-8",
-                "IR-8(1)",
-                "IR-9",
-                "IR-9(1)-(4)",
-                "PM-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.CO-1",
-                "RS.CO-4",
-                "ID.AM-6",
-                "ID.GV-2",
-                "ID.SC-5",
-                "PR.IP-9",
-                "PR.IP10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AT-01",
-                "PR.AT-02",
-                "RS.MA-01",
-                "GV.SC-08",
-                "ID.IM-02",
-                "ID.IM-04",
-                "RC.RP-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "12.10.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_attack_path_notifications_properly_configured",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_notify_alerts_severity_is_high"
-      ]
-    },
-    {
-      "Id": "SEF-06",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.",
-      "Name": "Event Triage Processes",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.4",
-                "27002: 16.1.4",
-                "27017: 16.1.4",
-                "27018: 16.1.4",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.25"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(3)",
-                "CA-7(4)",
-                "CA-7(5)",
-                "CA-7(6)",
-                "IR-4",
-                "IR-4(1)",
-                "IR-4(3)",
-                "IR-4(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-4",
-                "RS.RP-1",
-                "RS.AN-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "RS.MA-02",
-                "RS.MA-03",
-                "RS.AN-03",
-                "DE.AE-02",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "RS.MI-02",
-                "RC.RP-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_app_services_is_on",
-        "defender_ensure_defender_for_azure_sql_databases_is_on",
-        "defender_ensure_defender_for_databases_is_on",
-        "defender_ensure_defender_for_keyvault_is_on",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_mcas_is_enabled",
-        "defender_ensure_wdatp_is_enabled"
-      ]
-    },
-    {
-      "Id": "SEF-08",
-      "Description": "Maintain points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities.",
-      "Name": "Points of Contact Maintenance",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.2",
-                "27001: A.6.1.3",
-                "27002: 6.1.3",
-                "27017: 6.1.3",
-                "27018: 6.1.3",
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.18.1.1",
-                "27002: 18.1.1",
-                "27017: 18.1.1",
-                "27018: 18.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.5",
-                "27001: A.5.24",
-                "27002: 5.24 Incident management procedure (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-4",
-                "IR-4(8)",
-                "IR-6",
-                "IR-6(3)",
-                "IR-7",
-                "IR-7(2)",
-                "PM-21",
-                "PM-23",
-                "PM-26"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-2",
-                "RS.CO-3",
-                "RS.CO-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-02",
-                "RS.CO-02",
-                "RS.CO-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_additional_email_configured_with_a_security_contact",
-        "defender_ensure_notify_emails_to_owners"
-      ]
-    },
-    {
-      "Id": "TVM-02",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect against malware on managed assets. Review and update the policies and procedures at least annually.",
-      "Name": "Malware Protection Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.8"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-01",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "9.7",
-                "10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.2",
-                "TS1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.12.2.1",
-                "27001: A.6.2.1",
-                "27002: 6.2.1 (h)",
-                "27001: A.6.2.2",
-                "27002: 6.2.2 (j)",
-                "27001: A.7.2.2",
-                "27002: 7.2.2 (d)",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (g)",
-                "27001: A.13.2.1",
-                "27002: 13.2.1 (b)",
-                "27001: A.15.1.2",
-                "27017: 15.1.2",
-                "27001: A.12.2.1",
-                "27002: 12.2.1 (a),(d)",
-                "27017: CLD.9.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.7",
-                "27001: A.5.37",
-                "27001: A.8.7",
-                "27002: 5.7 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-3",
-                "RA-3(3)",
-                "RA-5",
-                "RA-5(3)",
-                "RA-5(5)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "DE.CM-4",
-                "DE.CM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "DE.CM-01",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.4",
-                "12.1",
-                "12.1.1",
-                "12.3.1",
-                "12.5.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.1.1",
-                "12.1.2",
-                "5.1.1",
-                "5.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_assessments_vm_endpoint_protection_installed",
-        "defender_auto_provisioning_log_analytics_agent_vms_on",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_wdatp_is_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-03",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.",
-      "Name": "Vulnerability Remediation Schedule",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC7.1",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.2",
-                "7.7",
-                "17.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "TM2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.2.1",
-                "27001: A.12.6.1",
-                "27002: 12.6.1(c)(d)(j)",
-                "27018: 12.6.1(k)(i)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.8.7",
-                "27001: A.8.8",
-                "27001: A.8.32",
-                "27002: 8.7",
-                "27002: 8.8",
-                "27002: 8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-31",
-                "RA-3",
-                "RA-3(1)",
-                "RA-5",
-                "RA-5(2)-(4)",
-                "RA-5(6)",
-                "SI-3",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.AN-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.1.a",
-                "6.1.b"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.1.1",
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "app_ensure_java_version_is_latest",
-        "app_ensure_php_version_is_latest",
-        "app_ensure_python_version_is_latest",
-        "app_function_latest_runtime_version",
-        "defender_ensure_system_updates_are_applied"
-      ]
-    },
-    {
-      "Id": "TVM-04",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to update detection tools, threat signatures, and indicators of compromise on a weekly, or more frequent basis.",
-      "Name": "Detection Updates",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.3",
-                "TS1.4",
-                "TM1.3",
-                "TM1.4",
-                "IM1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1.1",
-                "27002: 5.1.1 (h)",
-                "27001: A.12.6.1",
-                "27002: 12.6.1 (b),(c)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1",
-                "27001: A.8.8",
-                "27001: A.8.15",
-                "27001: A.8.16",
-                "27002: 5.1",
-                "27002: 5.37",
-                "27002: 8.8",
-                "27002: 8.15 (d)",
-                "27002: 8.16 (d,e)",
-                "27002: 8.31 2nd (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-7",
-                "CM-7(4)",
-                "RA-3",
-                "RA-3(3)",
-                "RA-5(2)",
-                "SA-10",
-                "SA-10(5)",
-                "SA-11",
-                "SA-11(2)",
-                "SI-2",
-                "SI-2(4)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-4",
-                "SI-4(9)",
-                "SI-4(24)",
-                "SI-8",
-                "SI-8(2)",
-                "SI-8(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-02",
-                "ID.RA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.2",
-                "5.2a",
-                "5.2b",
-                "5.2c"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "5.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
-        "defender_container_images_scan_enabled",
-        "defender_ensure_defender_for_containers_is_on",
-        "defender_ensure_defender_for_cosmosdb_is_on",
-        "defender_ensure_defender_for_os_relational_databases_is_on",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_defender_for_sql_servers_is_on",
-        "defender_ensure_wdatp_is_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-05",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to identify updates for applications which use third party or open source libraries according to the organization's vulnerability management policy.",
-      "Name": "External Library Vulnerabilities",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "SD2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.6.2",
-                "27002: 12.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A 5.6",
-                "27001: A.8.19",
-                "27001: A.8.8",
-                "27001: A.8.28",
-                "27001: A.8.31",
-                "27002: 5.6 (c)",
-                "27001: 8.19",
-                "27001: 8.8",
-                "27001: 8.28",
-                "27001: 8.31"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(3)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-11(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-03",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.2",
-                "6.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_container_images_resolved_vulnerabilities",
-        "defender_container_images_scan_enabled",
-        "defender_ensure_defender_for_containers_is_on",
-        "sqlserver_va_emails_notifications_admins_enabled",
-        "sqlserver_va_periodic_recurring_scans_enabled",
-        "sqlserver_va_scan_reports_configured",
-        "sqlserver_vulnerability_assessment_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-07",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.",
-      "Name": "Vulnerability Identification",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.1",
-                "7.5",
-                "7.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.6",
-                "27001: A.12.6.1",
-                "27002: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.8",
-                "27002: 8.8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(4)",
-                "RA-5(5)",
-                "SA-11",
-                "SA-11(5)",
-                "SA-15(5)",
-                "SC-7",
-                "SC-7(10)",
-                "SI-3(8)",
-                "SI-3(10)",
-                "SI-7",
-                "SI-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.RA-1",
-                "DE.CM-8",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "11.2",
-                "11.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "11.3.2",
-                "11.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
-        "defender_container_images_resolved_vulnerabilities",
-        "defender_container_images_scan_enabled",
-        "defender_ensure_defender_for_containers_is_on",
-        "defender_ensure_defender_for_server_is_on",
-        "defender_ensure_wdatp_is_enabled",
-        "sqlserver_microsoft_defender_enabled",
-        "sqlserver_vulnerability_assessment_enabled"
-      ]
-    },
-    {
-      "Id": "UEM-08",
-      "Description": "Protect information from unauthorized disclosure on managed endpoint devices with storage encryption.",
-      "Name": "Storage Encryption",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "MOS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "3.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "PA1.2",
-                "PA1.3",
-                "PA1.5",
-                "PA2.2",
-                "PM1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.11.2.7",
-                "27002: 11.2.7",
-                "27001: A.18.1.1",
-                "27017: 18.1.1",
-                "27001: A.12.3.1",
-                "27017: 12.3.1",
-                "27018: A.11.4",
-                "27018: A.11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.1",
-                "27002: 8.1 (h)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.4",
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.5.1",
-                "3.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "databricks_workspace_cmk_encryption_enabled",
-        "storage_infrastructure_encryption_is_enabled",
-        "vm_ensure_attached_disks_encrypted_with_cmk",
-        "vm_ensure_unattached_disks_encrypted_with_cmk"
-      ]
-    },
-    {
-      "Id": "UEM-11",
-      "Description": "Configure managed endpoints with Data Loss Prevention (DLP) technologies and rules in accordance with a risk assessment.",
-      "Name": "Data Loss Prevention",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.5",
-                "PA2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27002: 12.3",
-                "27001: A.8.3.1",
-                "27002: 8.3.1",
-                "27001: A.12.2",
-                "27002: 12.2",
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001: A.6.1.1",
-                "27017: 6.1.1",
-                "27018: 12.3.1",
-                "27018: 10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-7",
-                "SC-7(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.DS-10",
-                "PR.PS-01",
-                "ID.AM-08",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "defender_ensure_defender_for_storage_is_on",
-        "defender_ensure_mcas_is_enabled"
-      ]
-    }
-  ]
-}
diff --git a/prowler/compliance/azure/hipaa_azure.json b/prowler/compliance/azure/hipaa_azure.json
index 332d081590..70f1e7e13f 100644
--- a/prowler/compliance/azure/hipaa_azure.json
+++ b/prowler/compliance/azure/hipaa_azure.json
@@ -438,7 +438,9 @@
         "storage_geo_redundant_enabled",
         "keyvault_recoverable",
         "sqlserver_auditing_retention_90_days",
-        "postgresql_flexible_server_log_retention_days_greater_3"
+        "postgresql_flexible_server_log_retention_days_greater_3",
+        "cosmosdb_account_backup_policy_continuous",
+        "mysql_flexible_server_geo_redundant_backup_enabled"
       ]
     },
     {
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 0051795890..ee0e4ca89b 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1266,7 +1266,10 @@
           "Check_Summary": "Backup copies of information, software and systems should be maintained and regularly tested in accordance with the agreed topic-specific policy on backup."
         }
       ],
-      "Checks": []
+      "Checks": [
+        "cosmosdb_account_backup_policy_continuous",
+        "mysql_flexible_server_geo_redundant_backup_enabled"
+      ]
     },
     {
       "Id": "A.8.14",
@@ -1293,7 +1296,10 @@
         "storage_ensure_private_endpoints_in_storage_accounts",
         "storage_secure_transfer_required_is_enabled",
         "vm_ensure_using_managed_disks",
-        "vm_trusted_launch_enabled"
+        "vm_trusted_launch_enabled",
+        "cosmosdb_account_automatic_failover_enabled",
+        "mysql_flexible_server_geo_redundant_backup_enabled",
+        "mysql_flexible_server_high_availability_enabled"
       ]
     },
     {
@@ -1337,6 +1343,7 @@
         }
       ],
       "Checks": [
+        "defender_ensure_defender_cspm_is_on",
         "monitor_alert_create_policy_assignment",
         "monitor_alert_create_update_nsg",
         "monitor_alert_create_update_public_ip_address_rule",
@@ -1407,6 +1414,9 @@
         "aks_network_policy_enabled",
         "containerregistry_not_publicly_accessible",
         "cosmosdb_account_firewall_use_selected_networks",
+        "cosmosdb_account_public_network_access_disabled",
+        "databricks_workspace_no_public_ip_enabled",
+        "databricks_workspace_public_network_access_disabled",
         "network_bastion_host_exists",
         "network_flow_log_captured_sent",
         "network_flow_log_more_than_90_days",
@@ -1500,6 +1510,7 @@
       ],
       "Checks": [
         "app_minimum_tls_version_12",
+        "cosmosdb_account_minimum_tls_version",
         "monitor_storage_account_with_activity_logs_cmk_encrypted",
         "sqlserver_tde_encrypted_with_cmk",
         "sqlserver_tde_encryption_enabled",
diff --git a/prowler/compliance/csa_ccm_4.0.json b/prowler/compliance/csa_ccm_4.0.json
index e014c5f408..57f1a67758 100644
--- a/prowler/compliance/csa_ccm_4.0.json
+++ b/prowler/compliance/csa_ccm_4.0.json
@@ -1087,7 +1087,9 @@
           "storage_blob_versioning_is_enabled",
           "storage_geo_redundant_enabled",
           "vm_scaleset_associated_with_load_balancer",
-          "vm_scaleset_not_empty"
+          "vm_scaleset_not_empty",
+          "cosmosdb_account_automatic_failover_enabled",
+          "cosmosdb_account_backup_policy_continuous"
         ],
         "gcp": [
           "compute_instance_automatic_restart_enabled",
diff --git a/prowler/compliance/dora_2022_2554.json b/prowler/compliance/dora_2022_2554.json
new file mode 100644
index 0000000000..1bc4ed41da
--- /dev/null
+++ b/prowler/compliance/dora_2022_2554.json
@@ -0,0 +1,842 @@
+{
+  "framework": "DORA",
+  "name": "Digital Operational Resilience Act (Regulation (EU) 2022/2554)",
+  "version": "2022/2554",
+  "description": "The Digital Operational Resilience Act (DORA) is a European Union regulation (Regulation (EU) 2022/2554) that sets a uniform framework for the digital operational resilience of the EU financial sector. Mandatory since 17 January 2025, it applies to financial entities (banks, insurers, investment firms, payment institutions, etc.) and to ICT third-party service providers. DORA is structured around five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. This Prowler mapping covers the technical controls auditable from cloud configuration; the organisational, contractual and supervisory obligations defined in DORA must be addressed outside of Prowler.",
+  "icon": "dora",
+  "attributes_metadata": [
+    {
+      "key": "Pillar",
+      "label": "Pillar",
+      "type": "str",
+      "required": true,
+      "enum": [
+        "ICT Risk Management",
+        "ICT-Related Incident Reporting",
+        "Digital Operational Resilience Testing",
+        "ICT Third-Party Risk Management",
+        "Information Sharing"
+      ],
+      "output_formats": {
+        "csv": true,
+        "ocsf": true
+      }
+    },
+    {
+      "key": "Article",
+      "label": "Article",
+      "type": "str",
+      "required": true,
+      "output_formats": {
+        "csv": true,
+        "ocsf": true
+      }
+    },
+    {
+      "key": "ArticleTitle",
+      "label": "Article Title",
+      "type": "str",
+      "required": true,
+      "output_formats": {
+        "csv": true,
+        "ocsf": true
+      }
+    }
+  ],
+  "outputs": {
+    "table_config": {
+      "group_by": "Pillar"
+    },
+    "pdf_config": {
+      "language": "en",
+      "primary_color": "#003399",
+      "secondary_color": "#0055A5",
+      "bg_color": "#F0F4FA",
+      "group_by_field": "Pillar",
+      "sections": [
+        "ICT Risk Management",
+        "ICT-Related Incident Reporting",
+        "Digital Operational Resilience Testing",
+        "ICT Third-Party Risk Management",
+        "Information Sharing"
+      ],
+      "section_short_names": {
+        "ICT Risk Management": "ICT Risk Mgmt",
+        "ICT-Related Incident Reporting": "Incident Reporting",
+        "Digital Operational Resilience Testing": "Resilience Testing",
+        "ICT Third-Party Risk Management": "Third-Party Risk",
+        "Information Sharing": "Info Sharing"
+      },
+      "charts": [
+        {
+          "id": "pillar_compliance",
+          "type": "horizontal_bar",
+          "group_by": "Pillar",
+          "title": "Compliance Score by DORA Pillar",
+          "y_label": "Pillar",
+          "x_label": "Compliance %",
+          "value_source": "compliance_percent",
+          "color_mode": "by_value"
+        }
+      ],
+      "filter": {
+        "only_failed": true,
+        "include_manual": false
+      }
+    }
+  },
+  "requirements": [
+    {
+      "id": "DORA-Art5",
+      "name": "Governance and organisation",
+      "description": "Financial entities shall have a sound, comprehensive and well-documented ICT internal governance and control framework. Senior management is accountable for ICT risk and shall enforce strong identity, authentication and least-privilege policies for privileged identities, including the root account.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 5",
+        "ArticleTitle": "Governance and organisation"
+      },
+      "checks": {
+        "aws": [
+          "iam_avoid_root_usage",
+          "iam_no_root_access_key",
+          "iam_root_mfa_enabled",
+          "iam_root_hardware_mfa_enabled",
+          "iam_root_credentials_management_enabled",
+          "iam_password_policy_minimum_length_14",
+          "iam_password_policy_lowercase",
+          "iam_password_policy_uppercase",
+          "iam_password_policy_number",
+          "iam_password_policy_symbol",
+          "iam_password_policy_reuse_24",
+          "iam_password_policy_expires_passwords_within_90_days_or_less",
+          "iam_securityaudit_role_created",
+          "iam_support_role_created",
+          "organizations_account_part_of_organizations",
+          "iam_user_mfa_enabled_console_access",
+          "iam_user_hardware_mfa_enabled"
+        ],
+        "azure": [
+          "entra_global_admin_in_less_than_five_users",
+          "entra_privileged_user_has_mfa",
+          "entra_non_privileged_user_has_mfa",
+          "entra_user_with_vm_access_has_mfa",
+          "entra_security_defaults_enabled",
+          "entra_conditional_access_policy_require_mfa_for_admin_portals",
+          "entra_conditional_access_policy_require_mfa_for_management_api",
+          "entra_policy_default_users_cannot_create_security_groups",
+          "entra_policy_ensure_default_user_cannot_create_apps",
+          "entra_policy_ensure_default_user_cannot_create_tenants",
+          "entra_users_cannot_create_microsoft_365_groups",
+          "iam_subscription_roles_owner_custom_not_created",
+          "iam_role_user_access_admin_restricted",
+          "iam_custom_role_has_permissions_to_administer_resource_locks"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art6",
+      "name": "ICT risk management framework",
+      "description": "Financial entities shall have an ICT risk management framework that is sound, comprehensive and well-documented, enabling them to address ICT risk quickly, efficiently and comprehensively and to ensure a high level of digital operational resilience. This includes continuous configuration recording, security findings aggregation and an enterprise-wide visibility plane.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 6",
+        "ArticleTitle": "ICT risk management framework"
+      },
+      "checks": {
+        "aws": [
+          "config_recorder_all_regions_enabled",
+          "config_recorder_using_aws_service_role",
+          "securityhub_enabled",
+          "accessanalyzer_enabled",
+          "accessanalyzer_enabled_without_findings",
+          "organizations_delegated_administrators",
+          "guardduty_centrally_managed",
+          "guardduty_delegated_admin_enabled_all_regions"
+        ],
+        "azure": [
+          "defender_ensure_defender_for_server_is_on",
+          "defender_ensure_defender_for_containers_is_on",
+          "defender_ensure_defender_for_storage_is_on",
+          "defender_ensure_defender_for_app_services_is_on",
+          "defender_ensure_defender_for_azure_sql_databases_is_on",
+          "defender_ensure_defender_for_sql_servers_is_on",
+          "defender_ensure_defender_for_databases_is_on",
+          "defender_ensure_defender_for_os_relational_databases_is_on",
+          "defender_ensure_defender_for_keyvault_is_on",
+          "defender_ensure_defender_for_arm_is_on",
+          "defender_ensure_defender_for_dns_is_on",
+          "defender_ensure_defender_for_cosmosdb_is_on",
+          "defender_ensure_mcas_is_enabled",
+          "defender_ensure_wdatp_is_enabled",
+          "defender_auto_provisioning_log_analytics_agent_vms_on",
+          "policy_ensure_asc_enforcement_enabled"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art7",
+      "name": "ICT systems, protocols and tools",
+      "description": "Financial entities shall use and maintain updated ICT systems, protocols and tools that are appropriate to the magnitude of operations supporting ICT functions, technologically resilient, and adequately equipped to securely process data. Cryptographic primitives, certificate hygiene and network segmentation are core to this requirement.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 7",
+        "ArticleTitle": "ICT systems, protocols and tools"
+      },
+      "checks": {
+        "aws": [
+          "acm_certificates_with_secure_key_algorithms",
+          "acm_certificates_transparency_logs_enabled",
+          "acm_certificates_expiration_check",
+          "ec2_ebs_default_encryption",
+          "kms_cmk_rotation_enabled",
+          "s3_bucket_secure_transport_policy",
+          "s3_bucket_default_encryption",
+          "s3_bucket_kms_encryption",
+          "vpc_subnet_separate_private_public",
+          "vpc_subnet_no_public_ip_by_default",
+          "elb_insecure_ssl_ciphers",
+          "elbv2_insecure_ssl_ciphers",
+          "elb_ssl_listeners",
+          "elbv2_ssl_listeners",
+          "cloudfront_distributions_using_deprecated_ssl_protocols",
+          "cloudfront_distributions_https_enabled",
+          "rds_instance_transport_encrypted"
+        ],
+        "azure": [
+          "storage_ensure_minimum_tls_version_12",
+          "storage_secure_transfer_required_is_enabled",
+          "storage_smb_channel_encryption_with_secure_algorithm",
+          "storage_smb_protocol_version_is_latest",
+          "app_minimum_tls_version_12",
+          "app_ensure_http_is_redirected_to_https",
+          "app_ensure_using_http20",
+          "sqlserver_recommended_minimal_tls_version",
+          "mysql_flexible_server_minimum_tls_version_12",
+          "mysql_flexible_server_ssl_connection_enabled",
+          "postgresql_flexible_server_enforce_ssl_enabled",
+          "keyvault_key_rotation_enabled",
+          "storage_key_rotation_90_days",
+          "aks_network_policy_enabled"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art8",
+      "name": "Identification",
+      "description": "Financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting them, and their interdependencies. They shall on a continuous basis identify all sources of ICT risk, in particular the risk exposure to and from other financial entities.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 8",
+        "ArticleTitle": "Identification"
+      },
+      "checks": {
+        "aws": [
+          "accessanalyzer_enabled",
+          "accessanalyzer_enabled_without_findings",
+          "macie_is_enabled",
+          "macie_automated_sensitive_data_discovery_enabled",
+          "ec2_securitygroup_not_used",
+          "ec2_elastic_ip_unassigned",
+          "ec2_networkacl_unused",
+          "secretsmanager_secret_unused"
+        ],
+        "azure": [
+          "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
+          "network_watcher_enabled",
+          "network_public_ip_shodan",
+          "vm_scaleset_not_empty"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art9",
+      "name": "Protection and prevention",
+      "description": "Financial entities shall continuously monitor and control the security and functioning of ICT systems and tools and minimise the impact of ICT risk by deploying appropriate ICT security tools, policies and procedures. Encryption at rest and in transit, blocking of public exposure, network access controls, secret management and instance hardening are central to this article.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 9",
+        "ArticleTitle": "Protection and prevention"
+      },
+      "checks": {
+        "aws": [
+          "kms_key_not_publicly_accessible",
+          "ec2_ebs_volume_encryption",
+          "ec2_ebs_snapshots_encrypted",
+          "ec2_ebs_public_snapshot",
+          "ec2_ebs_snapshot_account_block_public_access",
+          "s3_account_level_public_access_blocks",
+          "s3_bucket_level_public_access_block",
+          "s3_bucket_public_access",
+          "s3_bucket_policy_public_write_access",
+          "s3_bucket_public_write_acl",
+          "s3_bucket_public_list_acl",
+          "s3_bucket_acl_prohibited",
+          "s3_access_point_public_access_block",
+          "ec2_securitygroup_default_restrict_traffic",
+          "ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
+          "ec2_securitygroup_allow_ingress_from_internet_to_any_port",
+          "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports",
+          "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
+          "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389",
+          "rds_instance_storage_encrypted",
+          "rds_cluster_storage_encrypted",
+          "rds_instance_no_public_access",
+          "rds_snapshots_public_access",
+          "secretsmanager_not_publicly_accessible",
+          "secretsmanager_has_restrictive_resource_policy",
+          "secretsmanager_automatic_rotation_enabled",
+          "dynamodb_tables_kms_cmk_encryption_enabled",
+          "sns_topics_kms_encryption_at_rest_enabled",
+          "sns_topics_not_publicly_accessible",
+          "ec2_instance_imdsv2_enabled",
+          "ec2_instance_account_imdsv2_enabled",
+          "efs_encryption_at_rest_enabled",
+          "awslambda_function_not_publicly_accessible"
+        ],
+        "azure": [
+          "storage_account_public_network_access_disabled",
+          "storage_blob_public_access_level_is_disabled",
+          "storage_default_network_access_rule_is_denied",
+          "storage_ensure_private_endpoints_in_storage_accounts",
+          "storage_ensure_encryption_with_customer_managed_keys",
+          "storage_infrastructure_encryption_is_enabled",
+          "storage_account_key_access_disabled",
+          "storage_default_to_entra_authorization_enabled",
+          "containerregistry_not_publicly_accessible",
+          "containerregistry_uses_private_link",
+          "cosmosdb_account_use_private_endpoints",
+          "cosmosdb_account_firewall_use_selected_networks",
+          "keyvault_private_endpoints",
+          "keyvault_access_only_through_private_endpoints",
+          "keyvault_rbac_enabled",
+          "app_function_not_publicly_accessible",
+          "aisearch_service_not_publicly_accessible",
+          "aks_clusters_public_access_disabled",
+          "aks_clusters_created_with_private_nodes",
+          "sqlserver_unrestricted_inbound_access",
+          "postgresql_flexible_server_allow_access_services_disabled",
+          "vm_ensure_attached_disks_encrypted_with_cmk",
+          "vm_ensure_unattached_disks_encrypted_with_cmk",
+          "vm_ensure_using_managed_disks",
+          "vm_trusted_launch_enabled",
+          "vm_linux_enforce_ssh_authentication",
+          "vm_jit_access_enabled",
+          "sqlserver_tde_encryption_enabled",
+          "sqlserver_tde_encrypted_with_cmk",
+          "databricks_workspace_cmk_encryption_enabled",
+          "network_ssh_internet_access_restricted",
+          "network_rdp_internet_access_restricted",
+          "network_http_internet_access_restricted",
+          "network_udp_internet_access_restricted",
+          "network_bastion_host_exists"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art10",
+      "name": "Detection",
+      "description": "Financial entities shall have in place mechanisms to promptly detect anomalous activities, including ICT network performance issues and ICT-related incidents, and to identify potential single points of failure. Threat detection across compute, identity, storage and the API control plane is required for timely detection.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 10",
+        "ArticleTitle": "Detection"
+      },
+      "checks": {
+        "aws": [
+          "guardduty_is_enabled",
+          "guardduty_no_high_severity_findings",
+          "guardduty_ec2_malware_protection_enabled",
+          "guardduty_lambda_protection_enabled",
+          "guardduty_rds_protection_enabled",
+          "guardduty_s3_protection_enabled",
+          "guardduty_eks_audit_log_enabled",
+          "guardduty_eks_runtime_monitoring_enabled",
+          "securityhub_enabled",
+          "cloudtrail_threat_detection_enumeration",
+          "cloudtrail_threat_detection_llm_jacking",
+          "cloudtrail_threat_detection_privilege_escalation",
+          "cloudtrail_insights_exist",
+          "inspector2_is_enabled",
+          "inspector2_active_findings_exist",
+          "ec2_elastic_ip_shodan"
+        ],
+        "azure": [
+          "defender_ensure_defender_for_server_is_on",
+          "defender_ensure_defender_for_containers_is_on",
+          "defender_ensure_defender_for_storage_is_on",
+          "defender_ensure_defender_for_keyvault_is_on",
+          "defender_ensure_defender_for_arm_is_on",
+          "defender_ensure_defender_for_dns_is_on",
+          "defender_ensure_defender_for_azure_sql_databases_is_on",
+          "defender_ensure_defender_for_sql_servers_is_on",
+          "defender_ensure_wdatp_is_enabled",
+          "defender_ensure_mcas_is_enabled",
+          "defender_container_images_scan_enabled",
+          "defender_container_images_resolved_vulnerabilities",
+          "sqlserver_microsoft_defender_enabled",
+          "apim_threat_detection_llm_jacking"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art11",
+      "name": "Response and recovery",
+      "description": "Financial entities shall put in place a comprehensive ICT business continuity policy, including ICT response and recovery plans, that ensures the continuity of ICT-supported critical or important functions. Operational alarming, automated event routing and tested recovery actions are essential.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 11",
+        "ArticleTitle": "Response and recovery"
+      },
+      "checks": {
+        "aws": [
+          "cloudwatch_alarm_actions_enabled",
+          "cloudwatch_alarm_actions_alarm_state_configured",
+          "eventbridge_global_endpoint_event_replication_enabled",
+          "sns_subscription_not_using_http_endpoints",
+          "backup_plans_exist",
+          "backup_vaults_exist",
+          "rds_instance_critical_event_subscription",
+          "rds_cluster_critical_event_subscription"
+        ],
+        "azure": [
+          "monitor_alert_service_health_exists",
+          "monitor_alert_create_update_security_solution",
+          "monitor_alert_delete_security_solution",
+          "defender_additional_email_configured_with_a_security_contact",
+          "defender_ensure_notify_alerts_severity_is_high",
+          "defender_ensure_notify_emails_to_owners",
+          "defender_attack_path_notifications_properly_configured",
+          "vm_backup_enabled",
+          "vm_sufficient_daily_backup_retention_period"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art12",
+      "name": "Backup policies and procedures, restoration and recovery procedures and methods",
+      "description": "Financial entities shall develop and document backup policies and procedures specifying the scope of data subject to backup and the minimum frequency of the backup, as well as restoration and recovery procedures and methods. Backups must be encrypted, retained, and resources must be designed for recoverability across availability zones and regions.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 12",
+        "ArticleTitle": "Backup policies and procedures, restoration and recovery procedures and methods"
+      },
+      "checks": {
+        "aws": [
+          "backup_plans_exist",
+          "backup_vaults_exist",
+          "backup_vaults_encrypted",
+          "backup_recovery_point_encrypted",
+          "backup_reportplans_exist",
+          "rds_instance_backup_enabled",
+          "rds_cluster_protected_by_backup_plan",
+          "rds_instance_protected_by_backup_plan",
+          "rds_instance_multi_az",
+          "rds_cluster_multi_az",
+          "rds_cluster_backtrack_enabled",
+          "rds_instance_deletion_protection",
+          "rds_cluster_deletion_protection",
+          "rds_snapshots_encrypted",
+          "s3_bucket_object_versioning",
+          "s3_bucket_object_lock",
+          "s3_bucket_cross_region_replication",
+          "s3_bucket_no_mfa_delete",
+          "dynamodb_tables_pitr_enabled",
+          "dynamodb_table_deletion_protection_enabled",
+          "ec2_ebs_volume_protected_by_backup_plan",
+          "ec2_ebs_volume_snapshots_exists",
+          "autoscaling_group_multiple_az",
+          "elb_is_in_multiple_az",
+          "elbv2_is_in_multiple_az",
+          "cloudfront_distributions_multiple_origin_failover_configured",
+          "dynamodb_table_protected_by_backup_plan"
+        ],
+        "azure": [
+          "vm_backup_enabled",
+          "vm_sufficient_daily_backup_retention_period",
+          "vm_ensure_using_managed_disks",
+          "storage_ensure_soft_delete_is_enabled",
+          "storage_ensure_file_shares_soft_delete_is_enabled",
+          "storage_blob_versioning_is_enabled",
+          "storage_geo_redundant_enabled",
+          "keyvault_recoverable"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art13",
+      "name": "Learning and evolving",
+      "description": "Financial entities shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, perform post ICT-related incident reviews, and continuously feed lessons learnt back into the ICT risk assessment process. Findings aggregation and continuous insights drive this cycle.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 13",
+        "ArticleTitle": "Learning and evolving"
+      },
+      "checks": {
+        "aws": [
+          "securityhub_enabled",
+          "guardduty_no_high_severity_findings",
+          "inspector2_active_findings_exist",
+          "accessanalyzer_enabled_without_findings",
+          "cloudtrail_insights_exist"
+        ],
+        "azure": [
+          "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
+          "defender_assessments_vm_endpoint_protection_installed",
+          "defender_container_images_resolved_vulnerabilities",
+          "defender_container_images_scan_enabled",
+          "defender_ensure_system_updates_are_applied",
+          "sqlserver_vulnerability_assessment_enabled",
+          "sqlserver_va_periodic_recurring_scans_enabled",
+          "sqlserver_va_scan_reports_configured"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art14",
+      "name": "Communication",
+      "description": "As part of the ICT risk management framework, financial entities shall have in place crisis communication plans enabling a responsible disclosure of ICT-related incidents or major vulnerabilities to clients, counterparts and the public. Reliable, encrypted and access-controlled notification channels are required.",
+      "attributes": {
+        "Pillar": "ICT Risk Management",
+        "Article": "Article 14",
+        "ArticleTitle": "Communication"
+      },
+      "checks": {
+        "aws": [
+          "sns_topics_kms_encryption_at_rest_enabled",
+          "sns_topics_not_publicly_accessible",
+          "sns_subscription_not_using_http_endpoints",
+          "eventbridge_bus_exposed",
+          "eventbridge_bus_cross_account_access",
+          "eventbridge_schema_registry_cross_account_access",
+          "cloudwatch_alarm_actions_enabled",
+          "cloudwatch_alarm_actions_alarm_state_configured"
+        ],
+        "azure": [
+          "defender_additional_email_configured_with_a_security_contact",
+          "defender_ensure_notify_emails_to_owners",
+          "defender_ensure_notify_alerts_severity_is_high",
+          "defender_attack_path_notifications_properly_configured",
+          "monitor_alert_service_health_exists"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art17",
+      "name": "ICT-related incident management process",
+      "description": "Financial entities shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents. Comprehensive trail logging, log integrity protection, retention and centralisation of ICT events are foundational requirements.",
+      "attributes": {
+        "Pillar": "ICT-Related Incident Reporting",
+        "Article": "Article 17",
+        "ArticleTitle": "ICT-related incident management process"
+      },
+      "checks": {
+        "aws": [
+          "cloudtrail_multi_region_enabled",
+          "cloudtrail_multi_region_enabled_logging_management_events",
+          "cloudtrail_kms_encryption_enabled",
+          "cloudtrail_log_file_validation_enabled",
+          "cloudtrail_cloudwatch_logging_enabled",
+          "cloudtrail_logs_s3_bucket_access_logging_enabled",
+          "cloudtrail_logs_s3_bucket_is_not_publicly_accessible",
+          "cloudtrail_s3_dataevents_read_enabled",
+          "cloudtrail_s3_dataevents_write_enabled",
+          "cloudtrail_bucket_requires_mfa_delete",
+          "cloudtrail_bedrock_logging_enabled",
+          "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "cloudwatch_log_group_kms_encryption_enabled",
+          "cloudwatch_log_group_no_secrets_in_logs",
+          "cloudwatch_log_group_not_publicly_accessible",
+          "vpc_flow_logs_enabled",
+          "ec2_client_vpn_endpoint_connection_logging_enabled",
+          "route53_public_hosted_zones_cloudwatch_logging_enabled",
+          "elb_logging_enabled",
+          "elbv2_logging_enabled",
+          "cloudfront_distributions_logging_enabled",
+          "s3_bucket_server_access_logging_enabled"
+        ],
+        "azure": [
+          "monitor_diagnostic_settings_exists",
+          "monitor_diagnostic_setting_with_appropriate_categories",
+          "monitor_storage_account_with_activity_logs_is_private",
+          "monitor_storage_account_with_activity_logs_cmk_encrypted",
+          "network_flow_log_captured_sent",
+          "network_flow_log_more_than_90_days",
+          "keyvault_logging_enabled",
+          "sqlserver_auditing_enabled",
+          "sqlserver_auditing_retention_90_days",
+          "mysql_flexible_server_audit_log_enabled",
+          "mysql_flexible_server_audit_log_connection_activated",
+          "postgresql_flexible_server_log_checkpoints_on",
+          "postgresql_flexible_server_log_connections_on",
+          "postgresql_flexible_server_log_disconnections_on",
+          "postgresql_flexible_server_log_retention_days_greater_3",
+          "app_http_logs_enabled",
+          "app_function_application_insights_enabled",
+          "appinsights_ensure_is_configured"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art18",
+      "name": "Classification of ICT-related incidents and cyber threats",
+      "description": "Financial entities shall classify ICT-related incidents and shall determine their impact based on criteria such as the number of clients affected, duration, geographical spread, data losses, and criticality of the services affected. Severity-aware threat detection across the estate underpins this classification.",
+      "attributes": {
+        "Pillar": "ICT-Related Incident Reporting",
+        "Article": "Article 18",
+        "ArticleTitle": "Classification of ICT-related incidents and cyber threats"
+      },
+      "checks": {
+        "aws": [
+          "guardduty_no_high_severity_findings",
+          "guardduty_centrally_managed",
+          "guardduty_delegated_admin_enabled_all_regions",
+          "securityhub_enabled",
+          "inspector2_active_findings_exist",
+          "accessanalyzer_enabled_without_findings",
+          "cloudtrail_threat_detection_enumeration",
+          "cloudtrail_threat_detection_llm_jacking",
+          "cloudtrail_threat_detection_privilege_escalation"
+        ],
+        "azure": [
+          "defender_ensure_notify_alerts_severity_is_high",
+          "defender_attack_path_notifications_properly_configured",
+          "defender_ensure_defender_for_server_is_on",
+          "defender_ensure_wdatp_is_enabled",
+          "defender_ensure_mcas_is_enabled",
+          "sqlserver_microsoft_defender_enabled",
+          "apim_threat_detection_llm_jacking"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art19",
+      "name": "Reporting of major ICT-related incidents and voluntary notification of significant cyber threats",
+      "description": "Financial entities shall report major ICT-related incidents to the relevant competent authority and may, on a voluntary basis, notify significant cyber threats. Detective metric filters, change-tracking alarms and reliable notification topics are needed to surface and route reportable events.",
+      "attributes": {
+        "Pillar": "ICT-Related Incident Reporting",
+        "Article": "Article 19",
+        "ArticleTitle": "Reporting of major ICT-related incidents and voluntary notification of significant cyber threats"
+      },
+      "checks": {
+        "aws": [
+          "cloudwatch_log_metric_filter_authentication_failures",
+          "cloudwatch_log_metric_filter_unauthorized_api_calls",
+          "cloudwatch_log_metric_filter_root_usage",
+          "cloudwatch_log_metric_filter_sign_in_without_mfa",
+          "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk",
+          "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes",
+          "cloudwatch_log_metric_filter_policy_changes",
+          "cloudwatch_log_metric_filter_security_group_changes",
+          "cloudwatch_log_metric_filter_aws_organizations_changes",
+          "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled",
+          "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled",
+          "cloudwatch_changes_to_network_acls_alarm_configured",
+          "cloudwatch_changes_to_network_gateways_alarm_configured",
+          "cloudwatch_changes_to_network_route_tables_alarm_configured",
+          "cloudwatch_changes_to_vpcs_alarm_configured",
+          "sns_subscription_not_using_http_endpoints"
+        ],
+        "azure": [
+          "monitor_alert_create_policy_assignment",
+          "monitor_alert_delete_policy_assignment",
+          "monitor_alert_create_update_nsg",
+          "monitor_alert_delete_nsg",
+          "monitor_alert_create_update_security_solution",
+          "monitor_alert_delete_security_solution",
+          "monitor_alert_create_update_sqlserver_fr",
+          "monitor_alert_delete_sqlserver_fr",
+          "monitor_alert_create_update_public_ip_address_rule",
+          "monitor_alert_delete_public_ip_address_rule",
+          "monitor_alert_service_health_exists",
+          "defender_additional_email_configured_with_a_security_contact"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art24",
+      "name": "General requirements for the performance of digital operational resilience testing",
+      "description": "Financial entities shall establish, maintain and review a sound and comprehensive digital operational resilience testing programme, as an integral part of the ICT risk management framework. Continuous vulnerability discovery, configuration assessment and instance manageability are foundational.",
+      "attributes": {
+        "Pillar": "Digital Operational Resilience Testing",
+        "Article": "Article 24",
+        "ArticleTitle": "General requirements for the performance of digital operational resilience testing"
+      },
+      "checks": {
+        "aws": [
+          "inspector2_is_enabled",
+          "inspector2_active_findings_exist",
+          "securityhub_enabled",
+          "ec2_instance_managed_by_ssm",
+          "ec2_instance_with_outdated_ami",
+          "ssm_managed_compliant_patching"
+        ],
+        "azure": [
+          "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
+          "defender_ensure_system_updates_are_applied",
+          "defender_container_images_scan_enabled",
+          "defender_assessments_vm_endpoint_protection_installed",
+          "sqlserver_vulnerability_assessment_enabled",
+          "sqlserver_va_periodic_recurring_scans_enabled",
+          "vm_ensure_using_approved_images",
+          "vm_desired_sku_size"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art25",
+      "name": "Testing of ICT tools and systems",
+      "description": "Financial entities shall ensure that tests are undertaken on ICT tools and systems, on critical ICT systems supporting all critical or important functions, at least yearly. Vulnerability assessments, deprecated component detection and certificate hygiene must be tracked.",
+      "attributes": {
+        "Pillar": "Digital Operational Resilience Testing",
+        "Article": "Article 25",
+        "ArticleTitle": "Testing of ICT tools and systems"
+      },
+      "checks": {
+        "aws": [
+          "inspector2_is_enabled",
+          "inspector2_active_findings_exist",
+          "guardduty_is_enabled",
+          "guardduty_no_high_severity_findings",
+          "config_recorder_all_regions_enabled",
+          "ec2_instance_with_outdated_ami",
+          "ec2_instance_managed_by_ssm",
+          "ec2_instance_paravirtual_type",
+          "rds_instance_deprecated_engine_version",
+          "acm_certificates_expiration_check",
+          "rds_instance_certificate_expiration",
+          "iam_no_expired_server_certificates_stored",
+          "ssm_managed_compliant_patching"
+        ],
+        "azure": [
+          "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
+          "defender_container_images_resolved_vulnerabilities",
+          "sqlserver_vulnerability_assessment_enabled",
+          "sqlserver_va_periodic_recurring_scans_enabled",
+          "sqlserver_va_scan_reports_configured",
+          "sqlserver_va_emails_notifications_admins_enabled",
+          "keyvault_key_expiration_set_in_non_rbac",
+          "keyvault_rbac_key_expiration_set",
+          "keyvault_non_rbac_secret_expiration_set",
+          "keyvault_rbac_secret_expiration_set",
+          "app_ensure_java_version_is_latest",
+          "app_ensure_php_version_is_latest",
+          "app_ensure_python_version_is_latest",
+          "app_function_latest_runtime_version",
+          "storage_smb_protocol_version_is_latest"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art28",
+      "name": "General principles (ICT third-party risk)",
+      "description": "Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework. Cross-account access, trust boundaries, organization-level controls and dependency visibility are critical to monitor third-party exposure on AWS.",
+      "attributes": {
+        "Pillar": "ICT Third-Party Risk Management",
+        "Article": "Article 28",
+        "ArticleTitle": "General principles (ICT third-party risk)"
+      },
+      "checks": {
+        "aws": [
+          "iam_role_cross_service_confused_deputy_prevention",
+          "iam_role_cross_account_readonlyaccess_policy",
+          "iam_no_custom_policy_permissive_role_assumption",
+          "accessanalyzer_enabled",
+          "accessanalyzer_enabled_without_findings",
+          "s3_bucket_cross_account_access",
+          "dynamodb_table_cross_account_access",
+          "eventbridge_bus_cross_account_access",
+          "eventbridge_schema_registry_cross_account_access",
+          "cloudwatch_cross_account_sharing_disabled",
+          "organizations_delegated_administrators",
+          "organizations_account_part_of_organizations",
+          "organizations_scp_check_deny_regions",
+          "vpc_endpoint_connections_trust_boundaries",
+          "vpc_endpoint_services_allowed_principals_trust_boundaries",
+          "vpc_peering_routing_tables_with_least_privilege",
+          "awslambda_function_using_cross_account_layers"
+        ],
+        "azure": [
+          "entra_policy_guest_users_access_restrictions",
+          "entra_policy_guest_invite_only_for_admin_roles",
+          "entra_policy_restricts_user_consent_for_apps",
+          "entra_policy_user_consent_for_verified_apps",
+          "storage_cross_tenant_replication_disabled",
+          "containerregistry_uses_private_link",
+          "cosmosdb_account_use_private_endpoints",
+          "keyvault_access_only_through_private_endpoints",
+          "aks_clusters_created_with_private_nodes"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art30",
+      "name": "Key contractual provisions",
+      "description": "Contractual arrangements with ICT third-party service providers shall be set out in writing and include, at minimum, agreed service levels and clear allocation of rights and obligations. Privilege boundaries, least-privilege policies and absence of administrative wildcards are the technical guardrails that enforce these contractual constraints inside AWS.",
+      "attributes": {
+        "Pillar": "ICT Third-Party Risk Management",
+        "Article": "Article 30",
+        "ArticleTitle": "Key contractual provisions"
+      },
+      "checks": {
+        "aws": [
+          "iam_aws_attached_policy_no_administrative_privileges",
+          "iam_customer_attached_policy_no_administrative_privileges",
+          "iam_customer_unattached_policy_no_administrative_privileges",
+          "iam_inline_policy_no_administrative_privileges",
+          "iam_inline_policy_allows_privilege_escalation",
+          "iam_policy_allows_privilege_escalation",
+          "iam_inline_policy_no_full_access_to_cloudtrail",
+          "iam_inline_policy_no_full_access_to_kms",
+          "iam_policy_no_full_access_to_cloudtrail",
+          "iam_policy_no_full_access_to_kms",
+          "iam_role_administratoraccess_policy",
+          "iam_user_administrator_access_policy",
+          "iam_group_administrator_access_policy",
+          "iam_administrator_access_with_mfa",
+          "iam_policy_attached_only_to_group_or_roles",
+          "accessanalyzer_enabled"
+        ],
+        "azure": [
+          "iam_subscription_roles_owner_custom_not_created",
+          "iam_role_user_access_admin_restricted",
+          "iam_custom_role_has_permissions_to_administer_resource_locks",
+          "entra_global_admin_in_less_than_five_users",
+          "app_function_identity_without_admin_privileges",
+          "entra_policy_default_users_cannot_create_security_groups",
+          "entra_policy_ensure_default_user_cannot_create_apps"
+        ]
+      }
+    },
+    {
+      "id": "DORA-Art45",
+      "name": "Information-sharing arrangements on cyber threat information and intelligence",
+      "description": "Financial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques and procedures, cyber security alerts and configuration tools. Centralised threat detection, sensitive data discovery and trail-based intelligence enable participation in such information-sharing arrangements.",
+      "attributes": {
+        "Pillar": "Information Sharing",
+        "Article": "Article 45",
+        "ArticleTitle": "Information-sharing arrangements on cyber threat information and intelligence"
+      },
+      "checks": {
+        "aws": [
+          "guardduty_is_enabled",
+          "guardduty_centrally_managed",
+          "securityhub_enabled",
+          "macie_is_enabled",
+          "macie_automated_sensitive_data_discovery_enabled",
+          "cloudtrail_threat_detection_enumeration",
+          "cloudtrail_threat_detection_llm_jacking",
+          "cloudtrail_threat_detection_privilege_escalation",
+          "accessanalyzer_enabled_without_findings"
+        ],
+        "azure": [
+          "defender_ensure_mcas_is_enabled",
+          "defender_ensure_wdatp_is_enabled",
+          "defender_ensure_defender_for_server_is_on",
+          "defender_attack_path_notifications_properly_configured",
+          "sqlserver_microsoft_defender_enabled",
+          "apim_threat_detection_llm_jacking"
+        ]
+      }
+    }
+  ]
+}
diff --git a/prowler/compliance/gcp/ccc_gcp.json b/prowler/compliance/gcp/ccc_gcp.json
index df6b15bc5c..67a75841ef 100644
--- a/prowler/compliance/gcp/ccc_gcp.json
+++ b/prowler/compliance/gcp/ccc_gcp.json
@@ -889,7 +889,7 @@
         }
       ],
       "Checks": [
-        "kms_key_rotation_enabled"
+        "kms_key_rotation_max_90_days"
       ]
     },
     {
diff --git a/prowler/compliance/gcp/cis_2.0_gcp.json b/prowler/compliance/gcp/cis_2.0_gcp.json
index d391bcc271..dd9eb62a96 100644
--- a/prowler/compliance/gcp/cis_2.0_gcp.json
+++ b/prowler/compliance/gcp/cis_2.0_gcp.json
@@ -150,7 +150,7 @@
       "Id": "1.10",
       "Description": "Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management.   The format for the rotation schedule depends on the client library that is used. For the gcloud command-line tool, the next rotation time must be in `ISO` or `RFC3339` format, and the rotation period must be in the form `INTEGERUNIT`, where units can be one of seconds (s), minutes (m), hours (h) or days (d).",
       "Checks": [
-        "kms_key_rotation_enabled"
+        "kms_key_rotation_max_90_days"
       ],
       "Attributes": [
         {
diff --git a/prowler/compliance/gcp/cis_3.0_gcp.json b/prowler/compliance/gcp/cis_3.0_gcp.json
index b8d796c35a..958a2a9bc3 100644
--- a/prowler/compliance/gcp/cis_3.0_gcp.json
+++ b/prowler/compliance/gcp/cis_3.0_gcp.json
@@ -201,7 +201,7 @@
       "Id": "1.10",
       "Description": "Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days",
       "Checks": [
-        "kms_key_rotation_enabled"
+        "kms_key_rotation_max_90_days"
       ],
       "Attributes": [
         {
diff --git a/prowler/compliance/gcp/cis_4.0_gcp.json b/prowler/compliance/gcp/cis_4.0_gcp.json
index 5cd97a87da..d7a3c5d7a2 100644
--- a/prowler/compliance/gcp/cis_4.0_gcp.json
+++ b/prowler/compliance/gcp/cis_4.0_gcp.json
@@ -201,7 +201,7 @@
       "Id": "1.10",
       "Description": "Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days",
       "Checks": [
-        "kms_key_rotation_enabled"
+        "kms_key_rotation_max_90_days"
       ],
       "Attributes": [
         {
diff --git a/prowler/compliance/gcp/csa_ccm_4.0_gcp.json b/prowler/compliance/gcp/csa_ccm_4.0_gcp.json
deleted file mode 100644
index 6623fe5eca..0000000000
--- a/prowler/compliance/gcp/csa_ccm_4.0_gcp.json
+++ /dev/null
@@ -1,7386 +0,0 @@
-{
-  "Framework": "CSA-CCM",
-  "Name": "CSA Cloud Controls Matrix (CCM) v4.0.13",
-  "Version": "4.0",
-  "Provider": "GCP",
-  "Description": "The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing, composed of 197 control objectives structured in 17 domains covering all key aspects of cloud technology. The CCM can be used as a tool for the systematic assessment of a cloud implementation, and provides guidance on which security controls should be implemented by which actor within the cloud supply chain.",
-  "Requirements": [
-    {
-      "Id": "A&A-02",
-      "Description": "Conduct independent audit and assurance assessments according to relevant standards at least annually.",
-      "Name": "Independent Assessments",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC4.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AAC-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.2",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.2.1",
-                "27002: 18.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.35",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-2",
-                "CA-2(1)",
-                "CA-2(2)",
-                "CA-7",
-                "CA-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_audit_logs_enabled"
-      ]
-    },
-    {
-      "Id": "A&A-04",
-      "Description": "Verify compliance with all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit.",
-      "Name": "Requirements Compliance",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01",
-                "GRM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.18.2.2",
-                "27002: 18.2.2",
-                "27001: A.18.2.3",
-                "27002: 18.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-3",
-                "DE.DP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_audit_logs_enabled",
-        "iam_cloud_asset_inventory_enabled"
-      ]
-    },
-    {
-      "Id": "AIS-04",
-      "Description": "Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.",
-      "Name": "Secure Application Design and Development",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27017: 14.1.1",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.14.2.1",
-                "27002: 14.2.1",
-                "27017: 14.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.8",
-                "27001: A.8.25",
-                "27001: A.8.26",
-                "27001: A.8.28"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PL-8",
-                "PL-8(1)",
-                "SA-3",
-                "SA-3(1)",
-                "SA-4",
-                "SA-4(2)",
-                "SA-4(3)",
-                "SA-4(8)",
-                "SA-4(9)",
-                "SA-5",
-                "SA-8",
-                "SA-8(1)-(7)",
-                "SA-8(9)-(13)",
-                "SA-8(15)-(20)",
-                "SA-8(22)",
-                "SA-8(24)-(28)",
-                "SA-8(30)-(33)",
-                "SA-17",
-                "SA-17(1)-(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-6",
-                "PR.DS-7",
-                "PR.IP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1",
-                "6.2.3",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "AIS-05",
-      "Description": "Implement a testing strategy, including criteria for acceptance of new information systems, upgrades and new versions, which provides application security assurance and maintains compliance while enabling organizational speed of delivery goals. Automate when applicable and possible.",
-      "Name": "Automated Application Security Testing",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.12",
-                "16.13"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.3",
-                "SD2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.8",
-                "27001: A.14.2.9",
-                "27001: A.12.1.2",
-                "27002: 12.1.2",
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.25",
-                "27001: A.8.29",
-                "27001: A.8.32",
-                "27002: 8.25 (e)",
-                "27002: 8.32 (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SA-11",
-                "SA-11(1)-(9)",
-                "SI-6",
-                "SI-6(2)",
-                "SI-6(3)",
-                "SI-10",
-                "SI-10(1)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.IP-12",
-                "DE.CM-8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "PR.PS-01",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A.3.2.2",
-                "A.3.2.2.1",
-                "6.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.4",
-                "6.4.1",
-                "6.4.2",
-                "6.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "gcr_container_scanning_enabled",
-        "artifacts_container_analysis_enabled"
-      ]
-    },
-    {
-      "Id": "AIS-07",
-      "Description": "Define and implement a process to remediate application security vulnerabilities, automating remediation when possible.",
-      "Name": "Application Vulnerability Remediation",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1",
-                "CC7.4",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.2",
-                "16.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27001: A.12.6.1",
-                "27002: 12.6.1",
-                "27017: 12.6.1",
-                "27018: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27002: 5.26 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-2",
-                "SI-2(2)-(6)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-15",
-                "SA-15(1)-(3)",
-                "SA-15(5)-(8)",
-                "SA-15(10)-(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.IP-12",
-                "DE.CM-8",
-                "RS.AN-5",
-                "RS.MI-3",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.2",
-                "6.5",
-                "6.5.1-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "11.3.1",
-                "11.3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "gcr_container_scanning_enabled",
-        "artifacts_container_analysis_enabled"
-      ]
-    },
-    {
-      "Id": "BCR-08",
-      "Description": "Periodically backup data stored in the cloud. Ensure the confidentiality, integrity and availability of the backup, and verify data restoration from backup for resiliency.",
-      "Name": "Backup",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "A1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "11.1",
-                "11.2",
-                "11.3",
-                "11.4",
-                "11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27017: 12.3",
-                "27018: 12.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.13",
-                "27001: A.5.23",
-                "27001: A.5.30",
-                "27002: 8.13",
-                "27002: 5.23 2nd (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-4",
-                "CP-4(4)",
-                "CP-6",
-                "CP-6(1)-(3)",
-                "CP-9",
-                "CP-9(1)",
-                "CP-9(2)",
-                "CP-10",
-                "CP-10(2)",
-                "CP-10(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-4",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-11",
-                "RC.RP-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.5.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "10.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudsql_instance_automated_backups",
-        "cloudstorage_bucket_versioning_enabled",
-        "cloudstorage_bucket_soft_delete_enabled"
-      ]
-    },
-    {
-      "Id": "BCR-09",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain a disaster response plan to recover from natural and man-made disasters. Update the plan at least annually or upon significant changes.",
-      "Name": "Disaster Response Plan",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9",
-                "1.6.1",
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.4",
-                "BC2.1",
-                "BC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.29",
-                "27001: A.5.30",
-                "27002: 5.29",
-                "27002: 5.30"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2(1)",
-                "CP-2(2)",
-                "CP-2(3)",
-                "CP-2(5)",
-                "CP-2(6)",
-                "CP-2(7)",
-                "CP-2(8)",
-                "PE-13",
-                "PE-13(1)",
-                "PE-13(2)",
-                "PE-13(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-9",
-                "PR.IP-10",
-                "RC.IM-1",
-                "RC.IM-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "BCR-11",
-      "Description": "Supplement business-critical equipment with redundant equipment independently located at a reasonable minimum distance in accordance with applicable industry standards.",
-      "Name": "Equipment Redundancy",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-06"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.20",
-                "27001: A.7.11",
-                "27001: A.8.14",
-                "27002: 5.20 (t)",
-                "27002: 8.14 (c)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "CP-4(3)",
-                "CP-6",
-                "CP-6(1)",
-                "CP-7",
-                "CP-8",
-                "CP-8(1)-(3)",
-                "CP-9",
-                "CP-9(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.BE-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.OC-04",
-                "GV.OC-05",
-                "PR.IR-03"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_instance_automatic_restart_enabled",
-        "compute_instance_group_autohealing_enabled",
-        "compute_instance_group_load_balancer_attached",
-        "compute_instance_group_multiple_zones",
-        "compute_instance_on_host_maintenance_migrate"
-      ]
-    },
-    {
-      "Id": "CCC-04",
-      "Description": "Restrict the unauthorized addition, removal, update, and management of organization assets.",
-      "Name": "Unauthorized Change Protection",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "CCC-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.1",
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4",
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.1.4",
-                "27002: 12.1.4",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27001: A.14.2.2",
-                "27017: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.3",
-                "27001: A.8.4",
-                "27001: A.8.15",
-                "27001: A.8.31",
-                "27001: A.8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(4)",
-                "CM-3",
-                "CM-3(1)",
-                "CM-3(5)",
-                "CM-3(7)",
-                "CM-3(8)",
-                "CM-5",
-                "CM-5(1)",
-                "CM-5(4)",
-                "CM-5(5)",
-                "CM-6",
-                "CM-6(1)",
-                "CM-6(2)",
-                "CM-7",
-                "CM-7(1)",
-                "CM-7(4)",
-                "CM-7(5)",
-                "CM-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.MA-1",
-                "PR.MA-2",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04",
-                "ID.AM-08",
-                "PR.PS-02",
-                "PR.PS-03",
-                "PR.PS-05",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.1",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_bucket_log_retention_policy_lock",
-        "iam_audit_logs_enabled",
-        "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled"
-      ]
-    },
-    {
-      "Id": "CCC-07",
-      "Description": "Implement detection measures with proactive notification in case of changes deviating from the established baseline.",
-      "Name": "Detection of Baseline Deviation",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.1",
-                "1.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.2",
-                "27001: A.14.2.4",
-                "27001: A.12.4.1",
-                "27002: 12.4.1 (g)",
-                "27001: A.5.1.1",
-                "27017: 5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.9",
-                "27001: A.8.15",
-                "27002: 8.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(2)",
-                "SI-2",
-                "SI-2(2)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.MA-1",
-                "PR.IP-1",
-                "DE.DP-4",
-                "PR.IP-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01",
-                "DE.CM-09",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.3",
-                "6.4.5.4",
-                "11.5",
-                "11.5.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "11.5.2",
-                "11.6.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled"
-      ]
-    },
-    {
-      "Id": "CEK-03",
-      "Description": "Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.",
-      "Name": "Data Encryption",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-03",
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6",
-                "3.1",
-                "3.11",
-                "11.3",
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.1",
-                "27001: A.18.1.2",
-                "27001: A.18.1.3",
-                "27001: A.18.1.4",
-                "27001: A.18.1.5",
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.18",
-                "27002: 18",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27001: A.14.1.3",
-                "27002 14.1.3 c)",
-                "27001 - A.10.1.1",
-                "27017 - 10.1.1",
-                "27001 - A.10.1.2",
-                "27017 - 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.24",
-                "27002: 8.24 Other Information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19",
-                "AC-19(5)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-8(3)",
-                "SC-8(4)",
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)-(3)",
-                "SI-4",
-                "SI-4(10)",
-                "SI-7",
-                "SI-7(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "Requirement 3",
-                "2.2.3",
-                "2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_instance_encryption_with_csek_enabled",
-        "compute_instance_confidential_computing_enabled",
-        "bigquery_dataset_cmk_encryption",
-        "bigquery_table_cmk_encryption",
-        "cloudsql_instance_ssl_connections",
-        "dataproc_encrypted_with_cmks_disabled"
-      ]
-    },
-    {
-      "Id": "CEK-04",
-      "Description": "Use encryption algorithms that are appropriate for data protection, considering the classification of data, associated risks, and usability of the encryption technology.",
-      "Name": "Encryption Algorithm",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.2",
-                "27002: 8.2",
-                "27001: A.8.3",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (b)",
-                "27001: A.10.1.2",
-                "27002: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.24",
-                "27001: A.5.12",
-                "27001: A.5.13",
-                "27002: 8.24 General (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A2",
-                "Requirement 3",
-                "2.3",
-                "2.2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "dns_rsasha1_in_use_to_key_sign_in_dnssec",
-        "dns_rsasha1_in_use_to_zone_sign_in_dnssec"
-      ]
-    },
-    {
-      "Id": "CEK-08",
-      "Description": "CSPs must provide the capability for CSCs to manage their own data encryption keys.",
-      "Name": "CSC Key Management Capability",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27017: 10.1",
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.23",
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-9",
-                "CP-9(8)",
-                "SA-9",
-                "SA-9(6)",
-                "SC-12",
-                "SC-12(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.AM-6",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-05"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "bigquery_dataset_cmk_encryption",
-        "bigquery_table_cmk_encryption",
-        "compute_instance_encryption_with_csek_enabled",
-        "dataproc_encrypted_with_cmks_disabled",
-        "kms_key_not_publicly_accessible",
-        "kms_key_rotation_enabled"
-      ]
-    },
-    {
-      "Id": "CEK-10",
-      "Description": "Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.",
-      "Name": "Key Generation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "TS2.3",
-                "SY1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (e)",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2",
-                "27002: 10.1.2 (a)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24",
-                "27002: 8.24 (d), Key management (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2.3",
-                "3.6.1",
-                "PCI Glossary - Cryptographic Key Generation"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.6.1.1",
-                "3.7.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "bigquery_dataset_cmk_encryption",
-        "bigquery_table_cmk_encryption",
-        "dataproc_encrypted_with_cmks_disabled"
-      ]
-    },
-    {
-      "Id": "CEK-12",
-      "Description": "Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.",
-      "Name": "Key Rotation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 e)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (e,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "kms_key_rotation_enabled",
-        "iam_sa_user_managed_key_rotate_90_days",
-        "apikeys_key_rotated_in_90_days"
-      ]
-    },
-    {
-      "Id": "CEK-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to destroy keys stored outside a secure environment and revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, which include provisions for legal and regulatory requirements.",
-      "Name": "Key Destruction",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27017: 10.1.2",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 (j)",
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (j,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.IP-6",
-                "ID.GV-3",
-                "PR.DS-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "ID.AM-08",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.6.4",
-                "3.6.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_role_kms_enforce_separation_of_duties"
-      ]
-    },
-    {
-      "Id": "DCS-06",
-      "Description": "Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.",
-      "Name": "Assets Cataloguing and Tracking",
-      "Attributes": [
-        {
-          "Section": "Datacenter Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DCS - 01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "1.1",
-                "2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27017: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-8",
-                "CM-8(1)",
-                "CM-8(2)",
-                "CM-8(4)",
-                "CM-8(7)",
-                "CM-8(8)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4",
-                "9.7.1",
-                "9.9.1",
-                "9.9.1.a",
-                "9.9.1.b",
-                "9.9.1.c",
-                "12.3.3",
-                "12.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1.1",
-                "6.3.2",
-                "9.4.2",
-                "9.4.3",
-                "12.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_cloud_asset_inventory_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-02",
-      "Description": "Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.",
-      "Name": "Secure Disposal",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3",
-                "CC6.4",
-                "CC6.5",
-                "CC6.7",
-                "P4.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-07"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.3",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.3.2",
-                "27002: 8.3.2",
-                "27001: A.11.2.7",
-                "27002: 11.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.7.10",
-                "27001: A.7.14",
-                "27001: A.8.10",
-                "27002: 7.10 (Secure reuse or disposal)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-22",
-                "SI-12",
-                "SI-12(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-10",
-                "PR.PS-02",
-                "PR.PS-03",
-                "ID.AM-08"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1",
-                "9.8",
-                "9.8.1",
-                "9.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "3.7.5",
-                "9.4.7"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_bucket_lifecycle_management_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-03",
-      "Description": "Create and maintain a data inventory, at least for any sensitive data and personal data.",
-      "Name": "Data Inventory",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2",
-                "1.3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-12",
-                "CM-12(1)",
-                "PM-5",
-                "PM-5(1)",
-                "SI-12",
-                "SI-12(1)",
-                "SI-19",
-                "SI-19(1)",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "9.4.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_cloud_asset_inventory_enabled",
-        "iam_audit_logs_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-04",
-      "Description": "Classify data according to its type and sensitivity level.",
-      "Name": "Data Classification",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "C1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.2.1",
-                "27002: 8.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-16",
-                "AC-16(9)",
-                "PM-22",
-                "PM-23",
-                "PT-2",
-                "PT-2(1)",
-                "SI-18",
-                "SI-18(2)",
-                "SI-19",
-                "SI-19(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-05",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "9.4.2",
-                "9.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "DSP-07",
-      "Description": "Develop systems, products, and business practices based upon a principle of security by design and industry best practices.",
-      "Name": "Data Protection by Design and Default",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "PI1.2",
-                "PI1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.1",
-                "5.3.2",
-                "5.3.3",
-                "5.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.2",
-                "IM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002:14.1.1",
-                "27001: A.14.2.5",
-                "27002:14.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.27",
-                "27001: A.8.28",
-                "27001: A.8.29",
-                "27002: 5.8 (Information security requirements a-i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-17",
-                "PM-24",
-                "PM-25",
-                "PT-2",
-                "PT-2(2)",
-                "SA-3",
-                "SA-4",
-                "SA-5",
-                "SA-8",
-                "SA-8(9)",
-                "SA-8(13)",
-                "SA-8(18)",
-                "SA-8(20)",
-                "SA-8(22)",
-                "SA-8(23)",
-                "SA-8(33)",
-                "SA-15",
-                "SA-15(12)",
-                "SC-3",
-                "SC-3(3)",
-                "SC-7",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(4)",
-                "SC-28",
-                "SC-28(1)",
-                "SI-12",
-                "SI-12(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "bigquery_dataset_public_access",
-        "cloudsql_instance_public_access",
-        "cloudsql_instance_public_ip",
-        "cloudstorage_bucket_public_access",
-        "compute_image_not_publicly_shared",
-        "compute_instance_public_ip",
-        "kms_key_not_publicly_accessible"
-      ]
-    },
-    {
-      "Id": "DSP-10",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.",
-      "Name": "Sensitive Data Transfer",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.12",
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "9.5.1",
-                "9.5.2",
-                "9.5.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.8.3.3",
-                "27002: 8.3.3",
-                "27001: A.13.2.3",
-                "27002: 13.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.7.10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-4",
-                "AC-4(23)-(25)",
-                "CA-3",
-                "CA-3(6)",
-                "CA-6",
-                "CA-6(1)",
-                "CA-6(2)",
-                "SC-4",
-                "SC-4(2)",
-                "SC-7",
-                "SC-7(10)",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-16",
-                "SC-16(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.DS-5",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.IR-01",
-                "ID.AM-03",
-                "GV.OC-03",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "4.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.1.1",
-                "4.2.1",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudsql_instance_ssl_connections"
-      ]
-    },
-    {
-      "Id": "DSP-16",
-      "Description": "Data retention, archiving and deletion is managed in accordance with business requirements, applicable laws and regulations.",
-      "Name": "Data Retention and Deletion",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "C1.1",
-                "C1.2",
-                "CC3.1",
-                "P4.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.4",
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.10",
-                "27002: 5.33 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-12",
-                "SI-12(1)-(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)",
-                "SI-19",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-3",
-                "PR.IP-6",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "GV.OC-03",
-                "GV.SC-10",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_bucket_lifecycle_management_enabled",
-        "cloudstorage_bucket_sufficient_retention_period"
-      ]
-    },
-    {
-      "Id": "DSP-17",
-      "Description": "Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.",
-      "Name": "Sensitive Data Protection",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSC-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.1",
-                "CC6.1",
-                "CC6.3",
-                "CC6.7",
-                "CC8.1",
-                "C1.1",
-                "P2.0",
-                "P3.0",
-                "P4.0",
-                "P5.0",
-                "P6.0"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.1",
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.3",
-                "9.1.1",
-                "9.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001:A.18.1.4",
-                "27002:18.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.11",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PM-22",
-                "PM-24",
-                "PT-7",
-                "PT-7(1)",
-                "PT-7(2)",
-                "PT-8",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.0 (including all subsections)",
-                "4.0 (including all subsections)"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_bucket_public_access",
-        "bigquery_dataset_public_access",
-        "cloudsql_instance_public_access",
-        "cloudsql_instance_public_ip",
-        "compute_instance_public_ip",
-        "compute_image_not_publicly_shared",
-        "kms_key_not_publicly_accessible"
-      ]
-    },
-    {
-      "Id": "GRC-05",
-      "Description": "Develop and implement an Information Security Program, which includes programs for all the relevant domains of the CCM.",
-      "Name": "Information Security Program",
-      "Attributes": [
-        {
-          "Section": "Governance, Risk and Compliance",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "14.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SG2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-1",
-                "PM-3",
-                "PM-14",
-                "PL-2",
-                "PM-18",
-                "PM-31"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.4.1",
-                "A.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.4.1",
-                "A3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_account_access_approval_enabled",
-        "iam_audit_logs_enabled",
-        "iam_organization_essential_contacts_configured"
-      ]
-    },
-    {
-      "Id": "IAM-02",
-      "Description": "Establish, document, approve, communicate, implement, apply, evaluate and maintain strong password policies and procedures. Review and update the policies and procedures at least annually.",
-      "Name": "Strong Password Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-12",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "4.1.2",
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1",
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.7.2.2",
-                "27002: 7.2.2",
-                "27001: A.9.2.6",
-                "27002: 9.2.6",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.17",
-                "27001: A.6.3",
-                "27001: A.8.5",
-                "27001: A.5.37"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-3",
-                "AC-3(3)",
-                "AC-12",
-                "AC-12(1)",
-                "IA-2",
-                "IA-2(10)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.AC-1",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.4",
-                "12.1",
-                "12.1.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.1.1",
-                "8.3.8"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "IAM-03",
-      "Description": "Manage, store, and review the information of system identities, and level of access.",
-      "Name": "Identity Inventory",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-04",
-                "IAM-08",
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27001: A.9.4.1",
-                "27002: 9.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.5.15",
-                "27001: A.5.16",
-                "27001: A.5.18",
-                "27001: A.7.4",
-                "27001: A.8.15",
-                "27001: A.8.2",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "AU-16",
-                "AU-16(1)",
-                "IA-4",
-                "IA-4(8)",
-                "IA-4(9)",
-                "IA-5",
-                "IA-5(5)",
-                "IA-8",
-                "IA-8(4)",
-                "PM-5(1)",
-                "SA-8",
-                "SA-8(22)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-04",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4.a"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_sa_user_managed_key_unused",
-        "iam_service_account_unused"
-      ]
-    },
-    {
-      "Id": "IAM-04",
-      "Description": "Employ the separation of duties principle when implementing information system access.",
-      "Name": "Separation of Duties",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC1.3",
-                "CC5.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.2",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.6.1.2",
-                "27002: 6.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18",
-                "27001: A.5.3",
-                "27001: A.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-6",
-                "AC-6(1)-(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4",
-                "6.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_role_sa_enforce_separation_of_duties",
-        "iam_role_kms_enforce_separation_of_duties",
-        "iam_no_service_roles_at_project_level"
-      ]
-    },
-    {
-      "Id": "IAM-05",
-      "Description": "Employ the least privilege principle when implementing information system access.",
-      "Name": "Least Privilege",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-06",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.1",
-                "27002: 9.1.1",
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.8.2",
-                "27002:  5.15 (Other information 2nd (a))"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "IA-12",
-                "IA-12(2)",
-                "IA-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1",
-                "7.1.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2",
-                "7.2.5",
-                "7.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "apikeys_api_restrictions_configured",
-        "compute_instance_default_service_account_in_use",
-        "compute_instance_default_service_account_in_use_with_full_api_access",
-        "gke_cluster_no_default_service_account",
-        "iam_no_service_roles_at_project_level",
-        "iam_sa_no_administrative_privileges"
-      ]
-    },
-    {
-      "Id": "IAM-07",
-      "Description": "De-provision or respectively modify access of movers / leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.",
-      "Name": "User Access Changes and Revocation",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.3",
-                "6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(1)",
-                "AC-2(2)",
-                "AC-2(6)",
-                "AC-2(8)",
-                "AC-3",
-                "AC-3(8)",
-                "AC-6",
-                "AC-6(7)",
-                "AU-10",
-                "AU-10(4)",
-                "AU-16",
-                "AU-16(1)",
-                "CM-7",
-                "CM-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.IP-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-04",
-                "GV.SC-10",
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.5",
-                "8.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_sa_user_managed_key_unused",
-        "iam_service_account_unused"
-      ]
-    },
-    {
-      "Id": "IAM-08",
-      "Description": "Review and revalidate user access for least privilege and separation of duties with a frequency that is commensurate with organizational risk tolerance.",
-      "Name": "User Access Review",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27001: A.9.2.6",
-                "27001: A.9.4.1",
-                "27017: 9.4.1",
-                "27001: A.6.1.2",
-                "27001: A 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.3",
-                "27001: A.5.18",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5.1",
-                "7.2.5",
-                "7.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_sa_user_managed_key_unused",
-        "iam_service_account_unused",
-        "iam_sa_user_managed_key_rotate_90_days"
-      ]
-    },
-    {
-      "Id": "IAM-09",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the segregation of privileged access roles such that administrative access to data, encryption and key management capabilities and logging capabilities are distinct and separated.",
-      "Name": "Segregation of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.1",
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-3(7)",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-5",
-                "IA-5(6)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.3",
-                "3.5.2",
-                "7.1.2",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.7.6",
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_role_kms_enforce_separation_of_duties",
-        "iam_role_sa_enforce_separation_of_duties",
-        "iam_sa_no_administrative_privileges"
-      ]
-    },
-    {
-      "Id": "IAM-10",
-      "Description": "Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access.",
-      "Name": "Management of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "6.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3",
-                "27001: A.9.4.4",
-                "27002: 9.4.4",
-                "27017: 9.4.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(7)",
-                "AC-3",
-                "AC-3(4)",
-                "AC-3(11)",
-                "AC-3(13)",
-                "AC-3(14)",
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(5)",
-                "AC-6(8)",
-                "AC-12",
-                "AC-12(3)",
-                "AC-17",
-                "AC-17(4)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_no_service_roles_at_project_level",
-        "iam_role_kms_enforce_separation_of_duties",
-        "iam_role_sa_enforce_separation_of_duties",
-        "iam_sa_no_administrative_privileges"
-      ]
-    },
-    {
-      "Id": "IAM-12",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the logging infrastructure is read-only for all with write access, including privileged access roles, and that the ability to disable it is controlled through a procedure that ensures the segregation of duties and break glass procedures.",
-      "Name": "Safeguard Logs Integrity",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1",
-                "27018: 12.4.1",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27017: 12.4.2",
-                "27018: 12.4.2",
-                "27001: A.12.4.3",
-                "27002: 12.4.3",
-                "27017: 12.4.3",
-                "27018: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.18",
-                "27002: 8.15 Protection of Logs"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(11)",
-                "AC-2(12)",
-                "IA-8",
-                "IA-8(4)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-34",
-                "SC-34(1)",
-                "SC-34(2)",
-                "SC-36",
-                "SI-4",
-                "SI-4(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_bucket_log_retention_policy_lock",
-        "cloudstorage_bucket_logging_enabled",
-        "logging_sink_created"
-      ]
-    },
-    {
-      "Id": "IAM-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure users are identifiable through unique IDs or which can associate individuals to the usage of user IDs.",
-      "Name": "Uniquely Identifiable Users",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.1",
-                "27002: 9.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(14)",
-                "AC-24",
-                "AC-24(2)",
-                "AU-10",
-                "AU-10(1)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-4",
-                "IA-4(1)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-23",
-                "SC-23(3)",
-                "SC-40(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1",
-                "8.2",
-                "8.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.1",
-                "8.2.2",
-                "8.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_project_os_login_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for authenticating access to systems, application and data assets, including multifactor authentication for at least privileged user and sensitive data access. Adopt digital certificates or alternatives which achieve an equivalent level of security for system identities.",
-      "Name": "Strong Authentication",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.3",
-                "6.5",
-                "12.5",
-                "12.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4",
-                "SA1.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27017: 9.1.2",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.9.4.2",
-                "27002: 9.4.2",
-                "27017: 9.4.2",
-                "27018: 9.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.17",
-                "27001: A.8.5",
-                "27001: A.8.24",
-                "27002: 8.5",
-                "27002: 8.24 other information (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(5)",
-                "AC-7",
-                "AC-7(4)",
-                "AU-10",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(8)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5",
-                "IA-5(2)",
-                "IA-5(7)",
-                "IA-5(9)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-5(14)-(16)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(6)",
-                "SC-23",
-                "SC-23(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3",
-                "8.1.6",
-                "8.2",
-                "8.3",
-                "8.3.2",
-                "12.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "8.3.1",
-                "8.3.2",
-                "8.4.1",
-                "8.4.2",
-                "8.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_project_os_login_2fa_enabled",
-        "compute_project_os_login_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-15",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the secure management of passwords.",
-      "Name": "Passwords Management",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27018: 9.2.4",
-                "27001: A.9.3.1",
-                "27002: 9.3.1",
-                "27017: 9.3.1",
-                "27018: 9.3.1",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.17"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IA-4",
-                "IA-4(8)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(8)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.2",
-                "8.2.1-6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.2",
-                "2.3.1",
-                "8.3.5",
-                "8.3.6",
-                "8.3.7",
-                "8.3.8",
-                "8.3.9",
-                "8.3.10",
-                "8.3.10.1",
-                "8.6.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "IAM-16",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.",
-      "Name": "Authorization Mechanisms",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27002: 9.2.5",
-                "27017: 9.2.5",
-                "27018: 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(5)",
-                "AC-4",
-                "AC-4(17)",
-                "AC-4(21)",
-                "AC-4(22)",
-                "AC-6",
-                "AC-6(8)",
-                "AC-6(9)",
-                "AC-12",
-                "AC-12(1)",
-                "AC-20",
-                "AC-20(1)",
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5(1)",
-                "IA-5(2)",
-                "IA-5(5)",
-                "IA-5(8)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.AC-6",
-                "PR.AC-7",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03",
-                "PR.AA-04",
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.3",
-                "7.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.4",
-                "7.2.3",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "apikeys_api_restrictions_configured",
-        "cloudstorage_bucket_uniform_bucket_level_access",
-        "compute_instance_default_service_account_in_use_with_full_api_access",
-        "iam_sa_no_administrative_privileges"
-      ]
-    },
-    {
-      "Id": "IPY-03",
-      "Description": "Implement cryptographically secure and standardized network protocols for the management, import and export of data.",
-      "Name": "Secure Interoperability and Portability Management",
-      "Attributes": [
-        {
-          "Section": "Interoperability & Portability",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IPY-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.2",
-                "NC1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1",
-                "27001: A.15.1.1",
-                "27002: 15.1.1",
-                "27017: 15.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.19",
-                "27001: A.5.23",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PT-2",
-                "PT-2(2)",
-                "SA-4",
-                "SC-16",
-                "SC-16(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.1",
-                "1.2.5",
-                "1.2.6",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudsql_instance_ssl_connections"
-      ]
-    },
-    {
-      "Id": "IVS-02",
-      "Description": "Plan and monitor the availability, quality, and adequate capacity of resources in order to deliver the required system performance as determined by the business.",
-      "Name": "Capacity and Resource Planning",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-04"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.3",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.12.1.3",
-                "27002: 12.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.3 (b)",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.8.6",
-                "27001: A.8.14"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "SC-5",
-                "SC-5(2)",
-                "SC-4",
-                "SI-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-04",
-                "GV.OC-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_instance_group_autohealing_enabled",
-        "compute_instance_group_load_balancer_attached",
-        "compute_instance_group_multiple_zones"
-      ]
-    },
-    {
-      "Id": "IVS-03",
-      "Description": "Monitor, encrypt and restrict communications between environments to only authenticated and authorized connections, as justified by the business. Review these configurations at least annually, and support them by a documented justification of all allowed services, protocols, ports, and compensating controls.",
-      "Name": "Network Security",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-06"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.8",
-                "3.1",
-                "12.2",
-                "13.6",
-                "13.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: A.5.15 2nd c)",
-                "27002: 8.20",
-                "27002: 8.21",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-1",
-                "SC-4",
-                "SC-7",
-                "SC-7(4)",
-                "SC-7(5)",
-                "SC-7(8)",
-                "SC-7(9)",
-                "SC-7(11)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-11",
-                "SC-12",
-                "SC-16",
-                "SC-23",
-                "SC-29",
-                "SC-29(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-5",
-                "PR.AC-7",
-                "PR.PT-4",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-01",
-                "PR.AA-03",
-                "PR.AA-05",
-                "DE.CM-01",
-                "PR.DS-02",
-                "ID.AM-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "1.1.6",
-                "1.2",
-                "1.2.3",
-                "2.2",
-                "4.1.1",
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.5",
-                "1.2.6",
-                "1.2.7",
-                "1.4.2",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1",
-                "10.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_firewall_rdp_access_from_the_internet_allowed",
-        "compute_firewall_ssh_access_from_the_internet_allowed",
-        "compute_instance_ip_forwarding_is_enabled",
-        "compute_network_default_in_use",
-        "compute_network_dns_logging_enabled",
-        "compute_network_not_legacy",
-        "compute_subnet_flow_logs_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-04",
-      "Description": "Harden host and guest OS, hypervisor or infrastructure control plane according to their respective best practices, and supported by technical controls, as part of a security baseline.",
-      "Name": "OS Hardening and Base Controls",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.8",
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-07",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "4.1",
-                "4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.3",
-                "SY1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2",
-                "27001: A.14.2.3",
-                "27001 A.14.2.4",
-                "27018: 12.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: 8.20",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(1)",
-                "SC-29",
-                "SC-29(1)",
-                "SC-2",
-                "SC-7",
-                "SC-7(12)",
-                "SC-30",
-                "SC-34",
-                "SC-35",
-                "SC-39",
-                "SC-44"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-1",
-                "PR.PT-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_instance_shielded_vm_enabled",
-        "compute_project_os_login_enabled",
-        "compute_instance_serial_ports_in_use",
-        "compute_instance_block_project_wide_ssh_keys_disabled"
-      ]
-    },
-    {
-      "Id": "IVS-06",
-      "Description": "Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.",
-      "Name": "Segmentation and Segregation",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-09"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.3.4",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.20",
-                "27001: A.8.3",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.22",
-                "27002: 5.15 (b)",
-                "27002: 8.3 (b)",
-                "27002: 8.16 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-3",
-                "SC-7",
-                "SC-7(20)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.AC-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.6",
-                "8.3.1",
-                "10.8",
-                "11.3",
-                "A3.2.1",
-                "A3.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A1.1.1",
-                "A1.1.2",
-                "A1.1.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudsql_instance_private_ip_assignment",
-        "cloudstorage_uses_vpc_service_controls",
-        "compute_instance_public_ip",
-        "compute_network_default_in_use",
-        "compute_network_not_legacy"
-      ]
-    },
-    {
-      "Id": "IVS-07",
-      "Description": "Use secure and encrypted communication channels when migrating servers, services, applications, or data to cloud environments. Such channels must include only up-to-date and approved protocols.",
-      "Name": "Migration to Cloud Environments",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-10"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM1.4",
-                "NC1.4",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27017: 13.1.1",
-                "27018: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27017: 13.1.2",
-                "27018: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3",
-                "27018: 13.1.3",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27017: 13.2.1",
-                "27018: 13.2.1",
-                "27001: A.13.2.2",
-                "27002: 13.2.2",
-                "27017: 13.2.2",
-                "27018: 13.2.2",
-                "27001: A.13.2.3",
-                "27002: 13.2.3",
-                "27017: 13.2.3",
-                "27018: 13.2.3",
-                "27001: A.13.2.4",
-                "27002: 13.2.4",
-                "27017: 13.2.4",
-                "27018: 13.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.20",
-                "27001: A.8.24",
-                "27002: 8.20 (e)",
-                "27002: 8.24 Guidance (b,f), other information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-17",
-                "AC-20",
-                "SC-7",
-                "SC-7(28)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-12",
-                "SC-23",
-                "SC-29",
-                "SI-7",
-                "SI-7(1)-(3)",
-                "SI-7(5)-(10)",
-                "SI-7(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudsql_instance_ssl_connections"
-      ]
-    },
-    {
-      "Id": "IVS-09",
-      "Description": "Define, implement and evaluate processes, procedures and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.",
-      "Name": "Network Defense",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.6",
-                "CC6.8",
-                "CC7.1",
-                "CC7.2",
-                "CC7.5"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-13"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "13.3",
-                "13.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3",
-                "5.2.4",
-                "5.2.5",
-                "5.2.7",
-                "5.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.11.1.4",
-                "27002: 11.1.4",
-                "27017: 11.1.4",
-                "27018: 16.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.5.24",
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.26",
-                "27002: 8.8 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-8",
-                "PL-8(1)",
-                "SC-5",
-                "SC-5(1)",
-                "SC-5(3)",
-                "SC-7",
-                "SC-7(13)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.DP-1",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.AC-5",
-                "RS.MI-2",
-                "PR.DS-2",
-                "RS.RP-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "DE.CM-01",
-                "PR.IR-01",
-                "RS.MA-01",
-                "RS.MI-01",
-                "RS.MI-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.6",
-                "1.1",
-                "1.2",
-                "1.3",
-                "1.5",
-                "12.10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.3.1",
-                "1.3.2",
-                "1.3.3",
-                "1.4.1",
-                "1.4.2",
-                "1.4.3",
-                "1.4.4",
-                "1.4.5",
-                "1.5.1",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_firewall_rdp_access_from_the_internet_allowed",
-        "compute_firewall_ssh_access_from_the_internet_allowed",
-        "compute_loadbalancer_logging_enabled",
-        "compute_public_address_shodan",
-        "dns_dnssec_disabled"
-      ]
-    },
-    {
-      "Id": "LOG-02",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.",
-      "Name": "Audit Logs Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1",
-                "8.9",
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.3",
-                "5.1.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-4",
-                "AU-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-08",
-                "PR.DS-11",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.7"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4",
-                "10.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_bucket_log_retention_policy_lock",
-        "cloudstorage_bucket_logging_enabled",
-        "logging_sink_created"
-      ]
-    },
-    {
-      "Id": "LOG-03",
-      "Description": "Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.",
-      "Name": "Security Monitoring and Alerting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03",
-                "SEF-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "5.2.7",
-                "1.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2",
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-3",
-                "DE.AE-5",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-4",
-                "DE.CM-5",
-                "DE.CM-6",
-                "DE.CM-7",
-                "DE.DP-1",
-                "DE.DP-4",
-                "DE.AE-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2",
-                "10.4.1.1",
-                "10.4.2.1",
-                "10.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-04",
-      "Description": "Restrict audit logs access to authorized personnel and maintain records that provide unique access accountability.",
-      "Name": "Audit Logs Access and Accountability",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.2",
-                "4.1.3",
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27001: A.12.4.1",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(4)",
-                "AU-9(6)",
-                "AU-10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.1",
-                "10.2.1",
-                "10.2.3",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1.3",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_bucket_public_access",
-        "cloudstorage_bucket_uniform_bucket_level_access",
-        "iam_audit_logs_enabled",
-        "kms_key_not_publicly_accessible"
-      ]
-    },
-    {
-      "Id": "LOG-05",
-      "Description": "Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.",
-      "Name": "Audit Logs Monitoring and Response",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.8",
-                "8.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "1.6.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.3",
-                "27002: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-6",
-                "AU-6(1)",
-                "AU-6(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-3",
-                "PR.PT-1",
-                "RS.AN-1",
-                "RS.CO-1.",
-                "DE.AE-1",
-                "DE.AE-5",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6",
-                "10.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.1.1",
-                "10.4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-07",
-      "Description": "Establish, document and implement which information meta/data system events should be logged. Review and update the scope at least annually or whenever there is a change in the threat environment.",
-      "Name": "Logging Scope",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-14",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.SC-4",
-                "PR.PT-1",
-                "ID.GV-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_audit_logs_enabled",
-        "cloudstorage_bucket_logging_enabled",
-        "compute_network_dns_logging_enabled",
-        "compute_subnet_flow_logs_enabled",
-        "iam_audit_logs_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-08",
-      "Description": "Generate audit records containing relevant security information.",
-      "Name": "Log Records",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-3",
-                "AU-3(1)",
-                "AU-3(3)",
-                "AU-6",
-                "AU-6(8)",
-                "AU-12",
-                "AU-12(1)",
-                "AU-12(2)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-6",
-                "DE.CM-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_audit_logs_enabled",
-        "compute_subnet_flow_logs_enabled",
-        "compute_loadbalancer_logging_enabled",
-        "compute_network_dns_logging_enabled",
-        "cloudstorage_audit_logs_enabled",
-        "cloudstorage_bucket_logging_enabled",
-        "logging_sink_created",
-        "cloudsql_instance_postgres_log_connections_flag",
-        "cloudsql_instance_postgres_log_disconnections_flag",
-        "cloudsql_instance_postgres_log_statement_flag",
-        "cloudsql_instance_postgres_enable_pgaudit_flag"
-      ]
-    },
-    {
-      "Id": "LOG-09",
-      "Description": "The information system protects audit records from unauthorized access, modification, and deletion.",
-      "Name": "Log Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04",
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(2)",
-                "AU-9(3)",
-                "AU-9(4)",
-                "AU-12(3)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_bucket_log_retention_policy_lock",
-        "cloudstorage_bucket_uniform_bucket_level_access"
-      ]
-    },
-    {
-      "Id": "LOG-10",
-      "Description": "Establish and maintain a monitoring and internal reporting capability over the operations of cryptographic, encryption and key management policies, processes, procedures, and controls.",
-      "Name": "Encryption Monitoring and Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.1.1",
-                "10.2.1",
-                "10.4.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "kms_key_rotation_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-11",
-      "Description": "Log and monitor key lifecycle management events to enable auditing and reporting on usage of cryptographic keys.",
-      "Name": "Transaction/Activity Logging",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudstorage_audit_logs_enabled",
-        "iam_audit_logs_enabled",
-        "logging_sink_created"
-      ]
-    },
-    {
-      "Id": "LOG-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the reporting of anomalies and failures of the monitoring system and provide immediate notification to the accountable party.",
-      "Name": "Failures and Anomalies Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.16.1.2",
-                "27017: 16.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.24",
-                "27001: A.6.8",
-                "27002: 6.8 (g)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-6",
-                "AU-6(3)",
-                "AU-6(4)",
-                "AU-6(5)",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-3",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.3",
-                "10.7.1",
-                "10.7.2",
-                "10.7.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
-        "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled"
-      ]
-    },
-    {
-      "Id": "SEF-03",
-      "Description": "'Establish, document, approve, communicate, apply, evaluate and maintain a security incident response plan, which includes but is not limited to: relevant internal departments, impacted CSCs, and other business critical relationships (such as supply-chain) that may be impacted.'",
-      "Name": "Incident Response Plans",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2",
-                "CC7.3",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2",
-                "17.4"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27017: CLD.12.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.5.26",
-                "27002: 5.26 (e,f)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-1",
-                "IR-2",
-                "IR-2(1)-(3)",
-                "IR-3",
-                "IR-3(1)-(3)",
-                "IR-4",
-                "IR-4(1)-(15)",
-                "IR-5",
-                "IR-5(1)",
-                "IR-6",
-                "IR-6(1)-(3)",
-                "IR-7",
-                "IR-7(1)",
-                "IR-7(2)",
-                "IR-8",
-                "IR-8(1)",
-                "IR-9",
-                "IR-9(1)-(4)",
-                "PM-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.CO-1",
-                "RS.CO-4",
-                "ID.AM-6",
-                "ID.GV-2",
-                "ID.SC-5",
-                "PR.IP-9",
-                "PR.IP10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AT-01",
-                "PR.AT-02",
-                "RS.MA-01",
-                "GV.SC-08",
-                "ID.IM-02",
-                "ID.IM-04",
-                "RC.RP-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "12.10.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "SEF-06",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.",
-      "Name": "Event Triage Processes",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.4",
-                "27002: 16.1.4",
-                "27017: 16.1.4",
-                "27018: 16.1.4",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.25"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(3)",
-                "CA-7(4)",
-                "CA-7(5)",
-                "CA-7(6)",
-                "IR-4",
-                "IR-4(1)",
-                "IR-4(3)",
-                "IR-4(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-4",
-                "RS.RP-1",
-                "RS.AN-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "RS.MA-02",
-                "RS.MA-03",
-                "RS.AN-03",
-                "DE.AE-02",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "RS.MI-02",
-                "RC.RP-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_audit_logs_enabled",
-        "logging_sink_created"
-      ]
-    },
-    {
-      "Id": "SEF-08",
-      "Description": "Maintain points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities.",
-      "Name": "Points of Contact Maintenance",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.2",
-                "27001: A.6.1.3",
-                "27002: 6.1.3",
-                "27017: 6.1.3",
-                "27018: 6.1.3",
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.18.1.1",
-                "27002: 18.1.1",
-                "27017: 18.1.1",
-                "27018: 18.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.5",
-                "27001: A.5.24",
-                "27002: 5.24 Incident management procedure (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-4",
-                "IR-4(8)",
-                "IR-6",
-                "IR-6(3)",
-                "IR-7",
-                "IR-7(2)",
-                "PM-21",
-                "PM-23",
-                "PM-26"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-2",
-                "RS.CO-3",
-                "RS.CO-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-02",
-                "RS.CO-02",
-                "RS.CO-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "iam_organization_essential_contacts_configured"
-      ]
-    },
-    {
-      "Id": "TVM-02",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect against malware on managed assets. Review and update the policies and procedures at least annually.",
-      "Name": "Malware Protection Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.8"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-01",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "9.7",
-                "10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.2",
-                "TS1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.12.2.1",
-                "27001: A.6.2.1",
-                "27002: 6.2.1 (h)",
-                "27001: A.6.2.2",
-                "27002: 6.2.2 (j)",
-                "27001: A.7.2.2",
-                "27002: 7.2.2 (d)",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (g)",
-                "27001: A.13.2.1",
-                "27002: 13.2.1 (b)",
-                "27001: A.15.1.2",
-                "27017: 15.1.2",
-                "27001: A.12.2.1",
-                "27002: 12.2.1 (a),(d)",
-                "27017: CLD.9.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.7",
-                "27001: A.5.37",
-                "27001: A.8.7",
-                "27002: 5.7 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-3",
-                "RA-3(3)",
-                "RA-5",
-                "RA-5(3)",
-                "RA-5(5)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "DE.CM-4",
-                "DE.CM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "DE.CM-01",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.4",
-                "12.1",
-                "12.1.1",
-                "12.3.1",
-                "12.5.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.1.1",
-                "12.1.2",
-                "5.1.1",
-                "5.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "TVM-03",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.",
-      "Name": "Vulnerability Remediation Schedule",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC7.1",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.2",
-                "7.7",
-                "17.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "TM2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.2.1",
-                "27001: A.12.6.1",
-                "27002: 12.6.1(c)(d)(j)",
-                "27018: 12.6.1(k)(i)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.8.7",
-                "27001: A.8.8",
-                "27001: A.8.32",
-                "27002: 8.7",
-                "27002: 8.8",
-                "27002: 8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-31",
-                "RA-3",
-                "RA-3(1)",
-                "RA-5",
-                "RA-5(2)-(4)",
-                "RA-5(6)",
-                "SI-3",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.AN-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.1.a",
-                "6.1.b"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.1.1",
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "TVM-04",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to update detection tools, threat signatures, and indicators of compromise on a weekly, or more frequent basis.",
-      "Name": "Detection Updates",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.3",
-                "TS1.4",
-                "TM1.3",
-                "TM1.4",
-                "IM1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1.1",
-                "27002: 5.1.1 (h)",
-                "27001: A.12.6.1",
-                "27002: 12.6.1 (b),(c)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1",
-                "27001: A.8.8",
-                "27001: A.8.15",
-                "27001: A.8.16",
-                "27002: 5.1",
-                "27002: 5.37",
-                "27002: 8.8",
-                "27002: 8.15 (d)",
-                "27002: 8.16 (d,e)",
-                "27002: 8.31 2nd (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-7",
-                "CM-7(4)",
-                "RA-3",
-                "RA-3(3)",
-                "RA-5(2)",
-                "SA-10",
-                "SA-10(5)",
-                "SA-11",
-                "SA-11(2)",
-                "SI-2",
-                "SI-2(4)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-4",
-                "SI-4(9)",
-                "SI-4(24)",
-                "SI-8",
-                "SI-8(2)",
-                "SI-8(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-02",
-                "ID.RA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.2",
-                "5.2a",
-                "5.2b",
-                "5.2c"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "5.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "artifacts_container_analysis_enabled",
-        "gcr_container_scanning_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-05",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to identify updates for applications which use third party or open source libraries according to the organization's vulnerability management policy.",
-      "Name": "External Library Vulnerabilities",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "SD2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.6.2",
-                "27002: 12.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A 5.6",
-                "27001: A.8.19",
-                "27001: A.8.8",
-                "27001: A.8.28",
-                "27001: A.8.31",
-                "27002: 5.6 (c)",
-                "27001: 8.19",
-                "27001: 8.8",
-                "27001: 8.28",
-                "27001: 8.31"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(3)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-11(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-03",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.2",
-                "6.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "artifacts_container_analysis_enabled",
-        "gcr_container_scanning_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-07",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.",
-      "Name": "Vulnerability Identification",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.1",
-                "7.5",
-                "7.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.6",
-                "27001: A.12.6.1",
-                "27002: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.8",
-                "27002: 8.8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(4)",
-                "RA-5(5)",
-                "SA-11",
-                "SA-11(5)",
-                "SA-15(5)",
-                "SC-7",
-                "SC-7(10)",
-                "SI-3(8)",
-                "SI-3(10)",
-                "SI-7",
-                "SI-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.RA-1",
-                "DE.CM-8",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "11.2",
-                "11.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "11.3.2",
-                "11.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "artifacts_container_analysis_enabled",
-        "compute_public_address_shodan",
-        "gcr_container_scanning_enabled"
-      ]
-    },
-    {
-      "Id": "UEM-08",
-      "Description": "Protect information from unauthorized disclosure on managed endpoint devices with storage encryption.",
-      "Name": "Storage Encryption",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "MOS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "3.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "PA1.2",
-                "PA1.3",
-                "PA1.5",
-                "PA2.2",
-                "PM1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.11.2.7",
-                "27002: 11.2.7",
-                "27001: A.18.1.1",
-                "27017: 18.1.1",
-                "27001: A.12.3.1",
-                "27017: 12.3.1",
-                "27018: A.11.4",
-                "27018: A.11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.1",
-                "27002: 8.1 (h)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.4",
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.5.1",
-                "3.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "bigquery_dataset_cmk_encryption",
-        "bigquery_table_cmk_encryption",
-        "compute_instance_confidential_computing_enabled",
-        "compute_instance_encryption_with_csek_enabled",
-        "dataproc_encrypted_with_cmks_disabled"
-      ]
-    },
-    {
-      "Id": "UEM-11",
-      "Description": "Configure managed endpoints with Data Loss Prevention (DLP) technologies and rules in accordance with a risk assessment.",
-      "Name": "Data Loss Prevention",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.5",
-                "PA2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27002: 12.3",
-                "27001: A.8.3.1",
-                "27002: 8.3.1",
-                "27001: A.12.2",
-                "27002: 12.2",
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001: A.6.1.1",
-                "27017: 6.1.1",
-                "27018: 12.3.1",
-                "27018: 10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-7",
-                "SC-7(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.DS-10",
-                "PR.PS-01",
-                "ID.AM-08",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    }
-  ]
-}
diff --git a/prowler/compliance/gcp/prowler_threatscore_gcp.json b/prowler/compliance/gcp/prowler_threatscore_gcp.json
index 46fc776fbe..923a1acfc2 100644
--- a/prowler/compliance/gcp/prowler_threatscore_gcp.json
+++ b/prowler/compliance/gcp/prowler_threatscore_gcp.json
@@ -117,7 +117,7 @@
       "Id": "1.2.4",
       "Description": "Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days",
       "Checks": [
-        "kms_key_rotation_enabled"
+        "kms_key_rotation_max_90_days"
       ],
       "Attributes": [
         {
diff --git a/prowler/lib/outputs/compliance/csa/__init__.py b/prowler/compliance/okta/__init__.py
similarity index 100%
rename from prowler/lib/outputs/compliance/csa/__init__.py
rename to prowler/compliance/okta/__init__.py
diff --git a/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json b/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json
new file mode 100644
index 0000000000..bac3d9132e
--- /dev/null
+++ b/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json
@@ -0,0 +1,638 @@
+{
+  "Framework": "Okta-IDaaS-STIG",
+  "Name": "DISA Okta Identity as a Service (IDaaS) STIG V1R2",
+  "Version": "1R2",
+  "Provider": "Okta",
+  "Description": "Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS), Version 1 Release 2 (Benchmark Date: 05 Jan 2026).",
+  "Requirements": [
+    {
+      "Id": "OKTA-APP-000020",
+      "Name": "Okta must log out a session after a 15-minute period of inactivity.",
+      "Description": "A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications must be able to identify when a user's application session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled. This is typically at the operating system level and results in a system lock. However, it may be at the application level where the application interface window is secured instead. Satisfies: SRG-APP-000003, SRG-APP-000190",
+      "Checks": [
+        "signon_global_session_idle_timeout_15min"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273186r1098825_rule",
+          "StigID": "OKTA-APP-000020",
+          "CCI": [
+            "CCI-000057",
+            "CCI-001133"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Global Session Policy. 2. In the Default Policy, verify a rule is configured at Priority 1 that is not named \"Default Rule\". 3. Click the edit icon next to the Priority 1 rule. 4. Verify the \"Maximum Okta global session idle time\" is set to 15 minutes. If \"Maximum Okta global session idle time\" is not set to 15 minutes, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Global Session Policy. 2. Select the Default Policy. 3. In the Rules table, make these updates: - Click \"Add rule\". - Set \"Maximum Okta global session idle time\" to 15 minutes."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000025",
+      "Name": "The Okta Admin Console must log out a session after a 15-minute period of inactivity.",
+      "Description": "A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications must be able to identify when a user's application session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled. This is typically at the operating system level and results in a system lock. However, it may be at the application level where the application interface window is secured instead.",
+      "Checks": [
+        "application_admin_console_session_idle_timeout_15min"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273187r1098828_rule",
+          "StigID": "OKTA-APP-000025",
+          "CCI": [
+            "CCI-000057"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Applications >> Applications >> Okta Admin Console. 2. In the Sign On tab, under \"Okta Admin Console session\", verify the \"Maximum app session idle time\" is set to 15 minutes. If the \"Maximum app session idle time\" is not set to 15 minutes, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Applications >> Applications >> Okta Admin Console. 2. In the Sign On tab, under \"Okta Admin Console session\", set the \"Maximum app session idle time\" to 15 minutes."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000090",
+      "Name": "Okta must automatically disable accounts after a 35-day period of account inactivity.",
+      "Description": "Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to an application. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Applications must track periods of user inactivity and disable accounts after 35 days of inactivity. Such a process greatly reduces the risk that accounts will be hijacked, leading to a data compromise. To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality. This policy does not apply to emergency accounts or infrequently used accounts. Infrequently used accounts are local login administrator accounts used by system administrators when network or normal login/access is not available. Emergency accounts are administrator accounts created in response to crisis situations. Satisfies: SRG-APP-000025, SRG-APP-000163, SRG-APP-000700",
+      "Checks": [
+        "user_inactivity_automation_35d_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273188r1098831_rule",
+          "StigID": "OKTA-APP-000090",
+          "CCI": [
+            "CCI-000017",
+            "CCI-000795",
+            "CCI-003627"
+          ],
+          "CheckText": "If Okta Services rely on external directory services for user sourcing, this is not applicable, and the connected directory services must perform this function. Go to Workflows >> Automations and verify that an Automation has been created to disable accounts after 35 days of inactivity. If the Okta configuration does not automatically disable accounts after a 35-day period of account inactivity, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Workflow >> Automations and select \"Add Automation\". 2. Create a name for the Automation (e.g., \"User Inactivity\"). 3. Click \"Add Condition\" and select \"User Inactivity in Okta\". 4. In the duration field, enter 35 days and click \"Save\". 5 Click the edit button next to \"Select Schedule\". 6. Configure the \"Schedule\" field for \"Run Daily\" and set the \"Time\" field to an organizationally defined time to run this automation. Click \"Save\". 7. Click the edit button next to \"Select group membership\". 8. In the \"Applies to\" field, select the group \"Everyone\" by typing it into the field. Click \"Save\". 9. Click \"Add Action\" and select \"Change User lifecycle state in Okta\". 10. In the \"Change user state to\" field, select \"Suspended\" and click \"Save\". 11. Click the \"Inactive\" button near the top of the section screen and select \"Activate\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000170",
+      "Name": "Okta must enforce the limit of three consecutive invalid login attempts by a user during a 15-minute time period.",
+      "Description": "By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-APP-000065, SRG-APP-000345",
+      "Checks": [
+        "authenticator_password_lockout_threshold_3"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273189r1098834_rule",
+          "StigID": "OKTA-APP-000170",
+          "CCI": [
+            "CCI-000044",
+            "CCI-002238"
+          ],
+          "CheckText": "If Okta Services rely on external directory services for user sourcing, this check is not applicable, and the connected directory services must perform this function. From the Admin Console: 1. Go to Security >> Authenticators. 2. Click the \"Actions\" button next to \"Password\" and select \"Edit\". 3. For each Password Policy, verify the \"Lock Out\" section has the following values: - \"Lock out after 3 unsuccessful attempts\" is checked. - The value is set to \"3\". If Okta Services are not configured to automatically lock user accounts after three consecutive invalid login attempts, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. Click the \"Actions\" button next to \"Password\" and select \"Edit\". 3. For each Password Policy, ensure the \"Lock Out\" section has the following values: - \"Lock out after 3 unsuccessful attempts\" is checked. - The value is set to \"3\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000180",
+      "Name": "The Okta Dashboard application must be configured to allow authentication only via non-phishable authenticators.",
+      "Description": "Requiring the use of non-phishable authenticators protects against brute force/password dictionary attacks. This provides a better level of security while removing the need to lock out accounts after three attempts in 15 minutes.",
+      "Checks": [
+        "application_dashboard_phishing_resistant_authentication"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273190r1099763_rule",
+          "StigID": "OKTA-APP-000180",
+          "CCI": [
+            "CCI-000044"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Dashboard\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"Possession factor constraints are\" section, verify the \"Phishing resistant\" box is checked. This will ensure that only phishing-resistant factors are used to access the Okta Dashboard. If in the \"Possession factor constraints are\" section the \"Phishing resistant\" box is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Dashboard\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"Possession factor constraints are\" section, ensure the \"Phishing resistant\" box is checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000190",
+      "Name": "The Okta Admin Console application must be configured to allow authentication only via non-phishable authenticators.",
+      "Description": "Requiring the use of non-phishable authenticators protects against brute force/password dictionary attacks. This provides a better level of security while removing the need to lock out accounts after three attempts in 15 minutes.",
+      "Checks": [
+        "application_admin_console_phishing_resistant_authentication"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273191r1099764_rule",
+          "StigID": "OKTA-APP-000190",
+          "CCI": [
+            "CCI-000044"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Admin Console\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"Possession factor constraints are\" section, verify the \"Phishing resistant\" box is checked. This will ensure that only phishing-resistant factors are used to access the Okta Dashboard. If in the \"Possession factor constraints are\" section the \"Phishing resistant\" box is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Admin Console\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"Possession factor constraints are\" section, ensure the \"Phishing resistant\" box is checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000200",
+      "Name": "Okta must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the application.",
+      "Description": "Display of the DOD-approved use notification before granting access to the application ensures that privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters: \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\" Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: \"I've read & consent to terms in IS user agreem't.\" Satisfies: SRG-APP-000068, SRG-APP-000069, SRG-APP-000070",
+      "Checks": [
+        "signon_dod_warning_banner_configured"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273192r1098843_rule",
+          "StigID": "OKTA-APP-000200",
+          "CCI": [
+            "CCI-000048",
+            "CCI-000050",
+            "CCI-001384",
+            "CCI-001385",
+            "CCI-001386",
+            "CCI-001387",
+            "CCI-001388"
+          ],
+          "CheckText": "Attempt to log in to the Okta tenant and verify the DOD-approved warning banner is in place. If the required warning banner is not present and complete, this is a finding.",
+          "FixText": "Follow the supplemental instructions in the \"Okta DOD Warning Banner Configuration Guide\" provided with this STIG package."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000560",
+      "Name": "The Okta Admin Console application must be configured to use multifactor authentication.",
+      "Description": "Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). Satisfies: SRG-APP-000149, SRG-APP-000154",
+      "Checks": [
+        "application_admin_console_mfa_required"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT I (High)",
+          "Severity": "high",
+          "RuleID": "SV-273193r1098846_rule",
+          "StigID": "OKTA-APP-000560",
+          "CCI": [
+            "CCI-000765",
+            "CCI-004046"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Admin Console\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"User must authenticate with\" field, verify that either \"Password/IdP + Another factor\" or \"Any 2 factor types\" is selected. If either of these settings is incorrect, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Admin Console\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"User must authenticate with\" field, select either \"Password/IdP + Another factor\" or \"Any 2 factor types\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000570",
+      "Name": "The Okta Dashboard application must be configured to use multifactor authentication.",
+      "Description": "To ensure accountability and prevent unauthenticated access, nonprivileged users must use multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: (i) Something you know (e.g., password/PIN); (ii) Something you have (e.g., cryptographic identification device, token); or (iii) Something you are (e.g., biometric). A nonprivileged account is any information system account with authorizations of a nonprivileged user. Network access is any access to an application by a user (or process acting on behalf of a user) where the access is obtained through a network connection. Applications integrating with the DOD Active Directory and using the DOD CAC are examples of compliant multifactor authentication solutions. Satisfies: SRG-APP-000150, SRG-APP-000155",
+      "Checks": [
+        "application_dashboard_mfa_required"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT I (High)",
+          "Severity": "high",
+          "RuleID": "SV-273194r1098849_rule",
+          "StigID": "OKTA-APP-000570",
+          "CCI": [
+            "CCI-000766",
+            "CCI-004046"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Dashboard\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"User must authenticate with\" field, verify that either \"Password/IdP + Another factor\" or \"Any 2 factor types\" is selected. If either of these settings is incorrect, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Dashboard\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"User must authenticate with\" field, select either \"Password/IdP + Another factor\" or \"Any 2 factor types\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000650",
+      "Name": "Okta must enforce a minimum 15-character password length.",
+      "Description": "Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.",
+      "Checks": [
+        "authenticator_password_minimum_length_15"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273195r1098852_rule",
+          "StigID": "OKTA-APP-000650",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify the \"Minimum Length\" field is set to at least \"15\" characters. If any policy is not set to at least \"15\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set the \"Minimum Length\" field to at least \"15\" characters."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000670",
+      "Name": "Okta must enforce password complexity by requiring that at least one uppercase character be used.",
+      "Description": "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.",
+      "Checks": [
+        "authenticator_password_complexity_uppercase"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273196r1098855_rule",
+          "StigID": "OKTA-APP-000670",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Upper case letter\" is checked. For each policy, if \"Upper case letter\" is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Upper case letter\" to checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000680",
+      "Name": "Okta must enforce password complexity by requiring that at least one lowercase character be used.",
+      "Description": "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.",
+      "Checks": [
+        "authenticator_password_complexity_lowercase"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273197r1098858_rule",
+          "StigID": "OKTA-APP-000680",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Lower case letter\" is checked. For each policy, if \"Lower case letter\" is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Lower case letter\" to checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000690",
+      "Name": "Okta must enforce password complexity by requiring that at least one numeric character be used.",
+      "Description": "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.",
+      "Checks": [
+        "authenticator_password_complexity_number"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273198r1098861_rule",
+          "StigID": "OKTA-APP-000690",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Number (0-9)\" is checked. For each policy, if \"Number (0-9)\" is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Number (0-9)\" to checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000700",
+      "Name": "Okta must enforce password complexity by requiring that at least one special character be used.",
+      "Description": "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor in determining how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Special characters are not alphanumeric. Examples include: ~ ! @ # $ % ^ *.",
+      "Checks": [
+        "authenticator_password_complexity_symbol"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273199r1098864_rule",
+          "StigID": "OKTA-APP-000700",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Symbol (e.g., !@#$%^&*)\" is checked. For each policy, if \"Symbol (e.g., !@#$%^&*)\" is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Symbol (e.g., !@#$%^&*)\" to checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000740",
+      "Name": "Okta must enforce 24 hours/one day as the minimum password lifetime.",
+      "Description": "Enforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement. Restricting this setting limits the user's ability to change their password. Passwords must be changed at specific policy-based intervals; however, if the application allows the user to immediately and continually change their password, it could be changed repeatedly in a short period of time to defeat the organization's policy regarding password reuse. Satisfies: SRG-APP-000173, SRG-APP-000870",
+      "Checks": [
+        "authenticator_password_minimum_age_24h"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273200r1098867_rule",
+          "StigID": "OKTA-APP-000740",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Minimum password age is XX hours\" is set to at least \"24\". For each policy, if \"Minimum password age is XX hours\" is not set to at least \"24\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Minimum password age is XX hours\" to at least \"24\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000745",
+      "Name": "Okta must enforce a 60-day maximum password lifetime restriction.",
+      "Description": "Any password, no matter how complex, can eventually be cracked. Therefore, passwords must be changed at specific intervals. One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised. This requirement does not include emergency administration accounts, which are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.",
+      "Checks": [
+        "authenticator_password_maximum_age_60d"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273201r1098870_rule",
+          "StigID": "OKTA-APP-000745",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Password expires after XX days\" is set to \"60\". For each policy, if \"Password expires after XX days\" is not set to \"60\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Password expires after XX days\" to \"60\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001430",
+      "Name": "Okta must off-load audit records onto a central log server.",
+      "Description": "Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Satisfies: SRG-APP-000358, SRG-APP-000080, SRG-APP-000125",
+      "Checks": [
+        "systemlog_streaming_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT I (High)",
+          "Severity": "high",
+          "RuleID": "SV-273202r1099766_rule",
+          "StigID": "OKTA-APP-001430",
+          "CCI": [
+            "CCI-001851",
+            "CCI-000166",
+            "CCI-001348"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Reports >> Log Streaming. 2. Verify that a Log Stream connection is configured and active. Alternately, interview the information system security manager (ISSM) and verify that an external Security Information and Event Management (SIEM) system is pulling Okta logs via an Application Programming Interface (API). If either of these is not configured, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Reports >> Log Streaming. 2. Select either \"AWS EventBridge\" or \"Splunk Cloud\" and click \"Next\". 3. Complete the necessary fields and click \"Save\". If Log Streaming is not an option because the SIEM required is not an option, customers can use the Okta Log API to export system logs in real time."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001665",
+      "Name": "Okta must be configured to limit the global session lifetime to 18 hours.",
+      "Description": "Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When applications provide the capability to change security roles or escalate the functional capability of the application, it is critical the user reauthenticate. In addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances. (i) When authenticators change; (ii) When roles change; (iii) When security categories of information systems change; (iv) When the execution of privileged functions occurs; (v) After a fixed period of time; or (vi) Periodically. Within the DOD, the minimum circumstances requiring reauthentication are privilege escalation and role changes.",
+      "Checks": [
+        "signon_global_session_lifetime_18h"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273203r1099958_rule",
+          "StigID": "OKTA-APP-001665",
+          "CCI": [
+            "CCI-002038"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Global Session Policy. 2. In the Default Policy, verify a rule is configured at Priority 1 that is not named \"Default Rule\". 3. Click the \"Edit\" icon next to the Priority 1 rule. 4. Verify \"Maximum Okta global session lifetime\" is set to 18 hours. If the above is not set, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Global Session Policy. 2. Select the Default Policy. 3. In the Rules table, make these updates: - Click \"Add rule\". - Set \"Maximum Okta global session lifetime\" to 18 hours."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001670",
+      "Name": "Okta must be configured to accept Personal Identity Verification (PIV) credentials.",
+      "Description": "The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DOD has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems. Satisfies: SRG-APP-000391, SRG-APP-000402, SRG-APP-000403",
+      "Checks": [
+        "authenticator_smart_card_active"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273204r1098879_rule",
+          "StigID": "OKTA-APP-001670",
+          "CCI": [
+            "CCI-001953",
+            "CCI-002009",
+            "CCI-002010"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. Verify that \"Smart Card Authenticator\" is listed and has \"Status\" listed as \"Active\". If \"Smart Card Authenticator\" is not listed or is not listed as \"Active\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. In the \"Setup\" tab, click \"Add authenticator\". 3. Select the configured Smart Card Identity Provider and finish configuration."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001700",
+      "Name": "The Okta Verify application must be configured to connect only to FIPS-compliant devices.",
+      "Description": "Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk. Currently, DOD requires the use of AES for bidirectional authentication because it is the only FIPS-validated AES cipher block algorithm. For distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions. A local connection is any connection with a device communicating without the use of a network. A network connection is any connection with a device that communicates through a network (e.g., local area or wide area network; the internet). A remote connection is any connection with a device communicating through an external network (e.g., the internet). Because of the challenges of applying this requirement on a large scale, organizations are encouraged to apply the requirement only to those limited number (and type) of devices that truly need to support this capability.",
+      "Checks": [
+        "authenticator_okta_verify_fips_compliant"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273205r1098882_rule",
+          "StigID": "OKTA-APP-001700",
+          "CCI": [
+            "CCI-001967"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. From the \"Setup\" tab, select \"Edit Okta Verify\". 3. Review the \"FIPS Compliance\" field. If FIPS-compliant authentication is not enabled, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. From the \"Setup\" tab, select \"Edit Okta Verify\". 3. In the \"FIPS Compliance\" field, choose whether users enrolling in Okta Verify can use FIPS-compliant devices only or any device. 4. Click \"Save\" after making any changes."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001710",
+      "Name": "Okta must be configured to disable persistent global session cookies.",
+      "Description": "If cached authentication information is out of date, the validity of the authentication information may be questionable. Satisfies: SRG-APP-000400, SRG-APP-000157",
+      "Checks": [
+        "signon_global_session_cookies_not_persistent"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273206r1098885_rule",
+          "StigID": "OKTA-APP-001710",
+          "CCI": [
+            "CCI-002007",
+            "CCI-001942"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Global Session Policy. 2. In the Default Policy, verify a rule is configured at Priority 1 that is not named \"Default Rule\". 3. Click the \"Edit\" icon next to the Priority 1 rule. 4. Verify \"Okta global session cookies persist across browser sessions\" is set to \"Disabled\". If the above it not set, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Global Session Policy. 2. Select the Default Policy. 3. In the \"Rules\" table, make these updates: - Click \"Add rule\". - Set \"Okta global session cookies persist across browser sessions\" to Disable."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001920",
+      "Name": "Okta must be configured to use only DOD-approved certificate authorities.",
+      "Description": "Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DOD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not DOD approved, trust of this CA has not been established. The DOD will accept only PKI certificates obtained from a DOD-approved internal or external CA. Reliance on CAs for the establishment of secure sessions includes, for example, the use of Transport Layer Security (TLS) certificates. This requirement focuses on communications protection for the application session rather than for the network packet. This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA). Satisfies: SRG-APP-000427, SRG-APP-000910",
+      "Checks": [
+        "idp_smart_card_dod_approved_ca"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273207r1098888_rule",
+          "StigID": "OKTA-APP-001920",
+          "CCI": [
+            "CCI-002470",
+            "CCI-004909"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Identity Providers (IdPs). 2. Review the list of IdPs with \"Type\" as \"Smart Card\". If the IdP is not listed as \"Active\", this is a finding. 3. Select Actions >> Configure. 4. Under \"Certificate chain\", verify the certificate is from a DOD-approved CA. If the certificate is not from a DOD-approved CA, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Identity Providers. 2. Click \"Add identity provider.\" 3. Click \"Smart Card IdP\". Click \"Next\". 4. Enter the name of the identity provider. 5. Build a certificate chain: - Click \"Browse\" to open a file explorer. Select the certificate file to add and click \"Open\". - To add another certificate, click \"Add Another\" and repeat step 1. - Click \"Build certificate chain\". On success, the chain and its certificates are shown. If the build failed, correct any issues and try again. - Click \"Reset certificate chain\" if replacing the current chain with a new one. 6. In \"IdP username\", select the \"idpuser.subjectAltNameUpn\" attribute. This is the attribute that stores the Electronic Data Interchange Personnel Identifier (EDIPI) on the CAC. 7. In the \"Match Against\" field, select the Okta Profile Attribute in which the EDIPI is to be stored."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-002980",
+      "Name": "Okta must validate passwords against a list of commonly used, expected, or compromised passwords.",
+      "Description": "Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.",
+      "Checks": [
+        "authenticator_password_common_password_check"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273208r1099769_rule",
+          "StigID": "OKTA-APP-002980",
+          "CCI": [
+            "CCI-004058"
+          ],
+          "CheckText": "From the Admin Console: 1. Navigate to Security >> Authenticators. 2. Click the \"Actions\" button next to the Password authenticator and select \"Edit\". 3. Under the \"Password Settings\" section, verify the \"Common Password Check\" box is checked. If \"Common Password Check\" is not selected, this is a finding.",
+          "FixText": "From the Admin Console: 1. Navigate to Security >> Authenticators. 2. Click the \"Actions\" button next to the Password authenticator and select \"Edit\". 3. Under the \"Password Settings\" section, check the \"Common Password Check\" box."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003010",
+      "Name": "Okta must prohibit password reuse for a minimum of five generations.",
+      "Description": "Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.",
+      "Checks": [
+        "authenticator_password_history_5"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273209r1098894_rule",
+          "StigID": "OKTA-APP-003010",
+          "CCI": [
+            "CCI-004061"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password row\" and select \"Edit\". 3. For each listed policy, verify \"Enforce password history for last XX passwords\" is set to \"5\". If any policy is not set to at least \"5\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Enforce password history for last XX passwords\" to \"5\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003240",
+      "Name": "Okta API tokens must be configured with Network Zones to restrict authorization from known networks.",
+      "Description": "An access token is a piece of data that represents the authorization granted to a user or NPE to access specific systems or information resources. Access tokens enable controlled access to services and resources. Properly managing the lifecycle of access tokens, including their issuance, validation, and revocation, is crucial to maintaining confidentiality of data and systems. Restricting token validity to a specific audience, e.g., an application or security domain, and restricting token validity lifetimes are important practices. Access tokens are revoked or invalidated if they are compromised, lost, or are no longer needed to mitigate the risks associated with stolen or misused tokens. API tokens have the potential to be replicated or stolen (just like a password). Because of this, it is important to only allow API tokens to authenticate from known IP ranges as this limits an adversary's ability to use a token to gain access.",
+      "Checks": [
+        "apitoken_restricted_to_network_zone"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279689r1155066_rule",
+          "StigID": "OKTA-APP-003240",
+          "CCI": [
+            "CCI-005165",
+            "CCI-000366"
+          ],
+          "CheckText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"API\" item. 2. Click the \"Tokens\" tab. 3. For each token listed, click the token name link. 4. In the \"Security\" section, verify the \"Token can be used from\" setting is mapped to a known network zone for the application calling the API. If a network zone for each API access token is not defined, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"API\" item. 2. Click the \"Tokens\" tab. 3. For each token listed, click the token name link. 4. In the \"Security\" section, click \"Edit\". 5. Set the \"Token can be used from\" setting to the known network zone for the application calling the API. 6. Click \"Save\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003241",
+      "Name": "Okta API tokens must be created under new dedicated user accounts.",
+      "Description": "An access token is a piece of data that represents the authorization granted to a user or NPE to access specific systems or information resources. Access tokens enable controlled access to services and resources. Properly managing the lifecycle of access tokens, including their issuance, validation, and revocation, is crucial to maintaining confidentiality of data and systems. Restricting token validity to a specific audience, e.g., an application or security domain, and restricting token validity lifetimes are important practices. Access tokens are revoked or invalidated if they are compromised, lost, or are no longer needed to mitigate the risks associated with stolen or misused tokens. When API tokens are created, they inherit the permissions of the user that created them. Therefore, API tokens should only be created from dedicated accounts and permissions must be constrained to least privilege for that dedicated user account and token. No API tokens should be created using a Super Admin account.",
+      "Checks": [
+        "apitoken_not_super_admin"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279690r1155069_rule",
+          "StigID": "OKTA-APP-003241",
+          "CCI": [
+            "CCI-005165",
+            "CCI-000366"
+          ],
+          "CheckText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"API\" item. 2. Click the \"Tokens\" tab. 3. For each token listed, verify that the Role listed is not \"Super Admin\", and that the account has been specifically created for that token. 4. Click the account name to be token to the user profile for that user. 5. Verify the user only has an administrator role (standard or customer) applied that is correctly scoped as required and documented in the Okta Access Control policy. If the token is using a Super Administrator account, or one that is not properly scoped per the Access Control policy, this is a finding. Note: If a Super Admin token is required for system operation, then this permanent finding.",
+          "FixText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"API\" item. 2. Click the \"Tokens\" tab. 3. For each token listed that has \"Super Admin\" or an improperly scoped Admin account, delete the token and create a new one with the appropriately scoped permissions. 4. Verify the application performing the API calls with the new token has been updated."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003242",
+      "Name": "The Okta Global Session policy must be configured to allow or deny IP based access in accordance with the Access Control policy for Okta.",
+      "Description": "To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access Control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. The Okta Global Session Policy is applied at the organization level and before any application-specific authentication policies are processed. The Okta authorization package should contain an access control policy that defines IP ranges from which to either allow or deny access. This list (either as an explicit allow or explicit deny) can be implemented in the Global Session Policy.",
+      "Checks": [
+        "signon_global_session_policy_network_zone_enforced"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279691r1155072_rule",
+          "StigID": "OKTA-APP-003242",
+          "CCI": [
+            "CCI-000213"
+          ],
+          "CheckText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"Global Session Policy\" item. 2. In the \"Policy Settings\" section, verify the \"IF User's IP is\" setting is correctly set to either allow or deny based on the organization defined policy. If the Okta Global Session Policy is not configured to restrict access to specific IP ranges, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"Global Session Policy\" item. 2. In the Policy Settings section, configure the \"IF User's IP is\" setting to correctly set the appropriate network to either allow or deny based on the Access Control Policy."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003243",
+      "Name": "Okta must be configured with Network Zones defined to block anonymized proxies according to organizationally defined policy.",
+      "Description": "A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If information flow is not enforced based on approved authorizations, the system may become compromised. Information flow control regulates where information is allowed to travel within a system and between interconnected systems. The flow of all application information must be monitored and controlled so it does not introduce any unacceptable risk to the systems or data. Application-specific examples of enforcement occurs in systems that employ rule sets or establish configuration settings that restrict information system services, or provide a message filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Applications providing information flow control must be able to enforce approved authorizations for controlling the flow of information between interconnected systems in accordance with applicable policy. Working with the organizational CSSP, the ISSM should obtain a list of known anonymizer proxies that exist on the commercial internet. If this is not available from the CSSP, then the Okta-provided \"Enhanced dynamic zone blocklist\" should be activated.",
+      "Checks": [
+        "network_zone_block_anonymized_proxies"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279692r1155075_rule",
+          "StigID": "OKTA-APP-003243",
+          "CCI": [
+            "CCI-001414"
+          ],
+          "CheckText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"Networks' item. 2. If the CSSP has provided a list of anonymizers to block, verify the \"IP Block list\" is configured with them. a. Click the pencil icon next to IP Block list. b. Verify the \"Gateway IPs\" section contains all of the IP ranges in the provided list. 3. If the CSSP is not able to provide a list, then implement the Okta managed list. a. Verify the \"Enhanced dynamic zone blocklist\" is set to \"Active\". If Network Zones are not configured to block anonymous proxies, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"Networks\" item. 2. If the CSSP has provided a list of anonymizers to block, add the IP ranges to the \"IP Block list\". a. Click the pencil icon next to IP Block list. b. Add the IP ranges to the \"Gateway IPs\" section and click \"Save\". 3. If the CSSP is not able to provide a list, then implement the Okta managed list. a. Set the \"Enhanced dynamic zone blocklist\" to \"Active\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003244",
+      "Name": "For each application integrated with Okta, network zones must be defined in its authentication policy.",
+      "Description": "A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If information flow is not enforced based on approved authorizations, the system may become compromised. Information flow control regulates where information is allowed to travel within a system and between interconnected systems. The flow of all application information must be monitored and controlled so it does not introduce any unacceptable risk to the systems or data. Application-specific examples of enforcement occurs in systems that employ rule sets or establish configuration settings that restrict information system services, or provide a message filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Applications providing information flow control must be able to enforce approved authorizations for controlling the flow of information between interconnected systems in accordance with applicable policy. Each application in Okta should have a well defined access control policy that takes into account the end user network. This should be documented in the Access Control policy for each application. As an example, access to an application may be restricted to a specific location by policy. In this case, a network defining that specific location should be created.",
+      "Checks": [
+        "application_authentication_policy_network_zone_enforced"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279693r1155078_rule",
+          "StigID": "OKTA-APP-003244",
+          "CCI": [
+            "CCI-001414"
+          ],
+          "CheckText": "For each application integrated into Okta: 1. From the Admin console, open the \"Security\" menu, and then select \"Networks\". 2. Verify the list of networks includes all necessary allow or block lists. If any application is not configured with network zones, this is a finding.",
+          "FixText": "For each application, starting at the admin console: 1. Open the \"Applications\" group from the Menu, and then click the \"Applications\" menu item. 2. Click the application name. 3. Click the \"Sign On\" tab. 4. Scroll to the \"User Authentication\" section, and then click \"Edit\". 5. Select the appropriate Authentication policy from the pull down, and then click \"Save\". 6. Click \"View Policy Details\". 7. For each nondefault rule: a. Select \"Edit\" from the Actions menu. b. In the \"IF\" section, verify the \"User is\" setting has the appropriate allow or deny range has been selected based on the Access Control policy for the application. c. Scroll down to the bottom and click \"Save\". 8. For the Catch-All rule: a. Select \"Edit\" from the Actions menu. b. Scroll down to the \"Then\" section. c. For the \"Access is\" setting, select \"Denied\", and then click \"Save\"."
+        }
+      ]
+    }
+  ]
+}
diff --git a/prowler/compliance/oraclecloud/cis_3.1_oraclecloud.json b/prowler/compliance/oraclecloud/cis_3.1_oraclecloud.json
index ceca68d124..8140dca6cc 100644
--- a/prowler/compliance/oraclecloud/cis_3.1_oraclecloud.json
+++ b/prowler/compliance/oraclecloud/cis_3.1_oraclecloud.json
@@ -302,7 +302,9 @@
     {
       "Id": "1.15",
       "Description": "Ensure storage service-level admins cannot delete resources they manage",
-      "Checks": [],
+      "Checks": [
+        "identity_storage_service_level_admins_scoped"
+      ],
       "Attributes": [
         {
           "Section": "1. Identity and Access Management",
diff --git a/prowler/compliance/oraclecloud/csa_ccm_4.0_oraclecloud.json b/prowler/compliance/oraclecloud/csa_ccm_4.0_oraclecloud.json
deleted file mode 100644
index 300e32788d..0000000000
--- a/prowler/compliance/oraclecloud/csa_ccm_4.0_oraclecloud.json
+++ /dev/null
@@ -1,7307 +0,0 @@
-{
-  "Framework": "CSA-CCM",
-  "Name": "CSA Cloud Controls Matrix (CCM) v4.0.13",
-  "Version": "4.0",
-  "Provider": "OracleCloud",
-  "Description": "The Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing, composed of 197 control objectives structured in 17 domains covering all key aspects of cloud technology. The CCM can be used as a tool for the systematic assessment of a cloud implementation, and provides guidance on which security controls should be implemented by which actor within the cloud supply chain.",
-  "Requirements": [
-    {
-      "Id": "A&A-02",
-      "Description": "Conduct independent audit and assurance assessments according to relevant standards at least annually.",
-      "Name": "Independent Assessments",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC4.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AAC-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.2",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.2.1",
-                "27002: 18.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.35",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-2",
-                "CA-2(1)",
-                "CA-2(2)",
-                "CA-7",
-                "CA-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled"
-      ]
-    },
-    {
-      "Id": "A&A-04",
-      "Description": "Verify compliance with all relevant standards, regulations, legal/contractual, and statutory requirements applicable to the audit.",
-      "Name": "Requirements Compliance",
-      "Attributes": [
-        {
-          "Section": "Audit & Assurance",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01",
-                "GRM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "AS1.1",
-                "AS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.18.2.2",
-                "27002: 18.2.2",
-                "27001: A.18.2.3",
-                "27002: 18.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.3.2",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34",
-                "27001: A.5.36"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-3",
-                "DE.DP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-01"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled"
-      ]
-    },
-    {
-      "Id": "AIS-04",
-      "Description": "Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.",
-      "Name": "Secure Application Design and Development",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27017: 14.1.1",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.14.2.1",
-                "27002: 14.2.1",
-                "27017: 14.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.8",
-                "27001: A.8.25",
-                "27001: A.8.26",
-                "27001: A.8.28"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PL-8",
-                "PL-8(1)",
-                "SA-3",
-                "SA-3(1)",
-                "SA-4",
-                "SA-4(2)",
-                "SA-4(3)",
-                "SA-4(8)",
-                "SA-4(9)",
-                "SA-5",
-                "SA-8",
-                "SA-8(1)-(7)",
-                "SA-8(9)-(13)",
-                "SA-8(15)-(20)",
-                "SA-8(22)",
-                "SA-8(24)-(28)",
-                "SA-8(30)-(33)",
-                "SA-17",
-                "SA-17(1)-(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-6",
-                "PR.DS-7",
-                "PR.IP-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1",
-                "6.2.3",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "AIS-05",
-      "Description": "Implement a testing strategy, including criteria for acceptance of new information systems, upgrades and new versions, which provides application security assurance and maintains compliance while enabling organizational speed of delivery goals. Automate when applicable and possible.",
-      "Name": "Automated Application Security Testing",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "AIS-01",
-                "AIS-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.12",
-                "16.13"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.3",
-                "SD2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.8",
-                "27001: A.14.2.9",
-                "27001: A.12.1.2",
-                "27002: 12.1.2",
-                "27001: A.14.1.1",
-                "27002: 14.1.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.25",
-                "27001: A.8.29",
-                "27001: A.8.32",
-                "27002: 8.25 (e)",
-                "27002: 8.32 (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SA-11",
-                "SA-11(1)-(9)",
-                "SI-6",
-                "SI-6(2)",
-                "SI-6(3)",
-                "SI-10",
-                "SI-10(1)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.IP-12",
-                "DE.CM-8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "PR.PS-01",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A.3.2.2",
-                "A.3.2.2.1",
-                "6.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.4",
-                "6.4.1",
-                "6.4.2",
-                "6.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "AIS-07",
-      "Description": "Define and implement a process to remediate application security vulnerabilities, automating remediation when possible.",
-      "Name": "Application Vulnerability Remediation",
-      "Attributes": [
-        {
-          "Section": "Application & Interface Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1",
-                "CC7.4",
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.2",
-                "16.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27001: A.12.6.1",
-                "27002: 12.6.1",
-                "27017: 12.6.1",
-                "27018: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27002: 5.26 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-2",
-                "SI-2(2)-(6)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-15",
-                "SA-15(1)-(3)",
-                "SA-15(5)-(8)",
-                "SA-15(10)-(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.IP-12",
-                "DE.CM-8",
-                "RS.AN-5",
-                "RS.MI-3",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.2",
-                "6.5",
-                "6.5.1-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "11.3.1",
-                "11.3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "BCR-08",
-      "Description": "Periodically backup data stored in the cloud. Ensure the confidentiality, integrity and availability of the backup, and verify data restoration from backup for resiliency.",
-      "Name": "Backup",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "A1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "11.1",
-                "11.2",
-                "11.3",
-                "11.4",
-                "11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27017: 12.3",
-                "27018: 12.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.13",
-                "27001: A.5.23",
-                "27001: A.5.30",
-                "27002: 8.13",
-                "27002: 5.23 2nd (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-4",
-                "CP-4(4)",
-                "CP-6",
-                "CP-6(1)-(3)",
-                "CP-9",
-                "CP-9(1)",
-                "CP-9(2)",
-                "CP-10",
-                "CP-10(2)",
-                "CP-10(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-4",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-11",
-                "RC.RP-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.5.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "10.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "objectstorage_bucket_versioning_enabled"
-      ]
-    },
-    {
-      "Id": "BCR-09",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain a disaster response plan to recover from natural and man-made disasters. Update the plan at least annually or upon significant changes.",
-      "Name": "Disaster Response Plan",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8",
-                "5.2.9",
-                "1.6.1",
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.4",
-                "BC2.1",
-                "BC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.29",
-                "27001: A.5.30",
-                "27002: 5.29",
-                "27002: 5.30"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2(1)",
-                "CP-2(2)",
-                "CP-2(3)",
-                "CP-2(5)",
-                "CP-2(6)",
-                "CP-2(7)",
-                "CP-2(8)",
-                "PE-13",
-                "PE-13(1)",
-                "PE-13(2)",
-                "PE-13(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-9",
-                "PR.IP-10",
-                "RC.IM-1",
-                "RC.IM-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.IM-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "BCR-11",
-      "Description": "Supplement business-critical equipment with redundant equipment independently located at a reasonable minimum distance in accordance with applicable industry standards.",
-      "Name": "Equipment Redundancy",
-      "Attributes": [
-        {
-          "Section": "Business Continuity Management and Operational Resilience",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.2",
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-06"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "BC1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.20",
-                "27001: A.7.11",
-                "27001: A.8.14",
-                "27002: 5.20 (t)",
-                "27002: 8.14 (c)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "CP-4(3)",
-                "CP-6",
-                "CP-6(1)",
-                "CP-7",
-                "CP-8",
-                "CP-8(1)-(3)",
-                "CP-9",
-                "CP-9(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.BE-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.OC-04",
-                "GV.OC-05",
-                "PR.IR-03"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "CCC-04",
-      "Description": "Restrict the unauthorized addition, removal, update, and management of organization assets.",
-      "Name": "Unauthorized Change Protection",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "CCC-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.1",
-                "1.3.4",
-                "5.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4",
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.1.4",
-                "27002: 12.1.4",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27001: A.14.2.2",
-                "27017: 14.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.3",
-                "27001: A.8.4",
-                "27001: A.8.15",
-                "27001: A.8.31",
-                "27001: A.8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(4)",
-                "CM-3",
-                "CM-3(1)",
-                "CM-3(5)",
-                "CM-3(7)",
-                "CM-3(8)",
-                "CM-5",
-                "CM-5(1)",
-                "CM-5(4)",
-                "CM-5(5)",
-                "CM-6",
-                "CM-6(1)",
-                "CM-6(2)",
-                "CM-7",
-                "CM-7(1)",
-                "CM-7(4)",
-                "CM-7(5)",
-                "CM-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.MA-1",
-                "PR.MA-2",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04",
-                "ID.AM-08",
-                "PR.PS-02",
-                "PR.PS-03",
-                "PR.PS-05",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.1",
-                "6.5.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "events_rule_iam_group_changes",
-        "events_rule_iam_policy_changes",
-        "events_rule_user_changes",
-        "events_rule_vcn_changes"
-      ]
-    },
-    {
-      "Id": "CCC-07",
-      "Description": "Implement detection measures with proactive notification in case of changes deviating from the established baseline.",
-      "Name": "Detection of Baseline Deviation",
-      "Attributes": [
-        {
-          "Section": "Change Control and Configuration Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC8.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.5.1",
-                "1.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.2.2",
-                "27001: A.14.2.4",
-                "27001: A.12.4.1",
-                "27002: 12.4.1 (g)",
-                "27001: A.5.1.1",
-                "27017: 5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.9",
-                "27001: A.8.15",
-                "27002: 8.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(2)",
-                "SI-2",
-                "SI-2(2)-(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.MA-1",
-                "PR.IP-1",
-                "DE.DP-4",
-                "PR.IP-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01",
-                "DE.CM-09",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4.5.3",
-                "6.4.5.4",
-                "11.5",
-                "11.5.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "11.5.2",
-                "11.6.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled",
-        "events_rule_cloudguard_problems",
-        "events_rule_network_gateway_changes",
-        "events_rule_network_security_group_changes",
-        "events_rule_route_table_changes",
-        "events_rule_security_list_changes",
-        "events_rule_vcn_changes"
-      ]
-    },
-    {
-      "Id": "CEK-03",
-      "Description": "Provide cryptographic protection to data at-rest and in-transit, using cryptographic libraries certified to approved standards.",
-      "Name": "Data Encryption",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-03",
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6",
-                "3.1",
-                "3.11",
-                "11.3",
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.1",
-                "27001: A.18.1.2",
-                "27001: A.18.1.3",
-                "27001: A.18.1.4",
-                "27001: A.18.1.5",
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.18",
-                "27002: 18",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27001: A.14.1.3",
-                "27002 14.1.3 c)",
-                "27001 - A.10.1.1",
-                "27017 - 10.1.1",
-                "27001 - A.10.1.2",
-                "27017 - 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.24",
-                "27002: 8.24 Other Information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19",
-                "AC-19(5)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-8(3)",
-                "SC-8(4)",
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)-(3)",
-                "SI-4",
-                "SI-4(10)",
-                "SI-7",
-                "SI-7(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "Requirement 3",
-                "2.2.3",
-                "2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "blockstorage_block_volume_encrypted_with_cmk",
-        "blockstorage_boot_volume_encrypted_with_cmk",
-        "compute_instance_in_transit_encryption_enabled",
-        "filestorage_file_system_encrypted_with_cmk",
-        "objectstorage_bucket_encrypted_with_cmk"
-      ]
-    },
-    {
-      "Id": "CEK-04",
-      "Description": "Use encryption algorithms that are appropriate for data protection, considering the classification of data, associated risks, and usability of the encryption technology.",
-      "Name": "Encryption Algorithm",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.2",
-                "27002: 8.2",
-                "27001: A.8.3",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (b)",
-                "27001: A.10.1.2",
-                "27002: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.2",
-                "27001: 6.1.3",
-                "27001: A.8.24",
-                "27001: A.5.12",
-                "27001: A.5.13",
-                "27002: 8.24 General (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A2",
-                "Requirement 3",
-                "2.3",
-                "2.2.3",
-                "3.4",
-                "3.5.3",
-                "4.1",
-                "8.2.1",
-                "PCI Glossary - Strong Cryptography"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.7",
-                "3.5.1",
-                "4.2.1",
-                "4.2.1.2",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "CEK-08",
-      "Description": "CSPs must provide the capability for CSCs to manage their own data encryption keys.",
-      "Name": "CSC Key Management Capability",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27017: 10.1",
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.23",
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-9",
-                "CP-9(8)",
-                "SA-9",
-                "SA-9(6)",
-                "SC-12",
-                "SC-12(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.AM-6",
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-05"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "blockstorage_block_volume_encrypted_with_cmk",
-        "blockstorage_boot_volume_encrypted_with_cmk",
-        "filestorage_file_system_encrypted_with_cmk",
-        "objectstorage_bucket_encrypted_with_cmk"
-      ]
-    },
-    {
-      "Id": "CEK-10",
-      "Description": "Generate Cryptographic keys using industry accepted cryptographic libraries specifying the algorithm strength and the random number generator used.",
-      "Name": "Key Generation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2",
-                "TS2.3",
-                "SY1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (e)",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2",
-                "27002: 10.1.2 (a)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24",
-                "27002: 8.24 (d), Key management (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2.3",
-                "3.6.1",
-                "PCI Glossary - Cryptographic Key Generation"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.6.1.1",
-                "3.7.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "CEK-12",
-      "Description": "Rotate cryptographic keys in accordance with the calculated cryptoperiod, which includes provisions for considering the risk of information disclosure and legal and regulatory requirements.",
-      "Name": "Key Rotation",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 e)",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (e,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)",
-                "SC-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "kms_key_rotation_enabled",
-        "identity_user_api_keys_rotated_90_days",
-        "identity_user_auth_tokens_rotated_90_days",
-        "identity_user_customer_secret_keys_rotated_90_days",
-        "identity_user_db_passwords_rotated_90_days"
-      ]
-    },
-    {
-      "Id": "CEK-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to destroy keys stored outside a secure environment and revoke keys stored in Hardware Security Modules (HSMs) when they are no longer needed, which include provisions for legal and regulatory requirements.",
-      "Name": "Key Destruction",
-      "Attributes": [
-        {
-          "Section": "Cryptography, Encryption & Key Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.1",
-                "27017: 10.1.1",
-                "27017: 10.1.2",
-                "27001: A.10.1.2",
-                "27002: 10.1.2 (j)",
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.31",
-                "27001: A.8.24",
-                "27002: 5.31 Cryptography",
-                "27002: 8.24 Key management (j,m)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-12",
-                "SC-12(2)",
-                "SC-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.IP-6",
-                "ID.GV-3",
-                "PR.DS-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05",
-                "ID.AM-08",
-                "GV.OC-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.6.4",
-                "3.6.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.7.4",
-                "3.7.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "DCS-06",
-      "Description": "Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.",
-      "Name": "Assets Cataloguing and Tracking",
-      "Attributes": [
-        {
-          "Section": "Datacenter Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DCS - 01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "1.1",
-                "2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27017: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-8",
-                "CM-8(1)",
-                "CM-8(2)",
-                "CM-8(4)",
-                "CM-8(7)",
-                "CM-8(8)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-1",
-                "ID.AM-2",
-                "ID.AM-4",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-01",
-                "ID.AM-02",
-                "ID.AM-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4",
-                "9.7.1",
-                "9.9.1",
-                "9.9.1.a",
-                "9.9.1.b",
-                "9.9.1.c",
-                "12.3.3",
-                "12.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1.1",
-                "6.3.2",
-                "9.4.2",
-                "9.4.3",
-                "12.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "DSP-02",
-      "Description": "Apply industry accepted methods for the secure disposal of data from storage media such that data is not recoverable by any forensic means.",
-      "Name": "Secure Disposal",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3",
-                "CC6.4",
-                "CC6.5",
-                "CC6.7",
-                "P4.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-07"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.3",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.3.2",
-                "27002: 8.3.2",
-                "27001: A.11.2.7",
-                "27002: 11.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.7.10",
-                "27001: A.7.14",
-                "27001: A.8.10",
-                "27002: 7.10 (Secure reuse or disposal)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-22",
-                "SI-12",
-                "SI-12(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.SC-10",
-                "PR.PS-02",
-                "PR.PS-03",
-                "ID.AM-08"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1",
-                "9.8",
-                "9.8.1",
-                "9.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "3.7.5",
-                "9.4.7"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "DSP-03",
-      "Description": "Create and maintain a data inventory, at least for any sensitive data and personal data.",
-      "Name": "Data Inventory",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2",
-                "1.3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.1.1",
-                "27002: 8.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.9",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-12",
-                "CM-12(1)",
-                "PM-5",
-                "PM-5(1)",
-                "SI-12",
-                "SI-12(1)",
-                "SI-19",
-                "SI-19(1)",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1",
-                "9.4.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "DSP-04",
-      "Description": "Classify data according to its type and sensitivity level.",
-      "Name": "Data Classification",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "C1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "DSI-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.3.1",
-                "1.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.8.2.1",
-                "27002: 8.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-16",
-                "AC-16(9)",
-                "PM-22",
-                "PM-23",
-                "PT-2",
-                "PT-2(1)",
-                "SI-18",
-                "SI-18(2)",
-                "SI-19",
-                "SI-19(6)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.AM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-05",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "9.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "9.4.2",
-                "9.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "DSP-07",
-      "Description": "Develop systems, products, and business practices based upon a principle of security by design and industry best practices.",
-      "Name": "Data Protection by Design and Default",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "PI1.2",
-                "PI1.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "16.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.1",
-                "5.3.2",
-                "5.3.3",
-                "5.3.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SD2.2",
-                "IM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.14.1.1",
-                "27002:14.1.1",
-                "27001: A.14.2.5",
-                "27002:14.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.27",
-                "27001: A.8.28",
-                "27001: A.8.29",
-                "27002: 5.8 (Information security requirements a-i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-17",
-                "PM-24",
-                "PM-25",
-                "PT-2",
-                "PT-2(2)",
-                "SA-3",
-                "SA-4",
-                "SA-5",
-                "SA-8",
-                "SA-8(9)",
-                "SA-8(13)",
-                "SA-8(18)",
-                "SA-8(20)",
-                "SA-8(22)",
-                "SA-8(23)",
-                "SA-8(33)",
-                "SA-15",
-                "SA-15(12)",
-                "SC-3",
-                "SC-3(3)",
-                "SC-7",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(4)",
-                "SC-28",
-                "SC-28(1)",
-                "SI-12",
-                "SI-12(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-2",
-                "PR.PT-3",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "PR.PS-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "objectstorage_bucket_not_publicly_accessible",
-        "database_autonomous_database_access_restricted",
-        "analytics_instance_access_restricted",
-        "integration_instance_access_restricted"
-      ]
-    },
-    {
-      "Id": "DSP-10",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure any transfer of personal or sensitive data is protected from unauthorized access and only processed within scope as permitted by the respective laws and regulations.",
-      "Name": "Sensitive Data Transfer",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.12",
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "9.5.1",
-                "9.5.2",
-                "9.5.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27001: A.8.3.3",
-                "27002: 8.3.3",
-                "27001: A.13.2.3",
-                "27002: 13.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.7.10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-4",
-                "AC-4(23)-(25)",
-                "CA-3",
-                "CA-3(6)",
-                "CA-6",
-                "CA-6(1)",
-                "CA-6(2)",
-                "SC-4",
-                "SC-4(2)",
-                "SC-7",
-                "SC-7(10)",
-                "SC-7(24)",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-16",
-                "SC-16(1)-(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.DS-5",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.IR-01",
-                "ID.AM-03",
-                "GV.OC-03",
-                "ID.AM-07"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "4.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.1.1",
-                "4.2.1",
-                "4.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_instance_in_transit_encryption_enabled"
-      ]
-    },
-    {
-      "Id": "DSP-16",
-      "Description": "Data retention, archiving and deletion is managed in accordance with business requirements, applicable laws and regulations.",
-      "Name": "Data Retention and Deletion",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "C1.1",
-                "C1.2",
-                "CC3.1",
-                "P4.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-02",
-                "BCR-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.4",
-                "3.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.3.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.10",
-                "27002: 5.33 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SI-12",
-                "SI-12(1)-(3)",
-                "SI-18",
-                "SI-18(1)",
-                "SI-18(4)",
-                "SI-18(5)",
-                "SI-19",
-                "SI-19(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-3",
-                "PR.IP-6",
-                "ID.GV-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-08",
-                "GV.OC-03",
-                "GV.SC-10",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "audit_log_retention_period_365_days"
-      ]
-    },
-    {
-      "Id": "DSP-17",
-      "Description": "Define and implement, processes, procedures and technical measures to protect sensitive data throughout it's lifecycle.",
-      "Name": "Sensitive Data Protection",
-      "Attributes": [
-        {
-          "Section": "Data Security and Privacy Lifecycle Management",
-          "CCMLite": "Yes",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSC-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.1",
-                "CC6.1",
-                "CC6.3",
-                "CC6.7",
-                "CC8.1",
-                "C1.1",
-                "P2.0",
-                "P3.0",
-                "P4.0",
-                "P5.0",
-                "P6.0"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.1",
-                "3.1",
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.3.3",
-                "9.1.1",
-                "9.2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.1",
-                "IM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001:A.18.1.4",
-                "27002:18.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.11",
-                "27001: A.8.12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-2",
-                "PM-22",
-                "PM-24",
-                "PT-7",
-                "PT-7(1)",
-                "PT-7(2)",
-                "PT-8",
-                "SC-8",
-                "SC-8(1)-(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1",
-                "PR.DS-2",
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-10"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.0 (including all subsections)",
-                "4.0 (including all subsections)"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "objectstorage_bucket_not_publicly_accessible",
-        "objectstorage_bucket_encrypted_with_cmk",
-        "database_autonomous_database_access_restricted",
-        "blockstorage_block_volume_encrypted_with_cmk",
-        "blockstorage_boot_volume_encrypted_with_cmk"
-      ]
-    },
-    {
-      "Id": "GRC-05",
-      "Description": "Develop and implement an Information Security Program, which includes programs for all the relevant domains of the CCM.",
-      "Name": "Information Security Program",
-      "Attributes": [
-        {
-          "Section": "Governance, Risk and Compliance",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "14.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SG2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 4.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-1",
-                "PM-3",
-                "PM-14",
-                "PL-2",
-                "PM-18",
-                "PM-31"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.4.1",
-                "A.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.4.1",
-                "A3.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled"
-      ]
-    },
-    {
-      "Id": "IAM-02",
-      "Description": "Establish, document, approve, communicate, implement, apply, evaluate and maintain strong password policies and procedures. Review and update the policies and procedures at least annually.",
-      "Name": "Strong Password Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-12",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "4.1.2",
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1",
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.7.2.2",
-                "27002: 7.2.2",
-                "27001: A.9.2.6",
-                "27002: 9.2.6",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.17",
-                "27001: A.6.3",
-                "27001: A.8.5",
-                "27001: A.5.37"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-3",
-                "AC-3(3)",
-                "AC-12",
-                "AC-12(1)",
-                "IA-2",
-                "IA-2(10)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.AC-1",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.4",
-                "12.1",
-                "12.1.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.1.1",
-                "8.3.8"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_password_policy_minimum_length_14",
-        "identity_password_policy_expires_within_365_days",
-        "identity_password_policy_prevents_reuse"
-      ]
-    },
-    {
-      "Id": "IAM-03",
-      "Description": "Manage, store, and review the information of system identities, and level of access.",
-      "Name": "Identity Inventory",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-04",
-                "IAM-08",
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.8.1.1",
-                "27002: 8.1.1",
-                "27001: A.9.4.1",
-                "27002: 9.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.2 (c)",
-                "27001: A.5.15",
-                "27001: A.5.16",
-                "27001: A.5.18",
-                "27001: A.7.4",
-                "27001: A.8.15",
-                "27001: A.8.2",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "AU-16",
-                "AU-16(1)",
-                "IA-4",
-                "IA-4(8)",
-                "IA-4(9)",
-                "IA-5",
-                "IA-5(5)",
-                "IA-8",
-                "IA-8(4)",
-                "PM-5(1)",
-                "SA-8",
-                "SA-8(22)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-04",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.4.a"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_user_api_keys_rotated_90_days",
-        "identity_user_auth_tokens_rotated_90_days",
-        "identity_user_customer_secret_keys_rotated_90_days",
-        "identity_user_valid_email_address"
-      ]
-    },
-    {
-      "Id": "IAM-04",
-      "Description": "Employ the separation of duties principle when implementing information system access.",
-      "Name": "Separation of Duties",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC1.3",
-                "CC5.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.2.2",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.6.1.2",
-                "27002: 6.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18",
-                "27001: A.5.3",
-                "27001: A.8.2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(3)",
-                "AC-2(11)",
-                "AC-6",
-                "AC-6(1)-(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.4",
-                "6.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_service_level_admins_exist",
-        "identity_iam_admins_cannot_update_tenancy_admins",
-        "identity_tenancy_admin_permissions_limited"
-      ]
-    },
-    {
-      "Id": "IAM-05",
-      "Description": "Employ the least privilege principle when implementing information system access.",
-      "Name": "Least Privilege",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-06",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.1",
-                "27002: 9.1.1",
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27001: A.9.2.3",
-                "27002: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.8.2",
-                "27002:  5.15 (Other information 2nd (a))"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "IA-12",
-                "IA-12(2)",
-                "IA-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1",
-                "7.1.1",
-                "7.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2",
-                "7.2.5",
-                "7.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_tenancy_admin_permissions_limited",
-        "identity_service_level_admins_exist",
-        "identity_no_resources_in_root_compartment",
-        "identity_non_root_compartment_exists"
-      ]
-    },
-    {
-      "Id": "IAM-07",
-      "Description": "De-provision or respectively modify access of movers / leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.",
-      "Name": "User Access Changes and Revocation",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.3",
-                "6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(1)",
-                "AC-2(2)",
-                "AC-2(6)",
-                "AC-2(8)",
-                "AC-3",
-                "AC-3(8)",
-                "AC-6",
-                "AC-6(7)",
-                "AU-10",
-                "AU-10(4)",
-                "AU-16",
-                "AU-16(1)",
-                "CM-7",
-                "CM-7(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.IP-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-04",
-                "GV.SC-10",
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.5",
-                "8.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_user_api_keys_rotated_90_days",
-        "identity_user_auth_tokens_rotated_90_days",
-        "identity_user_customer_secret_keys_rotated_90_days"
-      ]
-    },
-    {
-      "Id": "IAM-08",
-      "Description": "Review and revalidate user access for least privilege and separation of duties with a frequency that is commensurate with organizational risk tolerance.",
-      "Name": "User Access Review",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-10"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27001: A.9.2.6",
-                "27001: A.9.4.1",
-                "27017: 9.4.1",
-                "27001: A.6.1.2",
-                "27001: A 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.3",
-                "27001: A.5.18",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.5.1",
-                "7.2.5",
-                "7.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_user_api_keys_rotated_90_days",
-        "identity_user_auth_tokens_rotated_90_days",
-        "identity_user_customer_secret_keys_rotated_90_days",
-        "identity_user_db_passwords_rotated_90_days"
-      ]
-    },
-    {
-      "Id": "IAM-09",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the segregation of privileged access roles such that administrative access to data, encryption and key management capabilities and logging capabilities are distinct and separated.",
-      "Name": "Segregation of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.1",
-                "CC6.1",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (j)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-3(7)",
-                "AC-6(4)",
-                "AC-6(8)",
-                "IA-5",
-                "IA-5(6)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.3",
-                "3.5.2",
-                "7.1.2",
-                "7.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.6.1",
-                "3.7.6",
-                "6.5.3",
-                "6.5.4",
-                "7.2.1",
-                "7.2.2",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_tenancy_admin_permissions_limited",
-        "identity_iam_admins_cannot_update_tenancy_admins",
-        "identity_tenancy_admin_users_no_api_keys"
-      ]
-    },
-    {
-      "Id": "IAM-10",
-      "Description": "Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access.",
-      "Name": "Management of Privileged Access Roles",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1",
-                "6.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.3",
-                "27002: 9.2.3",
-                "27017: 9.2.3",
-                "27018: 9.2.3",
-                "27001: A.9.4.4",
-                "27002: 9.4.4",
-                "27017: 9.4.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.2",
-                "27001: A.8.18",
-                "27002: 8.2 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(7)",
-                "AC-3",
-                "AC-3(4)",
-                "AC-3(11)",
-                "AC-3(13)",
-                "AC-3(14)",
-                "AC-6",
-                "AC-6(4)",
-                "AC-6(5)",
-                "AC-6(8)",
-                "AC-12",
-                "AC-12(3)",
-                "AC-17",
-                "AC-17(4)",
-                "IA-8",
-                "IA-8(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "7.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "7.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_tenancy_admin_permissions_limited",
-        "identity_tenancy_admin_users_no_api_keys",
-        "identity_iam_admins_cannot_update_tenancy_admins"
-      ]
-    },
-    {
-      "Id": "IAM-12",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the logging infrastructure is read-only for all with write access, including privileged access roles, and that the ability to disable it is controlled through a procedure that ensures the segregation of duties and break glass procedures.",
-      "Name": "Safeguard Logs Integrity",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.3"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1",
-                "27018: 12.4.1",
-                "27001: A.12.4.2",
-                "27002: 12.4.2",
-                "27017: 12.4.2",
-                "27018: 12.4.2",
-                "27001: A.12.4.3",
-                "27002: 12.4.3",
-                "27017: 12.4.3",
-                "27018: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.18",
-                "27002: 8.15 Protection of Logs"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-2",
-                "AC-2(11)",
-                "AC-2(12)",
-                "IA-8",
-                "IA-8(4)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-34",
-                "SC-34(1)",
-                "SC-34(2)",
-                "SC-36",
-                "SI-4",
-                "SI-4(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "audit_log_retention_period_365_days"
-      ]
-    },
-    {
-      "Id": "IAM-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures that ensure users are identifiable through unique IDs or which can associate individuals to the usage of user IDs.",
-      "Name": "Uniquely Identifiable Users",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.1",
-                "27002: 9.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(14)",
-                "AC-24",
-                "AC-24(2)",
-                "AU-10",
-                "AU-10(1)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-4",
-                "IA-4(1)",
-                "SA-8",
-                "SA-8(22)",
-                "SC-23",
-                "SC-23(3)",
-                "SC-40(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1",
-                "8.2",
-                "8.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "8.2.1",
-                "8.2.2",
-                "8.2.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_user_mfa_enabled_console_access",
-        "identity_user_valid_email_address"
-      ]
-    },
-    {
-      "Id": "IAM-14",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for authenticating access to systems, application and data assets, including multifactor authentication for at least privileged user and sensitive data access. Adopt digital certificates or alternatives which achieve an equivalent level of security for system identities.",
-      "Name": "Strong Authentication",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02",
-                "IAM-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "6.3",
-                "6.5",
-                "12.5",
-                "12.7"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4",
-                "SA1.8"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.1.2",
-                "27002: 9.1.2",
-                "27017: 9.1.2",
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27001: A.9.4.2",
-                "27002: 9.4.2",
-                "27017: 9.4.2",
-                "27018: 9.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.15",
-                "27001: A.5.17",
-                "27001: A.8.5",
-                "27001: A.8.24",
-                "27002: 8.5",
-                "27002: 8.24 other information (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-6",
-                "AC-6(5)",
-                "AC-7",
-                "AC-7(4)",
-                "AU-10",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(8)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5",
-                "IA-5(2)",
-                "IA-5(7)",
-                "IA-5(9)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-5(14)-(16)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(6)",
-                "SC-23",
-                "SC-23(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-6",
-                "PR.AC-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.1.2",
-                "8.1.3",
-                "8.1.6",
-                "8.2",
-                "8.3",
-                "8.3.2",
-                "12.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.1",
-                "8.3.1",
-                "8.3.2",
-                "8.4.1",
-                "8.4.2",
-                "8.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_user_mfa_enabled_console_access"
-      ]
-    },
-    {
-      "Id": "IAM-15",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the secure management of passwords.",
-      "Name": "Passwords Management",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.4",
-                "27002: 9.2.4",
-                "27017: 9.2.4",
-                "27018: 9.2.4",
-                "27001: A.9.3.1",
-                "27002: 9.3.1",
-                "27017: 9.3.1",
-                "27018: 9.3.1",
-                "27001: A.9.4.3",
-                "27002: 9.4.3",
-                "27017: 9.4.3",
-                "27018: 9.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.17"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IA-4",
-                "IA-4(8)",
-                "IA-5",
-                "IA-5(1)",
-                "IA-5(8)",
-                "IA-5(18)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "8.2",
-                "8.2.1-6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.2",
-                "2.3.1",
-                "8.3.5",
-                "8.3.6",
-                "8.3.7",
-                "8.3.8",
-                "8.3.9",
-                "8.3.10",
-                "8.3.10.1",
-                "8.6.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_password_policy_minimum_length_14",
-        "identity_password_policy_expires_within_365_days",
-        "identity_password_policy_prevents_reuse"
-      ]
-    },
-    {
-      "Id": "IAM-16",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.",
-      "Name": "Authorization Mechanisms",
-      "Attributes": [
-        {
-          "Section": "Identity & Access Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.2",
-                "CC6.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IAM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "5.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SA1.3",
-                "SA1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.9.2.5",
-                "27002: 9.2.5",
-                "27017: 9.2.5",
-                "27018: 9.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.18"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-3",
-                "AC-3(5)",
-                "AC-4",
-                "AC-4(17)",
-                "AC-4(21)",
-                "AC-4(22)",
-                "AC-6",
-                "AC-6(8)",
-                "AC-6(9)",
-                "AC-12",
-                "AC-12(1)",
-                "AC-20",
-                "AC-20(1)",
-                "AU-10",
-                "AU-10(1)",
-                "AU-10(2)",
-                "IA-2",
-                "IA-2(1)",
-                "IA-2(2)",
-                "IA-2(12)",
-                "IA-3",
-                "IA-3(1)",
-                "IA-5(1)",
-                "IA-5(2)",
-                "IA-5(5)",
-                "IA-5(8)",
-                "IA-5(10)",
-                "IA-5(12)",
-                "IA-8",
-                "IA-8(1)",
-                "IA-8(2)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4",
-                "PR.AC-6",
-                "PR.AC-7",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-01",
-                "PR.AA-02",
-                "PR.AA-03",
-                "PR.AA-04",
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.3",
-                "7.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "7.2.4",
-                "7.2.3",
-                "7.2.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "identity_tenancy_admin_permissions_limited",
-        "identity_service_level_admins_exist",
-        "database_autonomous_database_access_restricted",
-        "analytics_instance_access_restricted",
-        "integration_instance_access_restricted"
-      ]
-    },
-    {
-      "Id": "IPY-03",
-      "Description": "Implement cryptographically secure and standardized network protocols for the management, import and export of data.",
-      "Name": "Secure Interoperability and Portability Management",
-      "Attributes": [
-        {
-          "Section": "Interoperability & Portability",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IPY-04"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.2",
-                "NC1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1",
-                "27001: A.15.1.1",
-                "27002: 15.1.1",
-                "27017: 15.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.19",
-                "27001: A.5.23",
-                "27001: A.5.31",
-                "27001: A.5.32",
-                "27001: A.5.33",
-                "27001: A.5.34"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PT-2",
-                "PT-2(2)",
-                "SA-4",
-                "SC-16",
-                "SC-16(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.1",
-                "1.2.5",
-                "1.2.6",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_instance_in_transit_encryption_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-02",
-      "Description": "Plan and monitor the availability, quality, and adequate capacity of resources in order to deliver the required system performance as determined by the business.",
-      "Name": "Capacity and Resource Planning",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "No",
-          "IaaS": "CSP-Owned",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "A1.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-04"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.3",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.12.1.3",
-                "27002: 12.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.3 (b)",
-                "27001: 6.1",
-                "27001: 9.1",
-                "27001: A.8.6",
-                "27001: A.8.14"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CP-2",
-                "CP-2(2)",
-                "SC-5",
-                "SC-5(2)",
-                "SC-4",
-                "SI-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-4",
-                "ID.BE-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-04",
-                "GV.OC-04"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "IVS-03",
-      "Description": "Monitor, encrypt and restrict communications between environments to only authenticated and authorized connections, as justified by the business. Review these configurations at least annually, and support them by a documented justification of all allowed services, protocols, ports, and compensating controls.",
-      "Name": "Network Security",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-06"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.8",
-                "3.1",
-                "12.2",
-                "13.6",
-                "13.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: A.5.15 2nd c)",
-                "27002: 8.20",
-                "27002: 8.21",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-1",
-                "SC-4",
-                "SC-7",
-                "SC-7(4)",
-                "SC-7(5)",
-                "SC-7(8)",
-                "SC-7(9)",
-                "SC-7(11)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-11",
-                "SC-12",
-                "SC-16",
-                "SC-23",
-                "SC-29",
-                "SC-29(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-5",
-                "PR.AC-7",
-                "PR.PT-4",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.DS-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.IR-01",
-                "PR.AA-03",
-                "PR.AA-05",
-                "DE.CM-01",
-                "PR.DS-02",
-                "ID.AM-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "1.1.6",
-                "1.2",
-                "1.2.3",
-                "2.2",
-                "4.1.1",
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.2.5",
-                "1.2.6",
-                "1.2.7",
-                "1.4.2",
-                "2.2.4",
-                "2.2.5",
-                "2.2.7",
-                "4.2.1",
-                "10.1.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "network_vcn_subnet_flow_logs_enabled",
-        "network_default_security_list_restricts_traffic",
-        "network_security_group_ingress_from_internet_to_ssh_port",
-        "network_security_group_ingress_from_internet_to_rdp_port",
-        "network_security_list_ingress_from_internet_to_ssh_port",
-        "network_security_list_ingress_from_internet_to_rdp_port"
-      ]
-    },
-    {
-      "Id": "IVS-04",
-      "Description": "Harden host and guest OS, hypervisor or infrastructure control plane according to their respective best practices, and supported by technical controls, as part of a security baseline.",
-      "Name": "OS Hardening and Base Controls",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "CSP-Owned",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.8",
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-07",
-                "IVS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "4.1",
-                "4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.1.3",
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SY1.1",
-                "SY1.3",
-                "SY1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.14.2.2",
-                "27002: 14.2.2",
-                "27001: A.14.2.3",
-                "27001 A.14.2.4",
-                "27018: 12.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: A.5.37",
-                "27001: A.8.5",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.22",
-                "27001: A.8.24",
-                "27002: 8.20",
-                "27002: 8.22",
-                "27002: 8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-6",
-                "CM-6(1)",
-                "SC-29",
-                "SC-29(1)",
-                "SC-2",
-                "SC-7",
-                "SC-7(12)",
-                "SC-30",
-                "SC-34",
-                "SC-35",
-                "SC-39",
-                "SC-44"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.IP-1",
-                "PR.PT-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "2.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_instance_legacy_metadata_endpoint_disabled",
-        "compute_instance_secure_boot_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-06",
-      "Description": "Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.",
-      "Name": "Segmentation and Segregation",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-09"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.3.4",
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SC2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 9.1",
-                "27001: A.5.15",
-                "27001: A.5.20",
-                "27001: A.8.3",
-                "27001: A.8.9",
-                "27001: A.8.16",
-                "27001: A.8.22",
-                "27002: 5.15 (b)",
-                "27002: 8.3 (b)",
-                "27002: 8.16 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-3",
-                "SC-7",
-                "SC-7(20)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.AC-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.IR-01",
-                "PR.PS-01",
-                "PR.PS-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "2.6",
-                "8.3.1",
-                "10.8",
-                "11.3",
-                "A3.2.1",
-                "A3.3.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A1.1.1",
-                "A1.1.2",
-                "A1.1.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "network_default_security_list_restricts_traffic",
-        "identity_non_root_compartment_exists",
-        "identity_no_resources_in_root_compartment"
-      ]
-    },
-    {
-      "Id": "IVS-07",
-      "Description": "Use secure and encrypted communication channels when migrating servers, services, applications, or data to cloud environments. Such channels must include only up-to-date and approved protocols.",
-      "Name": "Migration to Cloud Environments",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-10"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.4",
-                "IM1.4",
-                "NC1.4",
-                "SC2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.13.1.1",
-                "27002: 13.1.1",
-                "27017: 13.1.1",
-                "27018: 13.1.1",
-                "27001: A.13.1.2",
-                "27002: 13.1.2",
-                "27017: 13.1.2",
-                "27018: 13.1.2",
-                "27001: A.13.1.3",
-                "27002: 13.1.3",
-                "27017: 13.1.3",
-                "27018: 13.1.3",
-                "27001: A.13.2.1",
-                "27002: 13.2.1",
-                "27017: 13.2.1",
-                "27018: 13.2.1",
-                "27001: A.13.2.2",
-                "27002: 13.2.2",
-                "27017: 13.2.2",
-                "27018: 13.2.2",
-                "27001: A.13.2.3",
-                "27002: 13.2.3",
-                "27017: 13.2.3",
-                "27018: 13.2.3",
-                "27001: A.13.2.4",
-                "27002: 13.2.4",
-                "27017: 13.2.4",
-                "27018: 13.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.14",
-                "27001: A.8.20",
-                "27001: A.8.24",
-                "27002: 8.20 (e)",
-                "27002: 8.24 Guidance (b,f), other information (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-17",
-                "AC-20",
-                "SC-7",
-                "SC-7(28)",
-                "SC-8",
-                "SC-8(1)",
-                "SC-12",
-                "SC-23",
-                "SC-29",
-                "SI-7",
-                "SI-7(1)-(3)",
-                "SI-7(5)-(10)",
-                "SI-7(12)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-2",
-                "PR.PT-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "compute_instance_in_transit_encryption_enabled"
-      ]
-    },
-    {
-      "Id": "IVS-09",
-      "Description": "Define, implement and evaluate processes, procedures and defense-in-depth techniques for protection, detection, and timely response to network-based attacks.",
-      "Name": "Network Defense",
-      "Attributes": [
-        {
-          "Section": "Infrastructure & Virtualization Security",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.6",
-                "CC6.8",
-                "CC7.1",
-                "CC7.2",
-                "CC7.5"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-13"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "13.3",
-                "13.8"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3",
-                "5.2.4",
-                "5.2.5",
-                "5.2.7",
-                "5.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "NC1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.14.1.2",
-                "27002: 14.1.2",
-                "27017: 14.1.2",
-                "27001: A.11.1.4",
-                "27002: 11.1.4",
-                "27017: 11.1.4",
-                "27018: 16.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1",
-                "27001: 6.2",
-                "27001: A.5.24",
-                "27001: A.5.26",
-                "27001: A.8.8",
-                "27001: A.8.16",
-                "27001: A.8.20",
-                "27001: A.8.21",
-                "27001: A.8.22",
-                "27001: A.8.26",
-                "27002: 8.8 (i)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PL-8",
-                "PL-8(1)",
-                "SC-5",
-                "SC-5(1)",
-                "SC-5(3)",
-                "SC-7",
-                "SC-7(13)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.DP-1",
-                "DE.CM-1",
-                "DE.CM-7",
-                "PR.AC-5",
-                "RS.MI-2",
-                "PR.DS-2",
-                "RS.RP-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "DE.CM-01",
-                "PR.IR-01",
-                "RS.MA-01",
-                "RS.MI-01",
-                "RS.MI-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.6",
-                "1.1",
-                "1.2",
-                "1.3",
-                "1.5",
-                "12.10.5"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.3.1",
-                "1.3.2",
-                "1.3.3",
-                "1.4.1",
-                "1.4.2",
-                "1.4.3",
-                "1.4.4",
-                "1.4.5",
-                "1.5.1",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled",
-        "events_rule_cloudguard_problems"
-      ]
-    },
-    {
-      "Id": "LOG-02",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.",
-      "Name": "Audit Logs Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1",
-                "8.9",
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.3",
-                "5.1.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.18.1.3",
-                "27002: 18.1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-4",
-                "AU-11"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "ID.AM-08",
-                "PR.DS-11",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.7"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4",
-                "10.5.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "audit_log_retention_period_365_days"
-      ]
-    },
-    {
-      "Id": "LOG-03",
-      "Description": "Identify and monitor security-related events within applications and the underlying infrastructure. Define and implement a system to generate alerts to responsible stakeholders based on such events and corresponding metrics.",
-      "Name": "Security Monitoring and Alerting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.8",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03",
-                "SEF-05"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.5"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "5.2.7",
-                "1.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2",
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.28",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-13"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-3",
-                "DE.AE-5",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-4",
-                "DE.CM-5",
-                "DE.CM-6",
-                "DE.CM-7",
-                "DE.DP-1",
-                "DE.DP-4",
-                "DE.AE-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2",
-                "10.4.1.1",
-                "10.4.2.1",
-                "10.4.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled",
-        "events_rule_cloudguard_problems",
-        "events_notification_topic_and_subscription_exists",
-        "events_rule_local_user_authentication"
-      ]
-    },
-    {
-      "Id": "LOG-04",
-      "Description": "Restrict audit logs access to authorized personnel and maintain records that provide unique access accountability.",
-      "Name": "Audit Logs Access and Accountability",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.14"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "3.1.1",
-                "4.1.2",
-                "4.1.3",
-                "4.2.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27001: A.12.4.1",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.33",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(4)",
-                "AU-9(6)",
-                "AU-10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-1",
-                "PR.AC-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.1",
-                "10.2.1",
-                "10.2.3",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1.3",
-                "10.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "LOG-05",
-      "Description": "Monitor security audit logs to detect activity outside of typical or expected patterns. Establish and follow a defined process to review and take appropriate and timely actions on detected anomalies.",
-      "Name": "Audit Logs Monitoring and Response",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.8",
-                "8.11"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "1.6.2",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.3",
-                "27002: 12.4.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15",
-                "27001: A.8.16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-6",
-                "AU-6(1)",
-                "AU-6(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-3",
-                "PR.PT-1",
-                "RS.AN-1",
-                "RS.CO-1.",
-                "DE.AE-1",
-                "DE.AE-5",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.AM-03",
-                "PR.PS-04",
-                "DE.AE-02",
-                "DE.AE-03",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6",
-                "10.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.1.1",
-                "10.4.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "events_rule_iam_group_changes",
-        "events_rule_iam_policy_changes",
-        "events_rule_identity_provider_changes",
-        "events_rule_idp_group_mapping_changes",
-        "events_rule_local_user_authentication",
-        "events_rule_network_gateway_changes",
-        "events_rule_network_security_group_changes",
-        "events_rule_route_table_changes",
-        "events_rule_security_list_changes",
-        "events_rule_user_changes",
-        "events_rule_vcn_changes",
-        "events_rule_cloudguard_problems"
-      ]
-    },
-    {
-      "Id": "LOG-07",
-      "Description": "Establish, document and implement which information meta/data system events should be logged. Review and update the scope at least annually or whenever there is a change in the threat environment.",
-      "Name": "Logging Scope",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 7.5.3",
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-14",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.SC-3",
-                "ID.SC-4",
-                "PR.PT-1",
-                "ID.GV-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.1",
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "audit_log_retention_period_365_days",
-        "network_vcn_subnet_flow_logs_enabled",
-        "objectstorage_bucket_logging_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-08",
-      "Description": "Generate audit records containing relevant security information.",
-      "Name": "Log Records",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "8.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.1",
-                "27002: 12.4.1",
-                "27017: 12.4.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-3",
-                "AU-3(1)",
-                "AU-3(3)",
-                "AU-6",
-                "AU-6(8)",
-                "AU-12",
-                "AU-12(1)",
-                "AU-12(2)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3",
-                "DE.CM-1",
-                "DE.CM-2",
-                "DE.CM-3",
-                "DE.CM-6",
-                "DE.CM-7"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-01",
-                "DE.CM-02",
-                "DE.CM-03",
-                "DE.CM-06",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.3"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.2.2"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "audit_log_retention_period_365_days",
-        "network_vcn_subnet_flow_logs_enabled",
-        "objectstorage_bucket_logging_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-09",
-      "Description": "The information system protects audit records from unauthorized access, modification, and deletion.",
-      "Name": "Log Protection",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "GRM-04",
-                "IVS-01"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.4",
-                "4.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.4.2",
-                "27002: 12.4.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.15"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(2)",
-                "AU-9(3)",
-                "AU-9(4)",
-                "AU-12(3)",
-                "AU-12(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.AC-4",
-                "PR.IP-4",
-                "PR.IP-6",
-                "PR.PT-1",
-                "PR.DS-1",
-                "PR.DS-6"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AA-05",
-                "PR.DS-01",
-                "PR.DS-02",
-                "PR.DS-11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.5",
-                "10.5.1",
-                "10.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.3.1",
-                "10.3.2",
-                "10.3.3",
-                "10.3.4"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "audit_log_retention_period_365_days"
-      ]
-    },
-    {
-      "Id": "LOG-10",
-      "Description": "Establish and maintain a monitoring and internal reporting capability over the operations of cryptographic, encryption and key management policies, processes, procedures, and controls.",
-      "Name": "Encryption Monitoring and Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02",
-                "EKM-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "4.2.1",
-                "5.1.1",
-                "5.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1",
-                "27002: 10.1",
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-1",
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "PR.PT-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.1.1",
-                "10.2.1",
-                "10.4.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "kms_key_rotation_enabled"
-      ]
-    },
-    {
-      "Id": "LOG-11",
-      "Description": "Log and monitor key lifecycle management events to enable auditing and reporting on usage of cryptographic keys.",
-      "Name": "Transaction/Activity Logging",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "EKM-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.10.1.2",
-                "27017: 10.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.24"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-9",
-                "AU-9(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.PT-1",
-                "DE.AE-3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.CM-09"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "audit_log_retention_period_365_days"
-      ]
-    },
-    {
-      "Id": "LOG-13",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the reporting of anomalies and failures of the monitoring system and provide immediate notification to the accountable party.",
-      "Name": "Failures and Anomalies Reporting",
-      "Attributes": [
-        {
-          "Section": "Logging and Monitoring",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3",
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-03"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.1",
-                "5.2.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.16.1.2",
-                "27017: 16.1.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.24",
-                "27001: A.6.8",
-                "27002: 6.8 (g)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AU-5",
-                "AU-5(2)",
-                "AU-6",
-                "AU-6(3)",
-                "AU-6(4)",
-                "AU-6(5)",
-                "AU-16"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-3",
-                "DE.DP-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-04",
-                "DE.AE-06"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "10.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "10.4.3",
-                "10.7.1",
-                "10.7.2",
-                "10.7.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled",
-        "events_rule_cloudguard_problems",
-        "events_notification_topic_and_subscription_exists"
-      ]
-    },
-    {
-      "Id": "SEF-03",
-      "Description": "'Establish, document, approve, communicate, apply, evaluate and maintain a security incident response plan, which includes but is not limited to: relevant internal departments, impacted CSCs, and other business critical relationships (such as supply-chain) that may be impacted.'",
-      "Name": "Incident Response Plans",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2",
-                "CC7.3",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "BCR-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2",
-                "17.4"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27017: CLD.12.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: A.5.26",
-                "27002: 5.26 (e,f)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-1",
-                "IR-2",
-                "IR-2(1)-(3)",
-                "IR-3",
-                "IR-3(1)-(3)",
-                "IR-4",
-                "IR-4(1)-(15)",
-                "IR-5",
-                "IR-5(1)",
-                "IR-6",
-                "IR-6(1)-(3)",
-                "IR-7",
-                "IR-7(1)",
-                "IR-7(2)",
-                "IR-8",
-                "IR-8(1)",
-                "IR-9",
-                "IR-9(1)-(4)",
-                "PM-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.CO-1",
-                "RS.CO-4",
-                "ID.AM-6",
-                "ID.GV-2",
-                "ID.SC-5",
-                "PR.IP-9",
-                "PR.IP10"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.AT-01",
-                "PR.AT-02",
-                "RS.MA-01",
-                "GV.SC-08",
-                "ID.IM-02",
-                "ID.IM-04",
-                "RC.RP-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.1",
-                "12.10.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1",
-                "12.10.5"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "SEF-06",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.",
-      "Name": "Event Triage Processes",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-02"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.16.1.4",
-                "27002: 16.1.4",
-                "27017: 16.1.4",
-                "27018: 16.1.4",
-                "27001: A.16.1.5",
-                "27002: 16.1.5",
-                "27017: 16.1.5",
-                "27018: 16.1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.25"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CA-7",
-                "CA-7(3)",
-                "CA-7(4)",
-                "CA-7(5)",
-                "CA-7(6)",
-                "IR-4",
-                "IR-4(1)",
-                "IR-4(3)",
-                "IR-4(4)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.AE-1",
-                "DE.AE-2",
-                "DE.AE-4",
-                "RS.RP-1",
-                "RS.AN-2"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "RS.MA-02",
-                "RS.MA-03",
-                "RS.AN-03",
-                "DE.AE-02",
-                "DE.AE-04",
-                "DE.AE-06",
-                "DE.AE-07",
-                "DE.AE-08",
-                "RS.MI-02",
-                "RC.RP-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "12.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled"
-      ]
-    },
-    {
-      "Id": "SEF-08",
-      "Description": "Maintain points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities.",
-      "Name": "Points of Contact Maintenance",
-      "Attributes": [
-        {
-          "Section": "Security Incident Management, E-Discovery, & Cloud Forensics",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC2.3"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "SEF-01"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "17.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.6.2",
-                "1.6.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "SM2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 4.2",
-                "27001: A.6.1.3",
-                "27002: 6.1.3",
-                "27017: 6.1.3",
-                "27018: 6.1.3",
-                "27001: A.16.1.1",
-                "27002: 16.1.1",
-                "27001: A.18.1.1",
-                "27002: 18.1.1",
-                "27017: 18.1.1",
-                "27018: 18.1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.5",
-                "27001: A.5.24",
-                "27002: 5.24 Incident management procedure (d)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "IR-4",
-                "IR-4(8)",
-                "IR-6",
-                "IR-6(3)",
-                "IR-7",
-                "IR-7(2)",
-                "PM-21",
-                "PM-23",
-                "PM-26"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-2",
-                "RS.CO-3",
-                "RS.CO-4"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.RR-02",
-                "RS.CO-02",
-                "RS.CO-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "TVM-02",
-      "Description": "Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures to protect against malware on managed assets. Review and update the policies and procedures at least annually.",
-      "Name": "Malware Protection Policy and Procedures",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC6.8"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-01",
-                "GRM-06",
-                "GRM-09"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "9.7",
-                "10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "1.1.1",
-                "1.5.1",
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.2",
-                "TS1.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5",
-                "27002: 5",
-                "27001: A.12.2.1",
-                "27001: A.6.2.1",
-                "27002: 6.2.1 (h)",
-                "27001: A.6.2.2",
-                "27002: 6.2.2 (j)",
-                "27001: A.7.2.2",
-                "27002: 7.2.2 (d)",
-                "27001: A.10.1.1",
-                "27002: 10.1.1 (g)",
-                "27001: A.13.2.1",
-                "27002: 13.2.1 (b)",
-                "27001: A.15.1.2",
-                "27017: 15.1.2",
-                "27001: A.12.2.1",
-                "27002: 12.2.1 (a),(d)",
-                "27017: CLD.9.5.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 5.1",
-                "27001: 5.2",
-                "27001: 7.3",
-                "27001: 7.4",
-                "27001: 7.5",
-                "27001: 9.1",
-                "27001: 9.3",
-                "27001: A.5.1",
-                "27001: A.5.4",
-                "27001: A.5.7",
-                "27001: A.5.37",
-                "27001: A.8.7",
-                "27002: 5.7 (b)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-3",
-                "RA-3(3)",
-                "RA-5",
-                "RA-5(3)",
-                "RA-5(5)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.GV-1",
-                "DE.CM-4",
-                "DE.CM-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "GV.PO-01",
-                "GV.PO-02",
-                "ID.IM-03",
-                "DE.CM-01",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.4",
-                "12.1",
-                "12.1.1",
-                "12.3.1",
-                "12.5.1",
-                "12.11"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "12.1.1",
-                "12.1.2",
-                "5.1.1",
-                "5.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "TVM-03",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to enable both scheduled and emergency responses to vulnerability identifications, based on the identified risk.",
-      "Name": "Vulnerability Remediation Schedule",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC5.3",
-                "CC7.1",
-                "CC7.4"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.2",
-                "7.7",
-                "17.9"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "TM2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.2.1",
-                "27001: A.12.6.1",
-                "27002: 12.6.1(c)(d)(j)",
-                "27018: 12.6.1(k)(i)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.8.7",
-                "27001: A.8.8",
-                "27001: A.8.32",
-                "27002: 8.7",
-                "27002: 8.8",
-                "27002: 8.32"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "PM-31",
-                "RA-3",
-                "RA-3(1)",
-                "RA-5",
-                "RA-5(2)-(4)",
-                "RA-5(6)",
-                "SI-3",
-                "SI-3(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "RS.AN-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-06",
-                "ID.RA-08",
-                "PR.PS-02",
-                "PR.PS-03"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.1.a",
-                "6.1.b"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.1.1",
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "12.10.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "TVM-04",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to update detection tools, threat signatures, and indicators of compromise on a weekly, or more frequent basis.",
-      "Name": "Detection Updates",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "10.2"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TS1.3",
-                "TS1.4",
-                "TM1.3",
-                "TM1.4",
-                "IM1.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1.1",
-                "27002: 5.1.1 (h)",
-                "27001: A.12.6.1",
-                "27002: 12.6.1 (b),(c)"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.5.1",
-                "27001: A.8.8",
-                "27001: A.8.15",
-                "27001: A.8.16",
-                "27002: 5.1",
-                "27002: 5.37",
-                "27002: 8.8",
-                "27002: 8.15 (d)",
-                "27002: 8.16 (d,e)",
-                "27002: 8.31 2nd (a)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "CM-7",
-                "CM-7(4)",
-                "RA-3",
-                "RA-3(3)",
-                "RA-5(2)",
-                "SA-10",
-                "SA-10(5)",
-                "SA-11",
-                "SA-11(2)",
-                "SI-2",
-                "SI-2(4)",
-                "SI-3",
-                "SI-3(4)",
-                "SI-4",
-                "SI-4(9)",
-                "SI-4(24)",
-                "SI-8",
-                "SI-8(2)",
-                "SI-8(3)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.PS-02",
-                "ID.RA-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "5.2",
-                "5.2a",
-                "5.2b",
-                "5.2c"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "5.3.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled"
-      ]
-    },
-    {
-      "Id": "TVM-05",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures to identify updates for applications which use third party or open source libraries according to the organization's vulnerability management policy.",
-      "Name": "External Library Vulnerabilities",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "CSP-Owned",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC3.2"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "No mapping"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1",
-                "SD2.3"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A.12.6.2",
-                "27002: 12.6.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: 6.1.3",
-                "27001: A 5.6",
-                "27001: A.8.19",
-                "27001: A.8.8",
-                "27001: A.8.28",
-                "27001: A.8.31",
-                "27002: 5.6 (c)",
-                "27001: 8.19",
-                "27001: 8.8",
-                "27001: 8.28",
-                "27001: 8.31"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(3)",
-                "SA-11",
-                "SA-11(2)",
-                "SA-11(5)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "DE.DP-5",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01",
-                "ID.RA-03",
-                "PR.PS-02"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "6.2",
-                "6.3.2"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    },
-    {
-      "Id": "TVM-07",
-      "Description": "Define, implement and evaluate processes, procedures and technical measures for the detection of vulnerabilities on organizationally managed assets at least monthly.",
-      "Name": "Vulnerability Identification",
-      "Attributes": [
-        {
-          "Section": "Threat & Vulnerability Management",
-          "CCMLite": "Yes",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC7.1"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "TVM-02"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "7.1",
-                "7.5",
-                "7.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.5",
-                "5.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "TM1.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.6",
-                "27001: A.12.6.1",
-                "27002: 12.6.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.8",
-                "27002: 8.8"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "RA-5",
-                "RA-5(4)",
-                "RA-5(5)",
-                "SA-11",
-                "SA-11(5)",
-                "SA-15(5)",
-                "SC-7",
-                "SC-7(10)",
-                "SI-3(8)",
-                "SI-3(10)",
-                "SI-7",
-                "SI-7(9)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "ID.RA-1",
-                "DE.CM-8",
-                "PR.IP-12"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "ID.RA-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "6.1",
-                "11.2",
-                "11.2.1"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "6.3.1",
-                "6.3.2",
-                "6.3.3",
-                "11.3.2",
-                "11.3.2.1"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "cloudguard_enabled"
-      ]
-    },
-    {
-      "Id": "UEM-08",
-      "Description": "Protect information from unauthorized disclosure on managed endpoint devices with storage encryption.",
-      "Name": "Storage Encryption",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.1",
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CCM v3.0.1",
-              "Identifiers": [
-                "MOS-11"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.1.2",
-                "3.1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "PA1.2",
-                "PA1.3",
-                "PA1.5",
-                "PA2.2",
-                "PM1.4"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.11.2.7",
-                "27002: 11.2.7",
-                "27001: A.18.1.1",
-                "27017: 18.1.1",
-                "27001: A.12.3.1",
-                "27017: 12.3.1",
-                "27018: A.11.4",
-                "27018: A.11.5"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.8.1",
-                "27002: 8.1 (h)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "AC-19(5)",
-                "SC-28",
-                "SC-28(1)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-1"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-01"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "3.4",
-                "3.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "3.5.1",
-                "3.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": [
-        "blockstorage_block_volume_encrypted_with_cmk",
-        "blockstorage_boot_volume_encrypted_with_cmk",
-        "filestorage_file_system_encrypted_with_cmk"
-      ]
-    },
-    {
-      "Id": "UEM-11",
-      "Description": "Configure managed endpoints with Data Loss Prevention (DLP) technologies and rules in accordance with a risk assessment.",
-      "Name": "Data Loss Prevention",
-      "Attributes": [
-        {
-          "Section": "Universal Endpoint Management",
-          "CCMLite": "No",
-          "IaaS": "Shared",
-          "PaaS": "Shared",
-          "SaaS": "Shared",
-          "ScopeApplicability": [
-            {
-              "ReferenceId": "AICPA TSC 2017",
-              "Identifiers": [
-                "CC6.7"
-              ]
-            },
-            {
-              "ReferenceId": "CIS v8.0",
-              "Identifiers": [
-                "3.13"
-              ]
-            },
-            {
-              "ReferenceId": "ENX ISA v6.0",
-              "Identifiers": [
-                "5.2.7"
-              ]
-            },
-            {
-              "ReferenceId": "ISF SOGP 2022",
-              "Identifiers": [
-                "IM1.5",
-                "PA2.2"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2013,27002:2013,27017:2015,27018:2019",
-              "Identifiers": [
-                "27001: A.12.3",
-                "27002: 12.3",
-                "27001: A.8.3.1",
-                "27002: 8.3.1",
-                "27001: A.12.2",
-                "27002: 12.2",
-                "27001: A.18.1.3",
-                "27002: 18.1.3",
-                "27001: A.6.1.1",
-                "27017: 6.1.1",
-                "27018: 12.3.1",
-                "27018: 10.1"
-              ]
-            },
-            {
-              "ReferenceId": "ISO/IEC 27001:2022, 27002:2022",
-              "Identifiers": [
-                "27001: A.5.12",
-                "27001: A.8.3"
-              ]
-            },
-            {
-              "ReferenceId": "NIST 800-53 rev 5",
-              "Identifiers": [
-                "SC-7",
-                "SC-7(10)"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v1.1",
-              "Identifiers": [
-                "PR.DS-5"
-              ]
-            },
-            {
-              "ReferenceId": "NIST CSF v2.0",
-              "Identifiers": [
-                "PR.DS-02",
-                "PR.DS-10",
-                "PR.PS-01",
-                "ID.AM-08",
-                "DE.CM-09"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v3.2.1",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            },
-            {
-              "ReferenceId": "PCI DSS v4.0",
-              "Identifiers": [
-                "A3.2.6"
-              ]
-            }
-          ]
-        }
-      ],
-      "Checks": []
-    }
-  ]
-}
diff --git a/prowler/config/config.py b/prowler/config/config.py
index 4c76d98c1c..9e2b079da6 100644
--- a/prowler/config/config.py
+++ b/prowler/config/config.py
@@ -1,3 +1,4 @@
+import importlib.metadata
 import os
 import pathlib
 from datetime import datetime, timezone
@@ -48,7 +49,7 @@ class _MutableTimestamp:
 
 timestamp = _MutableTimestamp(datetime.today())
 timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.30.0"
+prowler_version = "5.31.0"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"
@@ -85,13 +86,38 @@ class Provider(str, Enum):
 actual_directory = pathlib.Path(os.path.dirname(os.path.realpath(__file__)))
 
 
+def _get_ep_compliance_dirs() -> dict:
+    """Discover compliance directories from entry points. Returns {provider: path}."""
+    dirs = {}
+    for ep in importlib.metadata.entry_points(group="prowler.compliance"):
+        try:
+            module = ep.load()
+            if hasattr(module, "__path__"):
+                dirs[ep.name] = module.__path__[0]
+            elif hasattr(module, "__file__"):
+                dirs[ep.name] = os.path.dirname(module.__file__)
+        except Exception as error:
+            logger.warning(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+    return dirs
+
+
 def get_available_compliance_frameworks(provider=None):
     available_compliance_frameworks = []
-    providers = [p.value for p in Provider]
+    # Built-in compliance
+    compliance_base = f"{actual_directory}/../compliance"
     if provider:
         providers = [provider]
-    for current_provider in providers:
-        compliance_dir = f"{actual_directory}/../compliance/{current_provider}"
+    else:
+        # Scan compliance directory for all provider subdirectories
+        providers = []
+        if os.path.isdir(compliance_base):
+            for entry in os.scandir(compliance_base):
+                if entry.is_dir():
+                    providers.append(entry.name)
+    for prov in providers:
+        compliance_dir = f"{compliance_base}/{prov}"
         if not os.path.isdir(compliance_dir):
             continue
         with os.scandir(compliance_dir) as files:
@@ -100,7 +126,8 @@ def get_available_compliance_frameworks(provider=None):
                     available_compliance_frameworks.append(
                         file.name.removesuffix(".json")
                     )
-    # Also scan top-level compliance/ for multi-provider (universal) JSONs.
+    # Built-in multi-provider frameworks at top-level compliance/ directory.
+    # Placed before external entry points so built-ins win on name collisions.
     # When a specific provider was requested, only include the framework if it
     # declares support for that provider; otherwise include all universal frameworks.
     compliance_root = f"{actual_directory}/../compliance"
@@ -117,6 +144,43 @@ def get_available_compliance_frameworks(provider=None):
                             continue
                     if name not in available_compliance_frameworks:
                         available_compliance_frameworks.append(name)
+    # External per-provider compliance via entry points.
+    ep_dirs = _get_ep_compliance_dirs()
+    for prov, path in ep_dirs.items():
+        if provider and prov != provider:
+            continue
+        if os.path.isdir(path):
+            for file in os.scandir(path):
+                if file.is_file() and file.name.endswith(".json"):
+                    name = file.name.removesuffix(".json")
+                    if name not in available_compliance_frameworks:
+                        available_compliance_frameworks.append(name)
+    # External multi-provider frameworks via the dedicated universal group;
+    # filtered by supports_provider when a provider is given.
+    for ep in importlib.metadata.entry_points(group="prowler.compliance.universal"):
+        try:
+            module = ep.load()
+            path = (
+                module.__path__[0]
+                if hasattr(module, "__path__")
+                else os.path.dirname(module.__file__)
+            )
+        except Exception as error:
+            logger.warning(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            continue
+        if not os.path.isdir(path):
+            continue
+        for file in os.scandir(path):
+            if file.is_file() and file.name.endswith(".json"):
+                name = file.name.removesuffix(".json")
+                if provider:
+                    framework = load_compliance_framework_universal(file.path)
+                    if framework is None or not framework.supports_provider(provider):
+                        continue
+                if name not in available_compliance_frameworks:
+                    available_compliance_frameworks.append(name)
     return available_compliance_frameworks
 
 
@@ -228,18 +292,26 @@ def load_and_validate_config_file(provider: str, config_file_path: str) -> dict:
         with open(config_file_path, "r", encoding=encoding_format_utf_8) as f:
             config_file = yaml.safe_load(f)
 
-            # Not to introduce a breaking change, allow the old format config file without any provider keys
-            # and a new format with a key for each provider to include their configuration values within.
-            if any(
-                key in config_file
-                for key in ["aws", "gcp", "azure", "kubernetes", "m365"]
+            # Namespaced format: each provider has its own top-level key.
+            # Works for every built-in and every external plugin without a hardcoded list.
+            # Flat legacy format is AWS-only (historical, pre-multicloud). We identify it
+            # by the absence of nested-dict top-level values (namespaced files always
+            # have dict values; the legacy AWS format only has primitives/lists).
+            if (
+                isinstance(config_file, dict)
+                and provider in config_file
+                and isinstance(config_file[provider], dict)
             ):
-                config = config_file.get(provider, {})
+                config = config_file.get(provider, {}) or {}
+            elif (
+                isinstance(config_file, dict)
+                and config_file
+                and provider == "aws"
+                and not any(isinstance(v, dict) for v in config_file.values())
+            ):
+                config = config_file
             else:
-                config = config_file if config_file else {}
-                # Not to break Azure, K8s and GCP does not support or use the old config format
-                if provider in ["azure", "gcp", "kubernetes", "m365"]:
-                    config = {}
+                config = {}
 
             return config
 
diff --git a/prowler/lib/banner.py b/prowler/lib/banner.py
index 72031805e2..8115983bc6 100644
--- a/prowler/lib/banner.py
+++ b/prowler/lib/banner.py
@@ -3,12 +3,13 @@ from colorama import Fore, Style
 from prowler.config.config import banner_color, orange_color, prowler_version, timestamp
 
 
-def print_banner(legend: bool = False):
+def print_banner(legend: bool = False, provider: str = None):
     """
     Prints the banner with optional legend for color codes.
 
     Parameters:
     - legend (bool): Flag to indicate whether to print the color legend or not. Default is False.
+    - provider (str): The provider being scanned, used to tailor the Prowler Cloud banner.
 
     Returns:
     - None
@@ -20,20 +21,50 @@ def print_banner(legend: bool = False):
 | .__/|_|  \___/ \_/\_/ |_|\___|_|v{prowler_version}
 |_|{Fore.BLUE} Get the most at https://cloud.prowler.com {Style.RESET_ALL}
 
-{Fore.GREEN}New! Send findings from Prowler CLI to Prowler Cloud{Style.RESET_ALL}
-{Fore.GREEN}More details here: goto.prowler.com/import-findings{Style.RESET_ALL}
-
 {Fore.YELLOW}Date: {timestamp.strftime("%Y-%m-%d %H:%M:%S")}{Style.RESET_ALL}
 """
     print(banner)
 
+    print_prowler_cloud_banner(provider)
+
     if legend:
-        print(
-            f"""
+        print(f"""
 {Style.BRIGHT}Color code for results:{Style.RESET_ALL}
 - {Fore.YELLOW}MANUAL (Manual check){Style.RESET_ALL}
 - {Fore.GREEN}PASS (Recommended value){Style.RESET_ALL}
 - {orange_color}MUTED (Muted by muted list){Style.RESET_ALL}
 - {Fore.RED}FAIL (Fix required){Style.RESET_ALL}
-            """
-        )
+            """)
+
+
+def print_prowler_cloud_banner(provider: str = None):
+    """
+    Prints a promotional banner highlighting what Prowler Cloud adds on top of
+    the open-source CLI.
+
+    Shown at the start and end of a scan to let users know about the managed
+    platform capabilities they are missing (attack paths, AI, organizations,
+    continuous scanning, integrations and live compliance dashboards).
+
+    Parameters:
+    - provider (str): The provider that was scanned, used to tailor the message.
+
+    Returns:
+    - None
+    """
+    check = f"{Fore.GREEN}✓{Style.RESET_ALL}"
+    bar = f"{banner_color}│{Style.RESET_ALL}"
+    print(f"""
+{bar} {Style.BRIGHT}You're getting a snapshot 📸. Prowler Cloud gives you the full picture:{Style.RESET_ALL}
+{bar}
+{bar} {check} {Style.BRIGHT}Continuous Security Monitoring{Style.RESET_ALL} - scheduled scans with history, trends and alerts.
+{bar} {check} {Style.BRIGHT}Lighthouse AI + MCP{Style.RESET_ALL} - autonomous triage, custom dashboards, prioritization with prevention and remediation.
+{bar} {check} {Style.BRIGHT}Alerts{Style.RESET_ALL} - get notified when anything you want is happening.
+{bar} {check} {Style.BRIGHT}Live Compliance{Style.RESET_ALL} - dashboards for 50+ frameworks, always up to date.
+{bar} {check} {Style.BRIGHT}Remediation{Style.RESET_ALL} - complete guided remediation including Autonomous remediation with Lighthouse AI.
+{bar} {check} {Style.BRIGHT}Attack Path Visualization{Style.RESET_ALL} - see how attackers chain risks to reach your crown jewels.
+{bar} {check} {Style.BRIGHT}Bulk Provisioning{Style.RESET_ALL} - add your entire AWS Organization in seconds.
+{bar} {check} {Style.BRIGHT}Integrations{Style.RESET_ALL} - Anything with our MCP + Jira, Slack, AWS Security Hub, Amazon S3, SSO and RBAC.
+{bar}
+{bar} {Fore.BLUE}Start free at 👉 cloud.prowler.com{Style.RESET_ALL}
+""")
diff --git a/prowler/lib/check/check.py b/prowler/lib/check/check.py
index 53b832290f..300520f589 100644
--- a/prowler/lib/check/check.py
+++ b/prowler/lib/check/check.py
@@ -1,4 +1,6 @@
 import importlib
+import importlib.metadata
+import importlib.util
 import json
 import os
 import re
@@ -19,6 +21,7 @@ from prowler.lib.check.utils import recover_checks_from_provider
 from prowler.lib.logger import logger
 from prowler.lib.outputs.outputs import report
 from prowler.lib.utils.utils import open_file, parse_json_file, print_boxes
+from prowler.providers.common.builtin import is_builtin_provider
 from prowler.providers.common.models import Audit_Metadata
 
 
@@ -385,6 +388,45 @@ def import_check(check_path: str) -> ModuleType:
     return lib
 
 
+def _resolve_check_module(
+    provider_type: str, service: str, check_name: str
+) -> ModuleType:
+    """Resolve and import a check module.
+
+    Built-in wins on CheckID collision. Plug-ins are first-class extenders
+    (they can add new checks under new CheckIDs) but cannot override
+    existing built-ins — a security tool prefers fail-loud predictability
+    over silent overrides. CheckMetadata.get_bulk() applies the same
+    precedence on the metadata side (first-write-wins) and emits a warning
+    when a plug-in tries to override, so the user knows their plug-in
+    duplicate is being ignored and can rename it.
+
+    Gates the built-in branch on `is_builtin_provider(provider_type)` —
+    calling `find_spec` on `prowler.providers.{provider_type}.services...`
+    directly would propagate `ModuleNotFoundError` for external providers
+    (their parent package `prowler.providers.{provider_type}` does not
+    exist) instead of returning None. The leaf helper encapsulates the
+    safe lookup, so external providers go straight to entry points. For
+    built-ins we still use `find_spec` to distinguish "check doesn't
+    exist" from "check exists but failed to import" (broken transitive
+    dep, etc.).
+    """
+    # Built-in first — built-in wins on CheckID collision
+    if is_builtin_provider(provider_type):
+        builtin_path = f"prowler.providers.{provider_type}.services.{service}.{check_name}.{check_name}"
+        if importlib.util.find_spec(builtin_path) is not None:
+            return import_check(builtin_path)
+
+    # Entry point lookup — only consulted when the built-in truly doesn't exist
+    for ep in importlib.metadata.entry_points(group=f"prowler.checks.{provider_type}"):
+        if ep.name == check_name:
+            return importlib.import_module(ep.value)
+
+    raise ModuleNotFoundError(
+        f"Check '{check_name}' not found for provider '{provider_type}'"
+    )
+
+
 def run_fixer(check_findings: list) -> int:
     """
     Run the fixer for the check if it exists and there are any FAIL findings
@@ -525,9 +567,10 @@ def execute_checks(
             service = check_name.split("_")[0]
             try:
                 try:
-                    # Import check module
-                    check_module_path = f"prowler.providers.{global_provider.type}.services.{service}.{check_name}.{check_name}"
-                    lib = import_check(check_module_path)
+                    # Import check module (built-in or entry point)
+                    lib = _resolve_check_module(
+                        global_provider.type, service, check_name
+                    )
                     # Recover functions from check
                     check_to_execute = getattr(lib, check_name)
                     check = check_to_execute()
@@ -605,9 +648,10 @@ def execute_checks(
                 )
                 try:
                     try:
-                        # Import check module
-                        check_module_path = f"prowler.providers.{global_provider.type}.services.{service}.{check_name}.{check_name}"
-                        lib = import_check(check_module_path)
+                        # Import check module (built-in or entry point)
+                        lib = _resolve_check_module(
+                            global_provider.type, service, check_name
+                        )
                         # Recover functions from check
                         check_to_execute = getattr(lib, check_name)
                         check = check_to_execute()
@@ -753,6 +797,10 @@ def execute(
                 is_finding_muted_args["org_domain"] = (
                     global_provider.identity.org_domain
                 )
+            elif not is_builtin_provider(global_provider.type):
+                # External/custom provider — delegate identity args
+                is_finding_muted_args = global_provider.get_mutelist_finding_args()
+
             for finding in check_findings:
                 if global_provider.type == "cloudflare":
                     is_finding_muted_args["account_id"] = finding.account_id
diff --git a/prowler/lib/check/checks_loader.py b/prowler/lib/check/checks_loader.py
index 9ef672df6b..77840084ff 100644
--- a/prowler/lib/check/checks_loader.py
+++ b/prowler/lib/check/checks_loader.py
@@ -2,10 +2,10 @@ import sys
 
 from colorama import Fore, Style
 
-from prowler.config.config import EXTERNAL_TOOL_PROVIDERS
 from prowler.lib.check.check import parse_checks_from_file
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.check.models import CheckMetadata, Severity
+from prowler.lib.check.tool_wrapper import is_tool_wrapper_provider
 from prowler.lib.logger import logger
 
 
@@ -26,8 +26,13 @@ def load_checks_to_execute(
 ) -> set:
     """Generate the list of checks to execute based on the cloud provider and the input arguments given"""
     try:
-        # Bypass check loading for providers that use external tools directly
-        if provider in EXTERNAL_TOOL_PROVIDERS:
+        # Bypass check loading for tool-wrapper providers — they delegate
+        # scanning to an external tool and have no checks to recover.
+        # Single source of truth across __main__, the CheckMetadata validators,
+        # check discovery and this loader, covering both built-in tool wrappers
+        # (iac/llm/image) and external plug-ins that declare
+        # `is_external_tool_provider = True` via the contract.
+        if is_tool_wrapper_provider(provider):
             return set()
 
         # Local subsets
diff --git a/prowler/lib/check/compliance_models.py b/prowler/lib/check/compliance_models.py
index 82ac54e4d9..f883bf60b1 100644
--- a/prowler/lib/check/compliance_models.py
+++ b/prowler/lib/check/compliance_models.py
@@ -1,3 +1,4 @@
+import importlib.metadata
 import json
 import os
 import sys
@@ -282,6 +283,26 @@ class CSA_CCM_Requirement_Attribute(BaseModel):
     ScopeApplicability: list[dict]
 
 
+class STIG_Requirement_Attribute_Severity(str, Enum):
+    """DISA STIG Requirement Attribute Severity (maps to CAT I/II/III)"""
+
+    high = "high"
+    medium = "medium"
+    low = "low"
+
+
+class STIG_Requirement_Attribute(BaseModel):
+    """DISA STIG Requirement Attribute"""
+
+    Section: str
+    Severity: STIG_Requirement_Attribute_Severity
+    RuleID: str
+    StigID: str
+    CCI: Optional[list[str]] = None
+    CheckText: Optional[str] = None
+    FixText: Optional[str] = None
+
+
 # Base Compliance Model
 # TODO: move this to compliance folder
 class Compliance_Requirement(BaseModel):
@@ -302,6 +323,7 @@ class Compliance_Requirement(BaseModel):
             CCC_Requirement_Attribute,
             C5Germany_Requirement_Attribute,
             CSA_CCM_Requirement_Attribute,
+            STIG_Requirement_Attribute,
             # Generic_Compliance_Requirement_Attribute must be the last one since it is the fallback for generic compliance framework
             Generic_Compliance_Requirement_Attribute,
         ]
@@ -434,26 +456,63 @@ class Compliance(BaseModel):
         """Bulk load all compliance frameworks specification into a dict"""
         try:
             bulk_compliance_frameworks = {}
+            # Built-in compliance from prowler/compliance/{provider}/
             available_compliance_framework_modules = list_compliance_modules()
             for compliance_framework in available_compliance_framework_modules:
-                if provider in compliance_framework.name:
+                # Match the provider segment exactly, not as a substring, so
+                # e.g. `cloud` does not capture `cloudflare`.
+                if compliance_framework.name.split(".")[-1] == provider:
                     compliance_specification_dir_path = (
                         f"{compliance_framework.module_finder.path}/{provider}"
                     )
-                    # for compliance_framework in available_compliance_framework_modules:
                     for filename in os.listdir(compliance_specification_dir_path):
                         file_path = os.path.join(
                             compliance_specification_dir_path, filename
                         )
-                        # Check if it is a file and ti size is greater than 0
                         if os.path.isfile(file_path) and os.stat(file_path).st_size > 0:
-                            # Open Compliance file in JSON
-                            # cis_v1.4_aws.json --> cis_v1.4_aws
                             compliance_framework_name = filename.split(".json")[0]
-                            # Store the compliance info
                             bulk_compliance_frameworks[compliance_framework_name] = (
                                 load_compliance_framework(file_path)
                             )
+
+            # External compliance via entry points
+            for ep in importlib.metadata.entry_points(group="prowler.compliance"):
+                if ep.name == provider:
+                    try:
+                        module = ep.load()
+                        compliance_dir = (
+                            module.__path__[0]
+                            if hasattr(module, "__path__")
+                            else os.path.dirname(module.__file__)
+                        )
+                        for filename in os.listdir(compliance_dir):
+                            if filename.endswith(".json"):
+                                file_path = os.path.join(compliance_dir, filename)
+                                if (
+                                    os.path.isfile(file_path)
+                                    and os.stat(file_path).st_size > 0
+                                ):
+                                    compliance_framework_name = filename.split(".json")[
+                                        0
+                                    ]
+                                    if (
+                                        compliance_framework_name
+                                        not in bulk_compliance_frameworks
+                                    ):
+                                        # External JSON: tolerate non-legacy
+                                        # schemas (skip + warn) instead of aborting.
+                                        framework = load_compliance_framework(
+                                            file_path, fatal=False
+                                        )
+                                        if framework is not None:
+                                            bulk_compliance_frameworks[
+                                                compliance_framework_name
+                                            ] = framework
+                    except Exception as error:
+                        logger.warning(
+                            f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                        )
+
         except Exception as e:
             logger.error(f"{e.__class__.__name__}[{e.__traceback__.tb_lineno}] -- {e}")
 
@@ -462,18 +521,26 @@ class Compliance(BaseModel):
 
 # Testing Pending
 def load_compliance_framework(
-    compliance_specification_file: str,
-) -> Compliance:
-    """load_compliance_framework loads and parse a Compliance Framework Specification"""
+    compliance_specification_file: str, fatal: bool = True
+) -> Optional[Compliance]:
+    """load_compliance_framework loads and parse a Compliance Framework Specification.
+
+    With ``fatal=True`` (built-in JSONs) an invalid file aborts the run; with
+    ``fatal=False`` (external JSONs) it is skipped with a warning and ``None``
+    is returned.
+    """
     try:
-        compliance_framework = Compliance.parse_file(compliance_specification_file)
+        return Compliance.parse_file(compliance_specification_file)
     except ValidationError as error:
-        logger.critical(
-            f"Compliance Framework Specification from {compliance_specification_file} is not valid: {error}"
+        if fatal:
+            logger.critical(
+                f"Compliance Framework Specification from {compliance_specification_file} is not valid: {error}"
+            )
+            sys.exit(1)
+        logger.warning(
+            f"Skipping invalid compliance framework {compliance_specification_file}: {error}"
         )
-        sys.exit(1)
-    else:
-        return compliance_framework
+        return None
 
 
 # ─── Universal Compliance Schema Models (Phase 1-3) ─────────────────────────
@@ -950,6 +1017,25 @@ def get_bulk_compliance_frameworks_universal(provider: str) -> dict:
         if compliance_root and os.path.isdir(compliance_root):
             _load_jsons_from_dir(compliance_root, provider, bulk)
 
+        # External multi-provider frameworks via the dedicated universal entry
+        # point group, kept separate from the per-provider `prowler.compliance`
+        # group so the legacy loader never parses a universal JSON. Built-ins
+        # (already in bulk) win on a name collision.
+        for ep in importlib.metadata.entry_points(group="prowler.compliance.universal"):
+            try:
+                module = ep.load()
+                ep_dir = (
+                    module.__path__[0]
+                    if hasattr(module, "__path__")
+                    else os.path.dirname(module.__file__)
+                )
+                if os.path.isdir(ep_dir):
+                    _load_jsons_from_dir(ep_dir, provider, bulk)
+            except Exception as error:
+                logger.warning(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
     except Exception as e:
         logger.error(f"{e.__class__.__name__}[{e.__traceback__.tb_lineno}] -- {e}")
     return bulk
diff --git a/prowler/lib/check/models.py b/prowler/lib/check/models.py
index d97be78cbe..f9155c68f7 100644
--- a/prowler/lib/check/models.py
+++ b/prowler/lib/check/models.py
@@ -11,10 +11,10 @@ from typing import Any, Dict, Optional, Set
 from pydantic.v1 import BaseModel, Field, ValidationError, validator
 from pydantic.v1.error_wrappers import ErrorWrapper
 
-from prowler.config.config import EXTERNAL_TOOL_PROVIDERS, Provider
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.check.utils import recover_checks_from_provider
 from prowler.lib.logger import logger
+from prowler.providers.common.provider import Provider as ProviderABC
 
 # Valid ResourceGroup values as defined in the RFC
 VALID_RESOURCE_GROUPS = frozenset(
@@ -259,7 +259,7 @@ class CheckMetadata(BaseModel):
             )
         if (
             value_lower not in VALID_CATEGORIES
-            and values.get("Provider") not in EXTERNAL_TOOL_PROVIDERS
+            and not ProviderABC.is_tool_wrapper_provider(values.get("Provider"))
         ):
             raise ValueError(
                 f"Invalid category: '{value_lower}'. Must be one of: {', '.join(sorted(VALID_CATEGORIES))}."
@@ -288,7 +288,9 @@ class CheckMetadata(BaseModel):
             raise ValueError("ServiceName must be a non-empty string")
 
         check_id = values.get("CheckID")
-        if check_id and values.get("Provider") not in EXTERNAL_TOOL_PROVIDERS:
+        if check_id and not ProviderABC.is_tool_wrapper_provider(
+            values.get("Provider")
+        ):
             service_from_check_id = check_id.split("_")[0]
             if service_name != service_from_check_id:
                 raise ValueError(
@@ -304,7 +306,9 @@ class CheckMetadata(BaseModel):
         if not check_id:
             raise ValueError("CheckID must be a non-empty string")
 
-        if check_id and values.get("Provider") not in EXTERNAL_TOOL_PROVIDERS:
+        if check_id and not ProviderABC.is_tool_wrapper_provider(
+            values.get("Provider")
+        ):
             if "-" in check_id:
                 raise ValueError(
                     f"CheckID {check_id} contains a hyphen, which is not allowed"
@@ -313,8 +317,9 @@ class CheckMetadata(BaseModel):
         return check_id
 
     @validator("CheckTitle", pre=True, always=True)
+    @classmethod
     def validate_check_title(cls, check_title, values):  # noqa: F841
-        if values.get("Provider") not in EXTERNAL_TOOL_PROVIDERS:
+        if not ProviderABC.is_tool_wrapper_provider(values.get("Provider")):
             if len(check_title) > 150:
                 raise ValueError(
                     f"CheckTitle must not exceed 150 characters, got {len(check_title)} characters"
@@ -326,14 +331,18 @@ class CheckMetadata(BaseModel):
         return check_title
 
     @validator("RelatedUrl", pre=True, always=True)
+    @classmethod
     def validate_related_url(cls, related_url, values):  # noqa: F841
-        if related_url and values.get("Provider") not in EXTERNAL_TOOL_PROVIDERS:
+        if related_url and not ProviderABC.is_tool_wrapper_provider(
+            values.get("Provider")
+        ):
             raise ValueError("RelatedUrl must be empty. This field is deprecated.")
         return related_url
 
     @validator("Remediation")
+    @classmethod
     def validate_recommendation_url(cls, remediation, values):  # noqa: F841
-        if values.get("Provider") not in EXTERNAL_TOOL_PROVIDERS:
+        if not ProviderABC.is_tool_wrapper_provider(values.get("Provider")):
             url = remediation.Recommendation.Url
             if url and not url.startswith("https://hub.prowler.com/"):
                 raise ValueError(
@@ -346,7 +355,7 @@ class CheckMetadata(BaseModel):
         provider = values.get("Provider", "").lower()
 
         # Non-AWS providers must have an empty CheckType list
-        if provider != "aws" and provider not in EXTERNAL_TOOL_PROVIDERS:
+        if provider != "aws" and not ProviderABC.is_tool_wrapper_provider(provider):
             if check_type:
                 raise ValueError(
                     f"CheckType must be empty for non-AWS providers. Got {check_type} for provider '{provider}'."
@@ -371,8 +380,9 @@ class CheckMetadata(BaseModel):
         return check_type
 
     @validator("Description", pre=True, always=True)
+    @classmethod
     def validate_description(cls, description, values):  # noqa: F841
-        if values.get("Provider") not in EXTERNAL_TOOL_PROVIDERS:
+        if not ProviderABC.is_tool_wrapper_provider(values.get("Provider")):
             if len(description) > 400:
                 raise ValueError(
                     f"Description must not exceed 400 characters, got {len(description)} characters"
@@ -380,8 +390,9 @@ class CheckMetadata(BaseModel):
         return description
 
     @validator("Risk", pre=True, always=True)
+    @classmethod
     def validate_risk(cls, risk, values):  # noqa: F841
-        if values.get("Provider") not in EXTERNAL_TOOL_PROVIDERS:
+        if not ProviderABC.is_tool_wrapper_provider(values.get("Provider")):
             if len(risk) > 400:
                 raise ValueError(
                     f"Risk must not exceed 400 characters, got {len(risk)} characters"
@@ -433,6 +444,20 @@ class CheckMetadata(BaseModel):
             metadata_file = f"{check_path}/{check_name}.metadata.json"
             # Load metadata
             check_metadata = load_check_metadata(metadata_file)
+            # Built-in wins on CheckID collision. Plug-in entry points are
+            # appended after built-ins by `recover_checks_from_provider`, so
+            # a duplicate CheckID here means an entry-point check is trying
+            # to override a built-in. Ignore the override (the built-in
+            # metadata stays) and surface it via a warning — matching the
+            # precedence enforced by `_resolve_check_module`.
+            if check_metadata.CheckID in bulk_check_metadata:
+                logger.warning(
+                    f"Plug-in check metadata '{check_metadata.CheckID}' "
+                    f"(loaded from '{metadata_file}') is being IGNORED — "
+                    f"a built-in with the same CheckID exists. To use your "
+                    f"plug-in, register it under a different CheckID."
+                )
+                continue
             bulk_check_metadata[check_metadata.CheckID] = check_metadata
 
         return bulk_check_metadata
@@ -470,7 +495,7 @@ class CheckMetadata(BaseModel):
         # If the bulk checks metadata is not provided, get it
         if not bulk_checks_metadata:
             bulk_checks_metadata = {}
-            available_providers = [p.value for p in Provider]
+            available_providers = ProviderABC.get_available_providers()
             for provider_name in available_providers:
                 bulk_checks_metadata.update(CheckMetadata.get_bulk(provider_name))
         if provider:
@@ -495,7 +520,7 @@ class CheckMetadata(BaseModel):
             # Loaded here, as it is not always needed
             if not bulk_compliance_frameworks:
                 bulk_compliance_frameworks = {}
-                available_providers = [p.value for p in Provider]
+                available_providers = ProviderABC.get_available_providers()
                 for provider in available_providers:
                     bulk_compliance_frameworks = Compliance.get_bulk(provider=provider)
             checks_from_compliance_framework = (
diff --git a/prowler/lib/check/tool_wrapper.py b/prowler/lib/check/tool_wrapper.py
new file mode 100644
index 0000000000..a1d606594e
--- /dev/null
+++ b/prowler/lib/check/tool_wrapper.py
@@ -0,0 +1,62 @@
+"""Standalone helper for tool-wrapper provider detection.
+
+A provider is a "tool wrapper" if it delegates scanning to an external tool
+(Trivy, promptfoo, etc.) instead of running checks/services through the
+standard Prowler engine. This module is the single source of truth for that
+classification across the codebase.
+
+Kept as a leaf module with no Prowler imports beyond the leaf
+`external_tool_providers` so it can be referenced from `prowler.lib.check.*`
+and `prowler.providers.common.provider` without forming an import cycle.
+"""
+
+import importlib.metadata
+
+from prowler.lib.check.external_tool_providers import EXTERNAL_TOOL_PROVIDERS
+from prowler.providers.common.builtin import is_builtin_provider
+
+# Module-level cache for entry-point classes consulted by this helper.
+# Independent of `Provider._ep_providers` to keep this module leaf — the cost
+# of a duplicate cache entry is negligible (one class object per external
+# provider, loaded lazily on first lookup).
+_ep_class_cache: dict = {}
+
+
+def _load_ep_class(provider: str):
+    """Return the entry-point provider class for `provider`, or None.
+
+    Caches the result in `_ep_class_cache`. Errors during entry-point loading
+    are swallowed (returning None) so a broken plug-in never crashes the
+    is-tool-wrapper check; it just falls through to "not a tool wrapper".
+    """
+    if provider in _ep_class_cache:
+        return _ep_class_cache[provider]
+    for ep in importlib.metadata.entry_points(group="prowler.providers"):
+        if ep.name == provider:
+            try:
+                cls = ep.load()
+            except Exception:
+                cls = None
+            _ep_class_cache[provider] = cls
+            return cls
+    _ep_class_cache[provider] = None
+    return None
+
+
+def is_tool_wrapper_provider(provider: str) -> bool:
+    """Return True if the provider delegates scanning to an external tool.
+
+    Combines the built-in `EXTERNAL_TOOL_PROVIDERS` frozenset (fast path for
+    iac/llm/image) with the `is_external_tool_provider` class attribute of
+    external plug-ins registered via entry points. This is the single source
+    of truth consulted by `__main__`, the `CheckMetadata` validators, the
+    check-loading utilities, and the checks loader.
+    """
+    if provider in EXTERNAL_TOOL_PROVIDERS:
+        return True
+    # Built-in wins: short-circuit before ep.load() so a same-name plug-in
+    # cannot flip a built-in onto the tool-wrapper path or run its code.
+    if is_builtin_provider(provider):
+        return False
+    cls = _load_ep_class(provider)
+    return bool(cls and getattr(cls, "is_external_tool_provider", False))
diff --git a/prowler/lib/check/utils.py b/prowler/lib/check/utils.py
index 0e4807078f..9c9a9c0523 100644
--- a/prowler/lib/check/utils.py
+++ b/prowler/lib/check/utils.py
@@ -1,9 +1,43 @@
 import importlib
+import importlib.metadata
+import importlib.util
+import os
 import sys
 from pkgutil import walk_packages
 
-from prowler.lib.check.external_tool_providers import EXTERNAL_TOOL_PROVIDERS
+from prowler.lib.check.tool_wrapper import is_tool_wrapper_provider
 from prowler.lib.logger import logger
+from prowler.providers.common.builtin import is_builtin_provider
+
+
+def _recover_ep_checks(provider: str, service: str = None) -> list[tuple]:
+    """Discover external checks registered via entry points for a provider.
+
+    External plugins follow the same layout as built-ins:
+    `{plugin_root}.services.{service}.{check}.{check}`
+
+    When `service` is provided, only entry points whose dotted path contains
+    `.services.{service}.` are included — mirroring how built-in discovery
+    filters by the `prowler.providers.{provider}.services.{service}` package.
+
+    Uses find_spec to locate the check module without importing it,
+    avoiding service client initialization at discovery time.
+    """
+    checks = []
+    for ep in importlib.metadata.entry_points(group=f"prowler.checks.{provider}"):
+        try:
+            if service and f".services.{service}." not in ep.value:
+                continue
+
+            spec = importlib.util.find_spec(ep.value)
+            if spec and spec.origin:
+                check_path = os.path.dirname(spec.origin)
+                checks.append((ep.name, check_path))
+        except Exception as error:
+            logger.warning(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+    return checks
 
 
 def recover_checks_from_provider(
@@ -15,29 +49,55 @@ def recover_checks_from_provider(
     Returns a list of tuples with the following format (check_name, check_path)
     """
     try:
-        # Bypass check loading for providers that use external tools directly
-        if provider in EXTERNAL_TOOL_PROVIDERS:
+        # Bypass check loading for tool-wrapper providers — they delegate
+        # scanning to an external tool and have no checks to recover.
+        # Single source of truth: combines the EXTERNAL_TOOL_PROVIDERS
+        # frozenset (built-ins) with the per-provider `is_external_tool_provider`
+        # class attribute (so external plug-ins opt in via the contract).
+        if is_tool_wrapper_provider(provider):
             return []
 
         checks = []
-        modules = list_modules(provider, service)
-        for module_name in modules:
-            # Format: "prowler.providers.{provider}.services.{service}.{check_name}.{check_name}"
-            check_module_name = module_name.name
-            # We need to exclude common shared libraries in services
-            if (
-                check_module_name.count(".") == 6
-                and ".lib." not in check_module_name
-                and (not check_module_name.endswith("_fixer") or include_fixers)
-            ):
-                check_path = module_name.module_finder.path
-                # Check name is the last part of the check_module_name
-                check_name = check_module_name.split(".")[-1]
-                check_info = (check_name, check_path)
-                checks.append(check_info)
-    except ModuleNotFoundError:
-        logger.critical(f"Service {service} was not found for the {provider} provider.")
-        sys.exit(1)
+        # Built-in checks from prowler.providers.{provider}.services. Gate
+        # the built-in branch on `is_builtin_provider(provider)` — calling
+        # `find_spec` directly on `prowler.providers.{provider}.services`
+        # would propagate `ModuleNotFoundError` when the parent package
+        # `prowler.providers.{provider}` does not exist (i.e. the provider
+        # is external), instead of returning None. The leaf helper
+        # encapsulates the safe lookup, so we only run the built-in
+        # discovery when the provider actually ships with the SDK; for
+        # external providers we go straight to entry points.
+        if is_builtin_provider(provider):
+            modules = list_modules(provider, service)
+            for module_name in modules:
+                # Format: "prowler.providers.{provider}.services.{service}.{check_name}.{check_name}"
+                check_module_name = module_name.name
+                # We need to exclude common shared libraries in services
+                if (
+                    check_module_name.count(".") == 6
+                    and ".lib." not in check_module_name
+                    and (not check_module_name.endswith("_fixer") or include_fixers)
+                ):
+                    check_path = module_name.module_finder.path
+                    check_name = check_module_name.split(".")[-1]
+                    check_info = (check_name, check_path)
+                    checks.append(check_info)
+
+        # External checks registered via entry points — always consulted, with
+        # optional service filter. Previously gated by `if not service:`, which
+        # prevented external providers from being usable with --service.
+        checks.extend(_recover_ep_checks(provider, service))
+
+        # A service was requested but nothing matched in either built-ins or
+        # entry points — surface this as a clear error instead of silently
+        # returning an empty list.
+        if service and not checks:
+            logger.critical(
+                f"Service '{service}' was not found for the '{provider}' provider "
+                f"(neither as a built-in nor via external entry points)."
+            )
+            sys.exit(1)
+
     except Exception as e:
         logger.critical(f"{e.__class__.__name__}[{e.__traceback__.tb_lineno}]: {e}")
         sys.exit(1)
@@ -64,8 +124,9 @@ def recover_checks_from_service(service_list: list, provider: str) -> set:
     Returns a set of checks from the given services
     """
     try:
-        # Bypass check loading for providers that use external tools directly
-        if provider in EXTERNAL_TOOL_PROVIDERS:
+        # Bypass check loading for tool-wrapper providers — symmetric with
+        # `recover_checks_from_provider` above, using the same source of truth.
+        if is_tool_wrapper_provider(provider):
             return set()
 
         checks = set()
diff --git a/prowler/lib/cli/parser.py b/prowler/lib/cli/parser.py
index 449c15a22c..2848e9c788 100644
--- a/prowler/lib/cli/parser.py
+++ b/prowler/lib/cli/parser.py
@@ -15,24 +15,68 @@ from prowler.lib.check.models import Severity
 from prowler.lib.cli.redact import warn_sensitive_argument_values
 from prowler.lib.outputs.common import Status
 from prowler.providers.common.arguments import (
+    PROVIDER_ALIASES,
+    enforce_invoked_provider_loaded,
     init_providers_parser,
     validate_asff_usage,
     validate_provider_arguments,
     validate_sarif_usage,
 )
+from prowler.providers.common.provider import Provider
 
 
 class ProwlerArgumentParser:
     # Set the default parser
     def __init__(self):
+        # Discover any providers not in the hardcoded list below
+        # TODO - First step to support current providers and the new external provider implementation
+        known_providers = {
+            "aws",
+            "azure",
+            "gcp",
+            "kubernetes",
+            "m365",
+            "github",
+            "googleworkspace",
+            "cloudflare",
+            "oraclecloud",
+            "openstack",
+            "alibabacloud",
+            "iac",
+            "llm",
+            "image",
+            "nhn",
+            "mongodbatlas",
+            "vercel",
+            "okta",
+            "scaleway",
+            "stackit",
+        }
+        all_providers = set(Provider.get_available_providers())
+        new_providers = sorted(all_providers - known_providers)
+
+        # Build extra strings for dynamically discovered providers
+        extra_providers_csv = ""
+        extra_providers_text = ""
+        if new_providers:
+            providers_help = Provider.get_providers_help_text()
+            extra_providers_csv = "," + ",".join(new_providers)
+            extra_lines = []
+            for name in new_providers:
+                help_text = providers_help.get(name, "")
+                if help_text:
+                    extra_lines.append(f"    {name:<20}{help_text}")
+            if extra_lines:
+                extra_providers_text = "\n" + "\n".join(extra_lines)
+
         # CLI Arguments
         self.parser = argparse.ArgumentParser(
             prog="prowler",
             formatter_class=RawTextHelpFormatter,
-            usage="prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,dashboard,iac,image,llm} ...",
-            epilog="""
+            usage=f"prowler [-h] [--version] {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,dashboard,iac,image,llm{extra_providers_csv}}} ...",
+            epilog=f"""
 Available Cloud Providers:
-  {aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,iac,llm,image,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel}
+  {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,iac,llm,image,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel{extra_providers_csv}}}
     aws                 AWS Provider
     azure               Azure Provider
     gcp                 GCP Provider
@@ -52,13 +96,14 @@ Available Cloud Providers:
     nhn                 NHN Provider (Unofficial)
     mongodbatlas        MongoDB Atlas Provider
     scaleway            Scaleway Provider
-    vercel              Vercel Provider
+    vercel              Vercel Provider{extra_providers_text}
+
 
 Available components:
     dashboard           Local dashboard
 
 To see the different available options on a specific component, run:
-    prowler {provider|dashboard} -h|--help
+    prowler {{provider|dashboard}} -h|--help
 
 Detailed documentation at https://docs.prowler.com
 """,
@@ -117,17 +162,19 @@ Detailed documentation at https://docs.prowler.com
             and (sys.argv[1] not in ("-v", "--version"))
         ):
             # Since the provider is always the second argument, we are checking if
-            # a flag, starting by "-", is supplied
-            if "-" in sys.argv[1]:
+            # a flag is supplied. Use startswith("-") instead of "in" to avoid
+            # matching external provider names that contain hyphens
+            # (e.g. "local-acme-snowflake").
+            if sys.argv[1].startswith("-"):
                 sys.argv = self.__set_default_provider__(sys.argv)
 
-            # Provider aliases mapping
-            # Microsoft 365
-            elif sys.argv[1] == "microsoft365":
-                sys.argv[1] = "m365"
-            # Oracle Cloud Infrastructure
-            elif sys.argv[1] == "oci":
-                sys.argv[1] = "oraclecloud"
+            # Provider aliases mapping (single source: arguments.PROVIDER_ALIASES)
+            elif sys.argv[1] in PROVIDER_ALIASES:
+                sys.argv[1] = PROVIDER_ALIASES[sys.argv[1]]
+
+        # Selective fail-loud here (post argv-normalisation, pre parse_args)
+        # so the invoked-provider check stays correct under parse(args=...).
+        enforce_invoked_provider_loaded(self)
 
         # Warn about sensitive flags passed with explicit values
         # Snapshot argv before parse_args() which may exit on errors
diff --git a/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py b/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py
index 75481fb6aa..df23aeb1d1 100644
--- a/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py
+++ b/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py
@@ -22,11 +22,14 @@ def get_asd_essential_eight_table(
     pass_count = []
     fail_count = []
     muted_count = []
+    section_seen = {}
+    provider = ""
     for index, finding in enumerate(findings):
         check = bulk_checks_metadata[finding.check_metadata.CheckID]
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "ASD-Essential-Eight":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
@@ -36,21 +39,33 @@ def get_asd_essential_eight_table(
                                 "PASS": 0,
                                 "Muted": 0,
                             }
+                            section_seen[section] = set()
+
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["PASS"] += 1
 
     sections = dict(sorted(sections.items()))
     for section in sections:
-        asd_essential_eight_compliance_table["Provider"].append(compliance.Provider)
+        asd_essential_eight_compliance_table["Provider"].append(provider)
         asd_essential_eight_compliance_table["Section"].append(section)
         if sections[section]["FAIL"] > 0:
             asd_essential_eight_compliance_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/c5/c5.py b/prowler/lib/outputs/compliance/c5/c5.py
index 32eb7e0f5a..b48260b5a2 100644
--- a/prowler/lib/outputs/compliance/c5/c5.py
+++ b/prowler/lib/outputs/compliance/c5/c5.py
@@ -22,33 +22,47 @@ def get_c5_table(
     fail_count = []
     muted_count = []
     sections = {}
+    section_seen = {}
+    provider = ""
     for index, finding in enumerate(findings):
         check = bulk_checks_metadata[finding.check_metadata.CheckID]
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "C5":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
 
                         if section not in sections:
                             sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            section_seen[section] = set()
 
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["PASS"] += 1
 
     sections = dict(sorted(sections.items()))
     for section in sections:
-        section_table["Provider"].append(compliance.Provider)
+        section_table["Provider"].append(provider)
         section_table["Section"].append(section)
         if sections[section]["FAIL"] > 0:
             section_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/ccc/ccc.py b/prowler/lib/outputs/compliance/ccc/ccc.py
index 99a6c91cd9..d8d76ad2d9 100644
--- a/prowler/lib/outputs/compliance/ccc/ccc.py
+++ b/prowler/lib/outputs/compliance/ccc/ccc.py
@@ -22,33 +22,47 @@ def get_ccc_table(
     fail_count = []
     muted_count = []
     sections = {}
+    section_seen = {}
+    provider = ""
     for index, finding in enumerate(findings):
         check = bulk_checks_metadata[finding.check_metadata.CheckID]
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "CCC":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
 
                         if section not in sections:
                             sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            section_seen[section] = set()
 
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["PASS"] += 1
 
     sections = dict(sorted(sections.items()))
     for section in sections:
-        section_table["Provider"].append(compliance.Provider)
+        section_table["Provider"].append(provider)
         section_table["Section"].append(section)
         if sections[section]["FAIL"] > 0:
             section_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/cis/cis.py b/prowler/lib/outputs/compliance/cis/cis.py
index 7f161f34c2..4acbd7fe58 100644
--- a/prowler/lib/outputs/compliance/cis/cis.py
+++ b/prowler/lib/outputs/compliance/cis/cis.py
@@ -13,6 +13,9 @@ def get_cis_table(
     compliance_overview: bool,
 ):
     sections = {}
+    section_muted_seen = {}
+    section_split_seen = {}
+    provider = ""
     cis_compliance_table = {
         "Provider": [],
         "Section": [],
@@ -29,6 +32,7 @@ def get_cis_table(
         for compliance in check_compliances:
             version_in_name = compliance_framework.split("_")[1]
             if compliance.Framework == "CIS" and version_in_name in compliance.Version:
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
@@ -40,9 +44,19 @@ def get_cis_table(
                                 "Level 2": {"FAIL": 0, "PASS": 0},
                                 "Muted": 0,
                             }
+                            section_muted_seen[section] = set()
+                            section_split_seen[section] = {
+                                "Level 1": set(),
+                                "Level 2": set(),
+                            }
                         if finding.muted:
+                            # Overview total: count each finding once per framework
                             if index not in muted_count:
                                 muted_count.append(index)
+                            # Per-section Muted: count each finding once per section
+                            # it belongs to (a finding can map to several sections).
+                            if index not in section_muted_seen[section]:
+                                section_muted_seen[section].add(index)
                                 sections[section]["Muted"] += 1
                         else:
                             if finding.status == "FAIL" and index not in fail_count:
@@ -50,13 +64,21 @@ def get_cis_table(
                             elif finding.status == "PASS" and index not in pass_count:
                                 pass_count.append(index)
                         if "Level 1" in attribute.Profile:
-                            if not finding.muted:
+                            if (
+                                not finding.muted
+                                and index not in section_split_seen[section]["Level 1"]
+                            ):
+                                section_split_seen[section]["Level 1"].add(index)
                                 if finding.status == "FAIL":
                                     sections[section]["Level 1"]["FAIL"] += 1
                                 else:
                                     sections[section]["Level 1"]["PASS"] += 1
                         elif "Level 2" in attribute.Profile:
-                            if not finding.muted:
+                            if (
+                                not finding.muted
+                                and index not in section_split_seen[section]["Level 2"]
+                            ):
+                                section_split_seen[section]["Level 2"].add(index)
                                 if finding.status == "FAIL":
                                     sections[section]["Level 2"]["FAIL"] += 1
                                 else:
@@ -65,7 +87,7 @@ def get_cis_table(
     # Add results to table
     sections = dict(sorted(sections.items()))
     for section in sections:
-        cis_compliance_table["Provider"].append(compliance.Provider)
+        cis_compliance_table["Provider"].append(provider)
         cis_compliance_table["Section"].append(section)
         if sections[section]["Level 1"]["FAIL"] > 0:
             cis_compliance_table["Level 1"].append(
diff --git a/prowler/lib/outputs/compliance/compliance.py b/prowler/lib/outputs/compliance/compliance.py
index b6b2f1f81f..4e4bd78232 100644
--- a/prowler/lib/outputs/compliance/compliance.py
+++ b/prowler/lib/outputs/compliance/compliance.py
@@ -10,7 +10,6 @@ from prowler.lib.outputs.compliance.cis.cis import get_cis_table
 from prowler.lib.outputs.compliance.compliance_check import (  # noqa: F401 - re-export for backward compatibility
     get_check_compliance,
 )
-from prowler.lib.outputs.compliance.csa.csa import get_csa_table
 from prowler.lib.outputs.compliance.ens.ens import get_ens_table
 from prowler.lib.outputs.compliance.generic.generic_table import (
     get_generic_compliance_table,
@@ -19,6 +18,9 @@ from prowler.lib.outputs.compliance.kisa_ismsp.kisa_ismsp import get_kisa_ismsp_
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack import (
     get_mitre_attack_table,
 )
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig import (
+    get_okta_idaas_stig_table,
+)
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore import (
     get_prowler_threatscore_table,
 )
@@ -33,24 +35,28 @@ def process_universal_compliance_frameworks(
     output_filename: str,
     provider: str,
     generated_outputs: dict,
+    from_cli: bool = True,
+    is_last: bool = True,
 ) -> set:
     """Process universal compliance frameworks, generating CSV and OCSF outputs.
 
     For each framework in *input_compliance_frameworks* that exists in
-    *universal_frameworks* and has an outputs.table_config, this function
-    creates both a CSV (UniversalComplianceOutput) and an OCSF JSON
-    (OCSFComplianceOutput) file.  OCSF is always generated regardless of
+    *universal_frameworks* and has an ``outputs.table_config``, this function
+    writes both a CSV (``UniversalComplianceOutput``) and an OCSF JSON
+    (``OCSFComplianceOutput``) file. OCSF is always generated regardless of
     the user's ``--output-formats`` flag.
 
-    The function is idempotent: it tracks already-created writers via
-    ``generated_outputs["compliance"]`` keyed by ``file_path``. If invoked
-    again for the same framework (e.g. once per streaming batch), it
-    reuses the existing writer instead of recreating it. This guarantees
-    one output writer per framework for the whole execution and keeps
-    the OCSF JSON array valid across multiple calls.
+    Streaming-aware: writers are tracked via ``generated_outputs["compliance"]``
+    keyed by ``file_path``. On the first call per framework a new writer is
+    created and emits both findings and manual requirements; subsequent calls
+    reuse the writer, transform only the new ``finding_outputs`` (manual
+    requirements are not re-emitted), and append to the open file. Set
+    ``from_cli=False`` and ``is_last=False`` for intermediate batches; pass
+    ``is_last=True`` on the final batch to close the file (OCSF is also
+    finalized as a valid JSON array).
 
-    Returns the set of framework names that were processed so the caller
-    can remove them before entering the legacy per-provider output loop.
+    Returns the set of framework names processed so the caller can subtract
+    them from the legacy per-provider output loop.
     """
     from prowler.lib.outputs.compliance.universal.ocsf_compliance import (
         OCSFComplianceOutput,
@@ -65,6 +71,13 @@ def process_universal_compliance_frameworks(
         if isinstance(out, (UniversalComplianceOutput, OCSFComplianceOutput))
     }
 
+    def _flush(writer, framework, label, is_new):
+        if not is_new:
+            writer._transform(finding_outputs, framework, label, include_manual=False)
+        writer.close_file = is_last
+        writer.batch_write_data_to_file()
+        writer._data.clear()
+
     processed = set()
     for compliance_name in input_compliance_frameworks:
         if not (
@@ -75,37 +88,46 @@ def process_universal_compliance_frameworks(
             continue
 
         fw = universal_frameworks[compliance_name]
+        compliance_label = (
+            fw.framework + "-" + fw.version if fw.version else fw.framework
+        )
 
         # CSV output
         csv_path = (
             f"{output_directory}/compliance/" f"{output_filename}_{compliance_name}.csv"
         )
-        if csv_path not in existing_writers:
-            output = UniversalComplianceOutput(
+        csv_writer = existing_writers.get(csv_path)
+        csv_is_new = csv_writer is None
+        if csv_is_new:
+            csv_writer = UniversalComplianceOutput(
                 findings=finding_outputs,
                 framework=fw,
                 file_path=csv_path,
+                from_cli=from_cli,
                 provider=provider,
             )
-            generated_outputs["compliance"].append(output)
-            existing_writers[csv_path] = output
-            output.batch_write_data_to_file()
+            generated_outputs["compliance"].append(csv_writer)
+            existing_writers[csv_path] = csv_writer
+        _flush(csv_writer, fw, compliance_label, csv_is_new)
 
         # OCSF output (always generated for universal frameworks)
         ocsf_path = (
             f"{output_directory}/compliance/"
             f"{output_filename}_{compliance_name}.ocsf.json"
         )
-        if ocsf_path not in existing_writers:
-            ocsf_output = OCSFComplianceOutput(
+        ocsf_writer = existing_writers.get(ocsf_path)
+        ocsf_is_new = ocsf_writer is None
+        if ocsf_is_new:
+            ocsf_writer = OCSFComplianceOutput(
                 findings=finding_outputs,
                 framework=fw,
                 file_path=ocsf_path,
+                from_cli=from_cli,
                 provider=provider,
             )
-            generated_outputs["compliance"].append(ocsf_output)
-            existing_writers[ocsf_path] = ocsf_output
-            ocsf_output.batch_write_data_to_file()
+            generated_outputs["compliance"].append(ocsf_writer)
+            existing_writers[ocsf_path] = ocsf_writer
+        _flush(ocsf_writer, fw, compliance_label, ocsf_is_new)
 
         processed.add(compliance_name)
 
@@ -206,15 +228,6 @@ def display_compliance_table(
                 output_directory,
                 compliance_overview,
             )
-        elif compliance_framework.startswith("csa_ccm_"):
-            get_csa_table(
-                findings,
-                bulk_checks_metadata,
-                compliance_framework,
-                output_filename,
-                output_directory,
-                compliance_overview,
-            )
         elif compliance_framework.startswith("c5_"):
             get_c5_table(
                 findings,
@@ -242,8 +255,8 @@ def display_compliance_table(
                 output_directory,
                 compliance_overview,
             )
-        else:
-            get_generic_compliance_table(
+        elif compliance_framework.startswith("okta_idaas_stig"):
+            get_okta_idaas_stig_table(
                 findings,
                 bulk_checks_metadata,
                 compliance_framework,
@@ -251,6 +264,33 @@ def display_compliance_table(
                 output_directory,
                 compliance_overview,
             )
+        else:
+            # Try provider-specific table first, fall back to generic
+            from prowler.providers.common.provider import Provider
+
+            provider = Provider.get_global_provider()
+            handled = False
+            if provider is not None:
+                try:
+                    handled = provider.display_compliance_table(
+                        findings,
+                        bulk_checks_metadata,
+                        compliance_framework,
+                        output_filename,
+                        output_directory,
+                        compliance_overview,
+                    )
+                except NotImplementedError:
+                    handled = False
+            if not handled:
+                get_generic_compliance_table(
+                    findings,
+                    bulk_checks_metadata,
+                    compliance_framework,
+                    output_filename,
+                    output_directory,
+                    compliance_overview,
+                )
     except Exception as error:
         logger.critical(
             f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
diff --git a/prowler/lib/outputs/compliance/csa/csa_alibabacloud.py b/prowler/lib/outputs/compliance/csa/csa_alibabacloud.py
deleted file mode 100644
index e0867ab5f1..0000000000
--- a/prowler/lib/outputs/compliance/csa/csa_alibabacloud.py
+++ /dev/null
@@ -1,95 +0,0 @@
-from prowler.config.config import timestamp
-from prowler.lib.check.compliance_models import Compliance
-from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
-from prowler.lib.outputs.compliance.csa.models import AlibabaCloudCSAModel
-from prowler.lib.outputs.finding import Finding
-
-
-class AlibabaCloudCSA(ComplianceOutput):
-    """
-    This class represents the Alibaba Cloud CSA compliance output.
-
-    Attributes:
-        - _data (list): A list to store transformed data from findings.
-        - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file.
-
-    Methods:
-        - transform: Transforms findings into Alibaba Cloud CSA compliance format.
-    """
-
-    def transform(
-        self,
-        findings: list[Finding],
-        compliance: Compliance,
-        compliance_name: str,
-    ) -> None:
-        """
-        Transforms a list of findings into Alibaba Cloud CSA compliance format.
-
-        Parameters:
-            - findings (list): A list of findings.
-            - compliance (Compliance): A compliance model.
-            - compliance_name (str): The name of the compliance model.
-
-        Returns:
-            - None
-        """
-        for finding in findings:
-            for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
-                    for attribute in requirement.Attributes:
-                        compliance_row = AlibabaCloudCSAModel(
-                            Provider=finding.provider,
-                            Description=compliance.Description,
-                            AccountId=finding.account_uid,
-                            Region=finding.region,
-                            AssessmentDate=str(timestamp),
-                            Requirements_Id=requirement.Id,
-                            Requirements_Description=requirement.Description,
-                            Requirements_Name=requirement.Name,
-                            Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_CCMLite=attribute.CCMLite,
-                            Requirements_Attributes_IaaS=attribute.IaaS,
-                            Requirements_Attributes_PaaS=attribute.PaaS,
-                            Requirements_Attributes_SaaS=attribute.SaaS,
-                            Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
-                            ResourceId=finding.resource_uid,
-                            ResourceName=finding.resource_name,
-                            CheckId=finding.check_id,
-                            Muted=finding.muted,
-                            Framework=compliance.Framework,
-                            Name=compliance.Name,
-                        )
-                        self._data.append(compliance_row)
-        # Add manual requirements to the compliance output
-        for requirement in compliance.Requirements:
-            if not requirement.Checks:
-                for attribute in requirement.Attributes:
-                    compliance_row = AlibabaCloudCSAModel(
-                        Provider=compliance.Provider.lower(),
-                        Description=compliance.Description,
-                        AccountId="",
-                        Region="",
-                        AssessmentDate=str(timestamp),
-                        Requirements_Id=requirement.Id,
-                        Requirements_Description=requirement.Description,
-                        Requirements_Name=requirement.Name,
-                        Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_CCMLite=attribute.CCMLite,
-                        Requirements_Attributes_IaaS=attribute.IaaS,
-                        Requirements_Attributes_PaaS=attribute.PaaS,
-                        Requirements_Attributes_SaaS=attribute.SaaS,
-                        Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
-                        Status="MANUAL",
-                        StatusExtended="Manual check",
-                        ResourceId="manual_check",
-                        ResourceName="Manual check",
-                        CheckId="manual",
-                        Muted=False,
-                        Framework=compliance.Framework,
-                        Name=compliance.Name,
-                    )
-                    self._data.append(compliance_row)
diff --git a/prowler/lib/outputs/compliance/csa/csa_aws.py b/prowler/lib/outputs/compliance/csa/csa_aws.py
deleted file mode 100644
index 6309dbe287..0000000000
--- a/prowler/lib/outputs/compliance/csa/csa_aws.py
+++ /dev/null
@@ -1,95 +0,0 @@
-from prowler.config.config import timestamp
-from prowler.lib.check.compliance_models import Compliance
-from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
-from prowler.lib.outputs.compliance.csa.models import AWSCSAModel
-from prowler.lib.outputs.finding import Finding
-
-
-class AWSCSA(ComplianceOutput):
-    """
-    This class represents the AWS CSA compliance output.
-
-    Attributes:
-        - _data (list): A list to store transformed data from findings.
-        - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file.
-
-    Methods:
-        - transform: Transforms findings into AWS CSA compliance format.
-    """
-
-    def transform(
-        self,
-        findings: list[Finding],
-        compliance: Compliance,
-        compliance_name: str,
-    ) -> None:
-        """
-        Transforms a list of findings into AWS CSA compliance format.
-
-        Parameters:
-            - findings (list): A list of findings.
-            - compliance (Compliance): A compliance model.
-            - compliance_name (str): The name of the compliance model.
-
-        Returns:
-            - None
-        """
-        for finding in findings:
-            for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
-                    for attribute in requirement.Attributes:
-                        compliance_row = AWSCSAModel(
-                            Provider=finding.provider,
-                            Description=compliance.Description,
-                            AccountId=finding.account_uid,
-                            Region=finding.region,
-                            AssessmentDate=str(timestamp),
-                            Requirements_Id=requirement.Id,
-                            Requirements_Description=requirement.Description,
-                            Requirements_Name=requirement.Name,
-                            Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_CCMLite=attribute.CCMLite,
-                            Requirements_Attributes_IaaS=attribute.IaaS,
-                            Requirements_Attributes_PaaS=attribute.PaaS,
-                            Requirements_Attributes_SaaS=attribute.SaaS,
-                            Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
-                            ResourceId=finding.resource_uid,
-                            ResourceName=finding.resource_name,
-                            CheckId=finding.check_id,
-                            Muted=finding.muted,
-                            Framework=compliance.Framework,
-                            Name=compliance.Name,
-                        )
-                        self._data.append(compliance_row)
-        # Add manual requirements to the compliance output
-        for requirement in compliance.Requirements:
-            if not requirement.Checks:
-                for attribute in requirement.Attributes:
-                    compliance_row = AWSCSAModel(
-                        Provider=compliance.Provider.lower(),
-                        Description=compliance.Description,
-                        AccountId="",
-                        Region="",
-                        AssessmentDate=str(timestamp),
-                        Requirements_Id=requirement.Id,
-                        Requirements_Description=requirement.Description,
-                        Requirements_Name=requirement.Name,
-                        Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_CCMLite=attribute.CCMLite,
-                        Requirements_Attributes_IaaS=attribute.IaaS,
-                        Requirements_Attributes_PaaS=attribute.PaaS,
-                        Requirements_Attributes_SaaS=attribute.SaaS,
-                        Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
-                        Status="MANUAL",
-                        StatusExtended="Manual check",
-                        ResourceId="manual_check",
-                        ResourceName="Manual check",
-                        CheckId="manual",
-                        Muted=False,
-                        Framework=compliance.Framework,
-                        Name=compliance.Name,
-                    )
-                    self._data.append(compliance_row)
diff --git a/prowler/lib/outputs/compliance/csa/csa_azure.py b/prowler/lib/outputs/compliance/csa/csa_azure.py
deleted file mode 100644
index cf9a1064e6..0000000000
--- a/prowler/lib/outputs/compliance/csa/csa_azure.py
+++ /dev/null
@@ -1,95 +0,0 @@
-from prowler.config.config import timestamp
-from prowler.lib.check.compliance_models import Compliance
-from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
-from prowler.lib.outputs.compliance.csa.models import AzureCSAModel
-from prowler.lib.outputs.finding import Finding
-
-
-class AzureCSA(ComplianceOutput):
-    """
-    This class represents the Azure CSA compliance output.
-
-    Attributes:
-        - _data (list): A list to store transformed data from findings.
-        - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file.
-
-    Methods:
-        - transform: Transforms findings into Azure CSA compliance format.
-    """
-
-    def transform(
-        self,
-        findings: list[Finding],
-        compliance: Compliance,
-        compliance_name: str,
-    ) -> None:
-        """
-        Transforms a list of findings into Azure CSA compliance format.
-
-        Parameters:
-            - findings (list): A list of findings.
-            - compliance (Compliance): A compliance model.
-            - compliance_name (str): The name of the compliance model.
-
-        Returns:
-            - None
-        """
-        for finding in findings:
-            for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
-                    for attribute in requirement.Attributes:
-                        compliance_row = AzureCSAModel(
-                            Provider=finding.provider,
-                            Description=compliance.Description,
-                            SubscriptionId=finding.account_uid,
-                            Location=finding.region,
-                            AssessmentDate=str(timestamp),
-                            Requirements_Id=requirement.Id,
-                            Requirements_Description=requirement.Description,
-                            Requirements_Name=requirement.Name,
-                            Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_CCMLite=attribute.CCMLite,
-                            Requirements_Attributes_IaaS=attribute.IaaS,
-                            Requirements_Attributes_PaaS=attribute.PaaS,
-                            Requirements_Attributes_SaaS=attribute.SaaS,
-                            Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
-                            ResourceId=finding.resource_uid,
-                            ResourceName=finding.resource_name,
-                            CheckId=finding.check_id,
-                            Muted=finding.muted,
-                            Framework=compliance.Framework,
-                            Name=compliance.Name,
-                        )
-                        self._data.append(compliance_row)
-        # Add manual requirements to the compliance output
-        for requirement in compliance.Requirements:
-            if not requirement.Checks:
-                for attribute in requirement.Attributes:
-                    compliance_row = AzureCSAModel(
-                        Provider=compliance.Provider.lower(),
-                        Description=compliance.Description,
-                        SubscriptionId="",
-                        Location="",
-                        AssessmentDate=str(timestamp),
-                        Requirements_Id=requirement.Id,
-                        Requirements_Description=requirement.Description,
-                        Requirements_Name=requirement.Name,
-                        Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_CCMLite=attribute.CCMLite,
-                        Requirements_Attributes_IaaS=attribute.IaaS,
-                        Requirements_Attributes_PaaS=attribute.PaaS,
-                        Requirements_Attributes_SaaS=attribute.SaaS,
-                        Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
-                        Status="MANUAL",
-                        StatusExtended="Manual check",
-                        ResourceId="manual_check",
-                        ResourceName="Manual check",
-                        CheckId="manual",
-                        Muted=False,
-                        Framework=compliance.Framework,
-                        Name=compliance.Name,
-                    )
-                    self._data.append(compliance_row)
diff --git a/prowler/lib/outputs/compliance/csa/csa_gcp.py b/prowler/lib/outputs/compliance/csa/csa_gcp.py
deleted file mode 100644
index 4a829295db..0000000000
--- a/prowler/lib/outputs/compliance/csa/csa_gcp.py
+++ /dev/null
@@ -1,95 +0,0 @@
-from prowler.config.config import timestamp
-from prowler.lib.check.compliance_models import Compliance
-from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
-from prowler.lib.outputs.compliance.csa.models import GCPCSAModel
-from prowler.lib.outputs.finding import Finding
-
-
-class GCPCSA(ComplianceOutput):
-    """
-    This class represents the GCP CSA compliance output.
-
-    Attributes:
-        - _data (list): A list to store transformed data from findings.
-        - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file.
-
-    Methods:
-        - transform: Transforms findings into GCP CSA compliance format.
-    """
-
-    def transform(
-        self,
-        findings: list[Finding],
-        compliance: Compliance,
-        compliance_name: str,
-    ) -> None:
-        """
-        Transforms a list of findings into GCP CSA compliance format.
-
-        Parameters:
-            - findings (list): A list of findings.
-            - compliance (Compliance): A compliance model.
-            - compliance_name (str): The name of the compliance model.
-
-        Returns:
-            - None
-        """
-        for finding in findings:
-            for requirement in compliance.Requirements:
-                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
-                if finding.check_id in requirement.Checks:
-                    for attribute in requirement.Attributes:
-                        compliance_row = GCPCSAModel(
-                            Provider=finding.provider,
-                            Description=compliance.Description,
-                            ProjectId=finding.account_uid,
-                            Location=finding.region,
-                            AssessmentDate=str(timestamp),
-                            Requirements_Id=requirement.Id,
-                            Requirements_Description=requirement.Description,
-                            Requirements_Name=requirement.Name,
-                            Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_CCMLite=attribute.CCMLite,
-                            Requirements_Attributes_IaaS=attribute.IaaS,
-                            Requirements_Attributes_PaaS=attribute.PaaS,
-                            Requirements_Attributes_SaaS=attribute.SaaS,
-                            Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
-                            ResourceId=finding.resource_uid,
-                            ResourceName=finding.resource_name,
-                            CheckId=finding.check_id,
-                            Muted=finding.muted,
-                            Framework=compliance.Framework,
-                            Name=compliance.Name,
-                        )
-                        self._data.append(compliance_row)
-        # Add manual requirements to the compliance output
-        for requirement in compliance.Requirements:
-            if not requirement.Checks:
-                for attribute in requirement.Attributes:
-                    compliance_row = GCPCSAModel(
-                        Provider=compliance.Provider.lower(),
-                        Description=compliance.Description,
-                        ProjectId="",
-                        Location="",
-                        AssessmentDate=str(timestamp),
-                        Requirements_Id=requirement.Id,
-                        Requirements_Description=requirement.Description,
-                        Requirements_Name=requirement.Name,
-                        Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_CCMLite=attribute.CCMLite,
-                        Requirements_Attributes_IaaS=attribute.IaaS,
-                        Requirements_Attributes_PaaS=attribute.PaaS,
-                        Requirements_Attributes_SaaS=attribute.SaaS,
-                        Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
-                        Status="MANUAL",
-                        StatusExtended="Manual check",
-                        ResourceId="manual_check",
-                        ResourceName="Manual check",
-                        CheckId="manual",
-                        Muted=False,
-                        Framework=compliance.Framework,
-                        Name=compliance.Name,
-                    )
-                    self._data.append(compliance_row)
diff --git a/prowler/lib/outputs/compliance/csa/models.py b/prowler/lib/outputs/compliance/csa/models.py
deleted file mode 100644
index 78c7384fc6..0000000000
--- a/prowler/lib/outputs/compliance/csa/models.py
+++ /dev/null
@@ -1,146 +0,0 @@
-from pydantic.v1 import BaseModel
-
-
-class AWSCSAModel(BaseModel):
-    """
-    AWSCSAModel generates a finding's output in CSV CSA format for AWS.
-    """
-
-    Provider: str
-    Description: str
-    AccountId: str
-    Region: str
-    AssessmentDate: str
-    Requirements_Id: str
-    Requirements_Description: str
-    Requirements_Name: str
-    Requirements_Attributes_Section: str
-    Requirements_Attributes_CCMLite: str
-    Requirements_Attributes_IaaS: str
-    Requirements_Attributes_PaaS: str
-    Requirements_Attributes_SaaS: str
-    Requirements_Attributes_ScopeApplicability: list[dict]
-    Status: str
-    StatusExtended: str
-    ResourceId: str
-    CheckId: str
-    Muted: bool
-    ResourceName: str
-    Framework: str
-    Name: str
-
-
-class GCPCSAModel(BaseModel):
-    """
-    GCPCSAModel generates a finding's output in CSV CSA format for GCP.
-    """
-
-    Provider: str
-    Description: str
-    ProjectId: str
-    Location: str
-    AssessmentDate: str
-    Requirements_Id: str
-    Requirements_Description: str
-    Requirements_Name: str
-    Requirements_Attributes_Section: str
-    Requirements_Attributes_CCMLite: str
-    Requirements_Attributes_IaaS: str
-    Requirements_Attributes_PaaS: str
-    Requirements_Attributes_SaaS: str
-    Requirements_Attributes_ScopeApplicability: list[dict]
-    Status: str
-    StatusExtended: str
-    ResourceId: str
-    CheckId: str
-    Muted: bool
-    ResourceName: str
-    Framework: str
-    Name: str
-
-
-class OracleCloudCSAModel(BaseModel):
-    """
-    OracleCloudCSAModel generates a finding's output in CSV CSA format for OracleCloud.
-    """
-
-    Provider: str
-    Description: str
-    TenancyId: str
-    Region: str
-    AssessmentDate: str
-    Requirements_Id: str
-    Requirements_Description: str
-    Requirements_Name: str
-    Requirements_Attributes_Section: str
-    Requirements_Attributes_CCMLite: str
-    Requirements_Attributes_IaaS: str
-    Requirements_Attributes_PaaS: str
-    Requirements_Attributes_SaaS: str
-    Requirements_Attributes_ScopeApplicability: list[dict]
-    Status: str
-    StatusExtended: str
-    ResourceId: str
-    CheckId: str
-    Muted: bool
-    ResourceName: str
-    Framework: str
-    Name: str
-
-
-class AlibabaCloudCSAModel(BaseModel):
-    """
-    AlibabaCloudCSAModel generates a finding's output in CSV CSA format for Alibaba Cloud.
-    """
-
-    Provider: str
-    Description: str
-    AccountId: str
-    Region: str
-    AssessmentDate: str
-    Requirements_Id: str
-    Requirements_Description: str
-    Requirements_Name: str
-    Requirements_Attributes_Section: str
-    Requirements_Attributes_CCMLite: str
-    Requirements_Attributes_IaaS: str
-    Requirements_Attributes_PaaS: str
-    Requirements_Attributes_SaaS: str
-    Requirements_Attributes_ScopeApplicability: list[dict]
-    Status: str
-    StatusExtended: str
-    ResourceId: str
-    CheckId: str
-    Muted: bool
-    ResourceName: str
-    Framework: str
-    Name: str
-
-
-class AzureCSAModel(BaseModel):
-    """
-    AzureCSAModel generates a finding's output in CSV CSA format for Azure.
-    """
-
-    Provider: str
-    Description: str
-    SubscriptionId: str
-    Location: str
-    AssessmentDate: str
-    Requirements_Id: str
-    Requirements_Description: str
-    Requirements_Name: str
-    Requirements_Attributes_Section: str
-    Requirements_Attributes_CCMLite: str
-    Requirements_Attributes_IaaS: str
-    Requirements_Attributes_PaaS: str
-    Requirements_Attributes_SaaS: str
-    Requirements_Attributes_ScopeApplicability: list[dict]
-    Status: str
-    StatusExtended: str
-    ResourceId: str
-    CheckId: str
-    Muted: bool
-    ResourceName: str
-    Framework: str
-    Name: str
diff --git a/prowler/lib/outputs/compliance/ens/ens.py b/prowler/lib/outputs/compliance/ens/ens.py
index a414a0206d..c39abe0a6a 100644
--- a/prowler/lib/outputs/compliance/ens/ens.py
+++ b/prowler/lib/outputs/compliance/ens/ens.py
@@ -13,6 +13,8 @@ def get_ens_table(
     compliance_overview: bool,
 ):
     marcos = {}
+    marco_muted_seen = {}
+    provider = ""
     ens_compliance_table = {
         "Proveedor": [],
         "Marco/Categoria": [],
@@ -31,6 +33,7 @@ def get_ens_table(
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "ENS":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         marco_categoria = f"{attribute.Marco}/{attribute.Categoria}"
@@ -44,17 +47,23 @@ def get_ens_table(
                                 "Bajo": 0,
                                 "Muted": 0,
                             }
+                            marco_muted_seen[marco_categoria] = set()
                         if finding.muted:
+                            # Overview total: count each finding once per framework
                             if index not in muted_count:
                                 muted_count.append(index)
+                            # Per-marco Muted: count each finding once per marco
+                            # it belongs to (a finding can map to several marcos).
+                            if index not in marco_muted_seen[marco_categoria]:
+                                marco_muted_seen[marco_categoria].add(index)
                                 marcos[marco_categoria]["Muted"] += 1
                         else:
                             if finding.status == "FAIL":
-                                if (
-                                    attribute.Tipo != "recomendacion"
-                                    and index not in fail_count
-                                ):
-                                    fail_count.append(index)
+                                if attribute.Tipo != "recomendacion":
+                                    if index not in fail_count:
+                                        fail_count.append(index)
+                                    # Mark every marco the finding belongs to as
+                                    # NO CUMPLE, not just the first one seen.
                                     marcos[marco_categoria][
                                         "Estado"
                                     ] = f"{Fore.RED}NO CUMPLE{Style.RESET_ALL}"
@@ -71,7 +80,7 @@ def get_ens_table(
 
     # Add results to table
     for marco in sorted(marcos):
-        ens_compliance_table["Proveedor"].append(compliance.Provider)
+        ens_compliance_table["Proveedor"].append(provider)
         ens_compliance_table["Marco/Categoria"].append(marco)
         ens_compliance_table["Estado"].append(marcos[marco]["Estado"])
         ens_compliance_table["Opcional"].append(
diff --git a/prowler/lib/outputs/compliance/generic/generic.py b/prowler/lib/outputs/compliance/generic/generic.py
index c7217db5b3..b774f09577 100644
--- a/prowler/lib/outputs/compliance/generic/generic.py
+++ b/prowler/lib/outputs/compliance/generic/generic.py
@@ -34,60 +34,48 @@ class GenericCompliance(ComplianceOutput):
         Returns:
             - None
         """
+
+        def compliance_row(requirement, attribute, finding=None):
+            # Read attribute fields defensively: GenericCompliance is the
+            # last-resort renderer for any framework, and provider-specific
+            # schemas (e.g. CIS, ENS, ISO27001) do not declare the universal
+            # Section/SubSection/SubGroup/Service/Type/Comment fields.
+            return GenericComplianceModel(
+                Provider=(finding.provider if finding else compliance.Provider.lower()),
+                Description=compliance.Description,
+                AccountId=finding.account_uid if finding else "",
+                Region=finding.region if finding else "",
+                AssessmentDate=str(timestamp),
+                Requirements_Id=requirement.Id,
+                Requirements_Description=requirement.Description,
+                Requirements_Attributes_Section=getattr(attribute, "Section", None),
+                Requirements_Attributes_SubSection=getattr(
+                    attribute, "SubSection", None
+                ),
+                Requirements_Attributes_SubGroup=getattr(attribute, "SubGroup", None),
+                Requirements_Attributes_Service=getattr(attribute, "Service", None),
+                Requirements_Attributes_Type=getattr(attribute, "Type", None),
+                Requirements_Attributes_Comment=getattr(attribute, "Comment", None),
+                Status=finding.status if finding else "MANUAL",
+                StatusExtended=(finding.status_extended if finding else "Manual check"),
+                ResourceId=finding.resource_uid if finding else "manual_check",
+                ResourceName=finding.resource_name if finding else "Manual check",
+                CheckId=finding.check_id if finding else "manual",
+                Muted=finding.muted if finding else False,
+                Framework=compliance.Framework,
+                Name=compliance.Name,
+            )
+
         for finding in findings:
             for requirement in compliance.Requirements:
                 # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                 if finding.check_id in requirement.Checks:
                     for attribute in requirement.Attributes:
-                        compliance_row = GenericComplianceModel(
-                            Provider=finding.provider,
-                            Description=compliance.Description,
-                            AccountId=finding.account_uid,
-                            Region=finding.region,
-                            AssessmentDate=str(timestamp),
-                            Requirements_Id=requirement.Id,
-                            Requirements_Description=requirement.Description,
-                            Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_SubSection=attribute.SubSection,
-                            Requirements_Attributes_SubGroup=attribute.SubGroup,
-                            Requirements_Attributes_Service=attribute.Service,
-                            Requirements_Attributes_Type=attribute.Type,
-                            Requirements_Attributes_Comment=attribute.Comment,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
-                            ResourceId=finding.resource_uid,
-                            ResourceName=finding.resource_name,
-                            CheckId=finding.check_id,
-                            Muted=finding.muted,
-                            Framework=compliance.Framework,
-                            Name=compliance.Name,
+                        self._data.append(
+                            compliance_row(requirement, attribute, finding)
                         )
-                        self._data.append(compliance_row)
         # Add manual requirements to the compliance output
         for requirement in compliance.Requirements:
             if not requirement.Checks:
                 for attribute in requirement.Attributes:
-                    compliance_row = GenericComplianceModel(
-                        Provider=compliance.Provider.lower(),
-                        Description=compliance.Description,
-                        AccountId="",
-                        Region="",
-                        AssessmentDate=str(timestamp),
-                        Requirements_Id=requirement.Id,
-                        Requirements_Description=requirement.Description,
-                        Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_SubSection=attribute.SubSection,
-                        Requirements_Attributes_SubGroup=attribute.SubGroup,
-                        Requirements_Attributes_Service=attribute.Service,
-                        Requirements_Attributes_Type=attribute.Type,
-                        Requirements_Attributes_Comment=attribute.Comment,
-                        Status="MANUAL",
-                        StatusExtended="Manual check",
-                        ResourceId="manual_check",
-                        ResourceName="Manual check",
-                        CheckId="manual",
-                        Muted=False,
-                        Framework=compliance.Framework,
-                        Name=compliance.Name,
-                    )
-                    self._data.append(compliance_row)
+                    self._data.append(compliance_row(requirement, attribute))
diff --git a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py
index 93b925a5ff..e7c00b188d 100644
--- a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py
+++ b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py
@@ -13,7 +13,9 @@ def get_kisa_ismsp_table(
     compliance_overview: bool,
 ):
     sections = {}
+    section_seen = {}
     sections_status = {}
+    provider = ""
     kisa_ismsp_compliance_table = {
         "Provider": [],
         "Section": [],
@@ -31,6 +33,7 @@ def get_kisa_ismsp_table(
                 compliance.Framework.startswith("KISA")
                 and compliance.Version in compliance_framework
             ):
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
@@ -43,16 +46,28 @@ def get_kisa_ismsp_table(
                                 },
                                 "Muted": 0,
                             }
+                            section_seen[section] = set()
+
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["Status"]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["Status"]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["Status"]["PASS"] += 1
 
     # Add results to table
@@ -70,7 +85,7 @@ def get_kisa_ismsp_table(
             else:
                 sections_status[section] = f"{Fore.GREEN}PASS{Style.RESET_ALL}"
     for section in sections:
-        kisa_ismsp_compliance_table["Provider"].append(compliance.Provider)
+        kisa_ismsp_compliance_table["Provider"].append(provider)
         kisa_ismsp_compliance_table["Section"].append(section)
         kisa_ismsp_compliance_table["Status"].append(sections_status[section])
         kisa_ismsp_compliance_table["Muted"].append(
diff --git a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py
index bab3e4e31a..7492624aff 100644
--- a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py
+++ b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py
@@ -13,6 +13,8 @@ def get_mitre_attack_table(
     compliance_overview: bool,
 ):
     tactics = {}
+    tactic_seen = {}
+    provider = ""
     mitre_compliance_table = {
         "Provider": [],
         "Tactic": [],
@@ -30,27 +32,38 @@ def get_mitre_attack_table(
                 "MITRE-ATTACK" in compliance.Framework
                 and compliance.Version in compliance_framework
             ):
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for tactic in requirement.Tactics:
                         if tactic not in tactics:
                             tactics[tactic] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            tactic_seen[tactic] = set()
+
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
+                                fail_count.append(index)
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
+                                pass_count.append(index)
+
+                        # Per-tactic counts: count each finding once per tactic
+                        # it belongs to (a finding can map to several tactics).
+                        if index not in tactic_seen[tactic]:
+                            tactic_seen[tactic].add(index)
+                            if finding.muted:
                                 tactics[tactic]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL":
-                                if index not in fail_count:
-                                    fail_count.append(index)
-                                    tactics[tactic]["FAIL"] += 1
+                            elif finding.status == "FAIL":
+                                tactics[tactic]["FAIL"] += 1
                             elif finding.status == "PASS":
-                                if index not in pass_count:
-                                    pass_count.append(index)
-                                    tactics[tactic]["PASS"] += 1
+                                tactics[tactic]["PASS"] += 1
     # Add results to table
     tactics = dict(sorted(tactics.items()))
     for tactic in tactics:
-        mitre_compliance_table["Provider"].append(compliance.Provider)
+        mitre_compliance_table["Provider"].append(provider)
         mitre_compliance_table["Tactic"].append(tactic)
         if tactics[tactic]["FAIL"] > 0:
             mitre_compliance_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/okta_idaas_stig/__init__.py b/prowler/lib/outputs/compliance/okta_idaas_stig/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/lib/outputs/compliance/okta_idaas_stig/models.py b/prowler/lib/outputs/compliance/okta_idaas_stig/models.py
new file mode 100644
index 0000000000..674d9656b7
--- /dev/null
+++ b/prowler/lib/outputs/compliance/okta_idaas_stig/models.py
@@ -0,0 +1,32 @@
+from typing import Optional
+
+from pydantic.v1 import BaseModel
+
+
+class OktaIDaaSSTIGModel(BaseModel):
+    """
+    OktaIDaaSSTIGModel generates a finding's output in DISA Okta IDaaS STIG Compliance format.
+    """
+
+    Provider: str
+    Description: str
+    OrganizationDomain: str
+    AssessmentDate: str
+    Requirements_Id: str
+    Requirements_Name: str
+    Requirements_Description: str
+    Requirements_Attributes_Section: str
+    Requirements_Attributes_Severity: str
+    Requirements_Attributes_RuleID: str
+    Requirements_Attributes_StigID: str
+    Requirements_Attributes_CCI: Optional[list[str]] = None
+    Requirements_Attributes_CheckText: Optional[str] = None
+    Requirements_Attributes_FixText: Optional[str] = None
+    Status: str
+    StatusExtended: str
+    ResourceId: str
+    ResourceName: str
+    CheckId: str
+    Muted: bool
+    Framework: str
+    Name: str
diff --git a/prowler/lib/outputs/compliance/csa/csa.py b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
similarity index 78%
rename from prowler/lib/outputs/compliance/csa/csa.py
rename to prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
index ab8a021a70..1febe02f60 100644
--- a/prowler/lib/outputs/compliance/csa/csa.py
+++ b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
@@ -4,7 +4,7 @@ from tabulate import tabulate
 from prowler.config.config import orange_color
 
 
-def get_csa_table(
+def get_okta_idaas_stig_table(
     findings: list,
     bulk_checks_metadata: dict,
     compliance_framework: str,
@@ -22,36 +22,47 @@ def get_csa_table(
     fail_count = []
     muted_count = []
     sections = {}
+    section_seen = {}
+    provider = ""
     for index, finding in enumerate(findings):
         check = bulk_checks_metadata[finding.check_metadata.CheckID]
         check_compliances = check.Compliance
         for compliance in check_compliances:
-            if (
-                compliance.Framework == "CSA-CCM"
-                and compliance.Version in compliance_framework
-            ):
+            if compliance.Framework == "Okta-IDaaS-STIG":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
 
                         if section not in sections:
                             sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            section_seen[section] = set()
 
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["PASS"] += 1
 
     sections = dict(sorted(sections.items()))
     for section in sections:
-        section_table["Provider"].append(compliance.Provider)
+        section_table["Provider"].append(provider)
         section_table["Section"].append(section)
         if sections[section]["FAIL"] > 0:
             section_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/csa/csa_oraclecloud.py b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py
similarity index 66%
rename from prowler/lib/outputs/compliance/csa/csa_oraclecloud.py
rename to prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py
index 107589c0f7..25f71b4def 100644
--- a/prowler/lib/outputs/compliance/csa/csa_oraclecloud.py
+++ b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py
@@ -1,35 +1,35 @@
 from prowler.config.config import timestamp
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
-from prowler.lib.outputs.compliance.csa.models import OracleCloudCSAModel
+from prowler.lib.outputs.compliance.okta_idaas_stig.models import OktaIDaaSSTIGModel
 from prowler.lib.outputs.finding import Finding
 
 
-class OracleCloudCSA(ComplianceOutput):
+class OktaIDaaSSTIG(ComplianceOutput):
     """
-    This class represents the OracleCloud CSA compliance output.
+    This class represents the Okta IDaaS STIG compliance output.
 
     Attributes:
         - _data (list): A list to store transformed data from findings.
         - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file.
 
     Methods:
-        - transform: Transforms findings into OracleCloud CSA compliance format.
+        - transform: Transforms findings into Okta IDaaS STIG compliance format.
     """
 
     def transform(
         self,
         findings: list[Finding],
         compliance: Compliance,
-        compliance_name: str,
+        _compliance_name: str,
     ) -> None:
         """
-        Transforms a list of findings into OracleCloud CSA compliance format.
+        Transforms a list of findings into Okta IDaaS STIG compliance format.
 
         Parameters:
             - findings (list): A list of findings.
             - compliance (Compliance): A compliance model.
-            - compliance_name (str): The name of the compliance model.
+            - _compliance_name (str): The name of the compliance model (unused).
 
         Returns:
             - None
@@ -39,21 +39,21 @@ class OracleCloudCSA(ComplianceOutput):
                 # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                 if finding.check_id in requirement.Checks:
                     for attribute in requirement.Attributes:
-                        compliance_row = OracleCloudCSAModel(
+                        compliance_row = OktaIDaaSSTIGModel(
                             Provider=finding.provider,
                             Description=compliance.Description,
-                            TenancyId=finding.account_uid,
-                            Region=finding.region,
+                            OrganizationDomain=finding.account_name,
                             AssessmentDate=str(timestamp),
                             Requirements_Id=requirement.Id,
-                            Requirements_Description=requirement.Description,
                             Requirements_Name=requirement.Name,
+                            Requirements_Description=requirement.Description,
                             Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_CCMLite=attribute.CCMLite,
-                            Requirements_Attributes_IaaS=attribute.IaaS,
-                            Requirements_Attributes_PaaS=attribute.PaaS,
-                            Requirements_Attributes_SaaS=attribute.SaaS,
-                            Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
+                            Requirements_Attributes_Severity=attribute.Severity.value,
+                            Requirements_Attributes_RuleID=attribute.RuleID,
+                            Requirements_Attributes_StigID=attribute.StigID,
+                            Requirements_Attributes_CCI=attribute.CCI,
+                            Requirements_Attributes_CheckText=attribute.CheckText,
+                            Requirements_Attributes_FixText=attribute.FixText,
                             Status=finding.status,
                             StatusExtended=finding.status_extended,
                             ResourceId=finding.resource_uid,
@@ -68,21 +68,21 @@ class OracleCloudCSA(ComplianceOutput):
         for requirement in compliance.Requirements:
             if not requirement.Checks:
                 for attribute in requirement.Attributes:
-                    compliance_row = OracleCloudCSAModel(
+                    compliance_row = OktaIDaaSSTIGModel(
                         Provider=compliance.Provider.lower(),
                         Description=compliance.Description,
-                        TenancyId="",
-                        Region="",
+                        OrganizationDomain="",
                         AssessmentDate=str(timestamp),
                         Requirements_Id=requirement.Id,
-                        Requirements_Description=requirement.Description,
                         Requirements_Name=requirement.Name,
+                        Requirements_Description=requirement.Description,
                         Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_CCMLite=attribute.CCMLite,
-                        Requirements_Attributes_IaaS=attribute.IaaS,
-                        Requirements_Attributes_PaaS=attribute.PaaS,
-                        Requirements_Attributes_SaaS=attribute.SaaS,
-                        Requirements_Attributes_ScopeApplicability=attribute.ScopeApplicability,
+                        Requirements_Attributes_Severity=attribute.Severity.value,
+                        Requirements_Attributes_RuleID=attribute.RuleID,
+                        Requirements_Attributes_StigID=attribute.StigID,
+                        Requirements_Attributes_CCI=attribute.CCI,
+                        Requirements_Attributes_CheckText=attribute.CheckText,
+                        Requirements_Attributes_FixText=attribute.FixText,
                         Status="MANUAL",
                         StatusExtended="Manual check",
                         ResourceId="manual_check",
diff --git a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py
index cfcd4a006e..b17307f04a 100644
--- a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py
+++ b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py
@@ -24,6 +24,8 @@ def get_prowler_threatscore_table(
     fail_count = []
     muted_count = []
     pillars = {}
+    pillar_seen = {}
+    provider = ""
     generic_score = 0
     max_generic_score = 0
     counted_findings_generic = []
@@ -35,6 +37,7 @@ def get_prowler_threatscore_table(
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "ProwlerThreatScore":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         pillar = attribute.Section
@@ -65,17 +68,28 @@ def get_prowler_threatscore_table(
 
                         if pillar not in pillars:
                             pillars[pillar] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            pillar_seen[pillar] = set()
 
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                pillars[pillar]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                pillars[pillar]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-pillar counts: count each finding once per pillar
+                        # it belongs to (a finding can map to several pillars).
+                        if index not in pillar_seen[pillar]:
+                            pillar_seen[pillar].add(index)
+                            if finding.muted:
+                                pillars[pillar]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                pillars[pillar]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 pillars[pillar]["PASS"] += 1
 
                         # Generic score
@@ -90,18 +104,21 @@ def get_prowler_threatscore_table(
                             counted_findings_generic.append(index)
 
     no_findings_pillars = []
-    bulk_compliance = Compliance.get_bulk(provider=compliance.Provider.lower()).get(
-        compliance_framework
+    bulk_compliance = (
+        Compliance.get_bulk(provider=provider.lower()).get(compliance_framework)
+        if provider
+        else None
     )
-    for requirement in bulk_compliance.Requirements:
-        for attribute in requirement.Attributes:
-            pillar = attribute.Section
-            if pillar not in pillars.keys() and pillar not in no_findings_pillars:
-                no_findings_pillars.append(pillar)
+    if bulk_compliance:
+        for requirement in bulk_compliance.Requirements:
+            for attribute in requirement.Attributes:
+                pillar = attribute.Section
+                if pillar not in pillars.keys() and pillar not in no_findings_pillars:
+                    no_findings_pillars.append(pillar)
 
     pillars = dict(sorted(pillars.items()))
     for pillar in pillars:
-        pillar_table["Provider"].append(compliance.Provider)
+        pillar_table["Provider"].append(provider)
         pillar_table["Pillar"].append(pillar)
         if max_score_per_pillar[pillar] == 0:
             pillar_score = 100.0
@@ -127,7 +144,7 @@ def get_prowler_threatscore_table(
         )
 
     for pillar in no_findings_pillars:
-        pillar_table["Provider"].append(compliance.Provider)
+        pillar_table["Provider"].append(provider)
         pillar_table["Pillar"].append(pillar)
         pillar_table["Score"].append(f"{Style.BRIGHT}{Fore.GREEN}100%{Style.RESET_ALL}")
         pillar_table["Status"].append(f"{Fore.GREEN}PASS{Style.RESET_ALL}")
diff --git a/prowler/lib/outputs/compliance/universal/ocsf_compliance.py b/prowler/lib/outputs/compliance/universal/ocsf_compliance.py
index 2ce69412e1..2886f7e4d2 100644
--- a/prowler/lib/outputs/compliance/universal/ocsf_compliance.py
+++ b/prowler/lib/outputs/compliance/universal/ocsf_compliance.py
@@ -79,30 +79,43 @@ def _to_snake_case(name: str) -> str:
     return s.lower()
 
 
-def _build_requirement_attrs(requirement, framework) -> dict:
-    """Build a dict with requirement attributes for the unmapped section.
+def _build_requirement_attrs(requirement, framework):
+    """Build the requirement attributes payload for the unmapped section.
 
-    Keys are normalized to snake_case for OCSF consistency.
-    Only includes attributes whose AttributeMetadata has output_formats.ocsf=True.
-    When no metadata is declared, all attributes are included.
+    Keys are snake_cased and filtered by ``AttributeMetadata.output_formats.ocsf``
+    when declared. MITRE-style attrs (``{"_raw_attributes": [...]}``) are
+    unwrapped into a list of per-entry dicts.
     """
-    attrs = requirement.attributes
-    if not attrs:
+    requirement_attributes = requirement.attributes
+    if not requirement_attributes:
         return {}
 
-    # Build set of keys allowed for OCSF output
     metadata = framework.attributes_metadata
-    if metadata:
-        ocsf_keys = {m.key for m in metadata if m.output_formats.ocsf}
-    else:
-        ocsf_keys = None  # No metadata → include all
+    allowed_keys = (
+        {entry.key for entry in metadata if entry.output_formats.ocsf}
+        if metadata
+        else None
+    )
 
-    result = {}
-    for key, value in attrs.items():
-        if ocsf_keys is not None and key not in ocsf_keys:
-            continue
-        result[_to_snake_case(key)] = value
-    return result
+    def _to_snake_case_dict(entry: dict) -> dict:
+        return {
+            _to_snake_case(key): value
+            for key, value in entry.items()
+            if allowed_keys is None or key in allowed_keys
+        }
+
+    if (
+        isinstance(requirement_attributes, dict)
+        and "_raw_attributes" in requirement_attributes
+    ):
+        raw_entries = requirement_attributes.get("_raw_attributes") or []
+        return [
+            _to_snake_case_dict(entry)
+            for entry in raw_entries
+            if isinstance(entry, dict)
+        ]
+
+    return _to_snake_case_dict(requirement_attributes)
 
 
 class OCSFComplianceOutput:
@@ -147,7 +160,14 @@ class OCSFComplianceOutput:
         findings: List["Finding"],
         framework: ComplianceFramework,
         compliance_name: str,
+        include_manual: bool = True,
     ) -> None:
+        """Transform findings into OCSF ComplianceFinding events.
+
+        Manual requirements are emitted only when ``include_manual=True``. The
+        caller must pass ``False`` for subsequent streaming batches so manual
+        events are not duplicated.
+        """
         # Build check -> requirements map
         check_req_map = {}
         for req in framework.requirements:
@@ -170,6 +190,9 @@ class OCSFComplianceOutput:
                     if cf:
                         self._data.append(cf)
 
+        if not include_manual:
+            return
+
         # Manual requirements (no checks or empty for current provider)
         for req in framework.requirements:
             checks = req.checks
diff --git a/prowler/lib/outputs/compliance/universal/universal_output.py b/prowler/lib/outputs/compliance/universal/universal_output.py
index 5f99f05755..a3cdb1389a 100644
--- a/prowler/lib/outputs/compliance/universal/universal_output.py
+++ b/prowler/lib/outputs/compliance/universal/universal_output.py
@@ -198,8 +198,15 @@ class UniversalComplianceOutput:
         findings: list["Finding"],
         framework: ComplianceFramework,
         compliance_name: str,
+        include_manual: bool = True,
     ) -> None:
-        """Transform findings into universal compliance CSV rows."""
+        """Transform findings into universal compliance CSV rows.
+
+        Manual requirements (no checks or empty for current provider) are
+        emitted only when ``include_manual=True``. When the writer is reused
+        across streaming batches, the caller should pass ``False`` after the
+        first batch so manual rows are not duplicated.
+        """
         # Build check -> requirements map (filtered by provider for dict checks)
         check_req_map = {}
         for req in framework.requirements:
@@ -228,6 +235,9 @@ class UniversalComplianceOutput:
                     except Exception as e:
                         logger.debug(f"Skipping row for {req.id}: {e}")
 
+        if not include_manual:
+            return
+
         # Manual requirements (no checks or empty dict)
         for req in framework.requirements:
             checks = req.checks
diff --git a/prowler/lib/outputs/compliance/universal/universal_table.py b/prowler/lib/outputs/compliance/universal/universal_table.py
index e838c5e9cf..e54ad5155c 100644
--- a/prowler/lib/outputs/compliance/universal/universal_table.py
+++ b/prowler/lib/outputs/compliance/universal/universal_table.py
@@ -163,6 +163,7 @@ def _render_grouped(
     """Grouped mode: one row per group with pass/fail counts."""
     check_map = _build_requirement_check_map(framework, provider)
     groups = {}
+    group_seen = {}
     pass_count = []
     fail_count = []
     muted_count = []
@@ -176,17 +177,28 @@ def _render_grouped(
             for group_key in _get_group_key(req, group_by):
                 if group_key not in groups:
                     groups[group_key] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                    group_seen[group_key] = set()
 
+                # Overview totals: count each finding once per framework
                 if finding.muted:
                     if index not in muted_count:
                         muted_count.append(index)
-                        groups[group_key]["Muted"] += 1
-                else:
-                    if finding.status == "FAIL" and index not in fail_count:
+                elif finding.status == "FAIL":
+                    if index not in fail_count:
                         fail_count.append(index)
-                        groups[group_key]["FAIL"] += 1
-                    elif finding.status == "PASS" and index not in pass_count:
+                elif finding.status == "PASS":
+                    if index not in pass_count:
                         pass_count.append(index)
+
+                # Per-group counts: count each finding once per group it belongs
+                # to (a finding can map to several groups via several requirements).
+                if index not in group_seen[group_key]:
+                    group_seen[group_key].add(index)
+                    if finding.muted:
+                        groups[group_key]["Muted"] += 1
+                    elif finding.status == "FAIL":
+                        groups[group_key]["FAIL"] += 1
+                    elif finding.status == "PASS":
                         groups[group_key]["PASS"] += 1
 
     if not _print_overview(
@@ -258,6 +270,8 @@ def _render_split(
     split_field = split_by.field
     split_values = split_by.values
     groups = {}
+    group_muted_seen = {}
+    group_split_seen = {}
     pass_count = []
     fail_count = []
     muted_count = []
@@ -274,12 +288,19 @@ def _render_split(
                         sv: {"FAIL": 0, "PASS": 0} for sv in split_values
                     }
                     groups[group_key]["Muted"] = 0
+                    group_muted_seen[group_key] = set()
+                    group_split_seen[group_key] = {sv: set() for sv in split_values}
 
                 split_val = req.attributes.get(split_field, "")
 
                 if finding.muted:
+                    # Overview total: count each finding once per framework
                     if index not in muted_count:
                         muted_count.append(index)
+                    # Per-group Muted: count each finding once per group it
+                    # belongs to (a finding can map to several groups).
+                    if index not in group_muted_seen[group_key]:
+                        group_muted_seen[group_key].add(index)
                         groups[group_key]["Muted"] += 1
                 else:
                     if finding.status == "FAIL" and index not in fail_count:
@@ -289,7 +310,8 @@ def _render_split(
 
                     for sv in split_values:
                         if sv in str(split_val):
-                            if not finding.muted:
+                            if index not in group_split_seen[group_key][sv]:
+                                group_split_seen[group_key][sv].add(index)
                                 if finding.status == "FAIL":
                                     groups[group_key][sv]["FAIL"] += 1
                                 else:
@@ -364,6 +386,7 @@ def _render_scored(
     risk_field = scoring.risk_field
     weight_field = scoring.weight_field
     groups = {}
+    group_seen = {}
     pass_count = []
     fail_count = []
     muted_count = []
@@ -388,6 +411,7 @@ def _render_scored(
 
                 if group_key not in groups:
                     groups[group_key] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                    group_seen[group_key] = set()
                     score_per_group[group_key] = 0
                     max_score_per_group[group_key] = 0
                     counted_per_group[group_key] = []
@@ -398,16 +422,26 @@ def _render_scored(
                     max_score_per_group[group_key] += risk * weight
                     counted_per_group[group_key].append(index)
 
+                # Overview totals: count each finding once per framework
                 if finding.muted:
                     if index not in muted_count:
                         muted_count.append(index)
-                        groups[group_key]["Muted"] += 1
-                else:
-                    if finding.status == "FAIL" and index not in fail_count:
+                elif finding.status == "FAIL":
+                    if index not in fail_count:
                         fail_count.append(index)
-                        groups[group_key]["FAIL"] += 1
-                    elif finding.status == "PASS" and index not in pass_count:
+                elif finding.status == "PASS":
+                    if index not in pass_count:
                         pass_count.append(index)
+
+                # Per-group counts: count each finding once per group it belongs
+                # to (a finding can map to several groups via several requirements).
+                if index not in group_seen[group_key]:
+                    group_seen[group_key].add(index)
+                    if finding.muted:
+                        groups[group_key]["Muted"] += 1
+                    elif finding.status == "FAIL":
+                        groups[group_key]["FAIL"] += 1
+                    elif finding.status == "PASS":
                         groups[group_key]["PASS"] += 1
 
                 if index not in counted_generic and not finding.muted:
diff --git a/prowler/lib/outputs/finding.py b/prowler/lib/outputs/finding.py
index 950460e4e3..9f772d17c4 100644
--- a/prowler/lib/outputs/finding.py
+++ b/prowler/lib/outputs/finding.py
@@ -517,6 +517,11 @@ class Finding(BaseModel):
                     check_output, "fixed_version", ""
                 )
 
+            else:
+                # Dynamic fallback: any external/custom provider
+                provider_data = provider.get_finding_output_data(check_output)
+                output_data.update(provider_data)
+
             # check_output Unique ID
             # TODO: move this to a function
             # TODO: in Azure, GCP and K8s there are findings without resource_name
diff --git a/prowler/lib/outputs/html/html.py b/prowler/lib/outputs/html/html.py
index 33f7ef4934..545bcbc456 100644
--- a/prowler/lib/outputs/html/html.py
+++ b/prowler/lib/outputs/html/html.py
@@ -73,8 +73,7 @@ class HTML(Output):
                 elif finding.status == "FAIL":
                     row_class = "table-danger"
 
-                self._data.append(
-                    f"""
+                self._data.append(f"""
                         <tr class="{row_class}">
                             <td>{finding_status}</td>
                             <td>{finding.metadata.Severity.value}</td>
@@ -89,8 +88,7 @@ class HTML(Output):
                             <td><p class="show-read-more">{HTML.process_markdown(finding.metadata.Remediation.Recommendation.Text)}</p> <a class="read-more" href="{finding.metadata.Remediation.Recommendation.Url}"><i class="fas fa-external-link-alt"></i></a></td>
                             <td><p class="show-read-more">{parse_html_string(unroll_dict(finding.compliance, separator=": "))}</p></td>
                         </tr>
-                        """
-                )
+                        """)
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -143,8 +141,7 @@ class HTML(Output):
             from_cli (bool): whether the request is from the CLI or not
         """
         try:
-            file_descriptor.write(
-                f"""<!DOCTYPE html>
+            file_descriptor.write(f"""<!DOCTYPE html>
     <html lang="en">
     <head>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
@@ -253,8 +250,7 @@ class HTML(Output):
                     <th scope="col">Compliance</th>
                 </tr>
             </thead>
-            <tbody>"""
-            )
+            <tbody>""")
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
@@ -269,8 +265,7 @@ class HTML(Output):
             file_descriptor (file): the file descriptor to write the footer
         """
         try:
-            file_descriptor.write(
-                """
+            file_descriptor.write("""
             </tbody>
             </table>
         </div>
@@ -409,8 +404,7 @@ class HTML(Output):
 </body>
 
 </html>
-"""
-            )
+""")
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
@@ -1608,11 +1602,13 @@ class HTML(Output):
             # Azure_provider --> azure
             # Kubernetes_provider --> kubernetes
 
-            # Dynamically get the Provider quick inventory handler
-            provider_html_assessment_summary_function = (
-                f"get_{provider.type}_assessment_summary"
-            )
-            return getattr(HTML, provider_html_assessment_summary_function)(provider)
+            # Try static method first, fall back to provider method
+            method_name = f"get_{provider.type}_assessment_summary"
+            if hasattr(HTML, method_name):
+                return getattr(HTML, method_name)(provider)
+            else:
+                # Dynamic fallback: any external/custom provider
+                return provider.get_html_assessment_summary()
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
diff --git a/prowler/lib/outputs/jira/jira.py b/prowler/lib/outputs/jira/jira.py
index ed8f7faab0..9005b5274e 100644
--- a/prowler/lib/outputs/jira/jira.py
+++ b/prowler/lib/outputs/jira/jira.py
@@ -229,7 +229,9 @@ class MarkdownToADFConverter:
         return node
 
     def _paragraph_with_text(self, text: str) -> Dict:
-        return {"type": "paragraph", "content": [self._create_text_node(text, None)]}
+        # ADF forbids empty text nodes; emit an empty paragraph instead.
+        content = [self._create_text_node(text, None)] if text else []
+        return {"type": "paragraph", "content": content}
 
     @staticmethod
     def _pop_mark(marks_stack: List[Dict], mark_type: str) -> None:
@@ -339,6 +341,7 @@ class Jira:
     }
     TOKEN_URL = "https://auth.atlassian.com/oauth/token"
     API_TOKEN_URL = "https://api.atlassian.com/oauth/token/accessible-resources"
+    REQUEST_TIMEOUT = 90
     HEADER_TEMPLATE = {
         "Content-Type": "application/json",
         "X-Force-Accept-Language": "true",
@@ -576,7 +579,12 @@ class Jira:
             }
 
             headers = self.get_headers(content_type_json=True)
-            response = requests.post(self.TOKEN_URL, json=body, headers=headers)
+            response = requests.post(
+                self.TOKEN_URL,
+                json=body,
+                headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
+            )
 
             if response.status_code == 200:
                 tokens = response.json()
@@ -628,12 +636,17 @@ class Jira:
                 response = requests.get(
                     f"https://{domain}.atlassian.net/_edge/tenant_info",
                     headers=headers,
+                    timeout=self.REQUEST_TIMEOUT,
                 )
                 response = response.json()
                 return response.get("cloudId")
             else:
                 headers = self.get_headers(access_token)
-                response = requests.get(self.API_TOKEN_URL, headers=headers)
+                response = requests.get(
+                    self.API_TOKEN_URL,
+                    headers=headers,
+                    timeout=self.REQUEST_TIMEOUT,
+                )
 
             if response.status_code == 200:
                 resources = response.json()
@@ -715,7 +728,12 @@ class Jira:
             }
 
             headers = self.get_headers(content_type_json=True)
-            response = requests.post(url, json=body, headers=headers)
+            response = requests.post(
+                url,
+                json=body,
+                headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
+            )
 
             if response.status_code == 200:
                 tokens = response.json()
@@ -872,6 +890,7 @@ class Jira:
             response = requests.get(
                 f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/project",
                 headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
             )
 
             if response.status_code == 200:
@@ -939,6 +958,7 @@ class Jira:
             response = requests.get(
                 f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/issue/createmeta?projectKeys={project_key}&expand=projects.issuetypes.fields",
                 headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
             )
 
             if response.status_code == 200:
@@ -984,6 +1004,7 @@ class Jira:
             response = requests.get(
                 f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/project",
                 headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
             )
             if response.status_code == 200:
                 projects_data = {}
@@ -999,6 +1020,7 @@ class Jira:
                         project_response = requests.get(
                             f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/issue/createmeta?projectKeys={project['key']}&expand=projects.issuetypes.fields",
                             headers=headers,
+                            timeout=self.REQUEST_TIMEOUT,
                         )
                         if project_response.status_code == 200:
                             project_metadata = project_response.json()
@@ -1118,6 +1140,18 @@ class Jira:
         tenant_info: str = "",
     ) -> dict:
 
+        # ADF forbids empty text nodes, so Jira rejects them with 400 INVALID_INPUT.
+        def _safe(value: str) -> str:
+            return value if (value and value.strip()) else "-"
+
+        check_id = _safe(check_id)
+        check_title = _safe(check_title)
+        status_extended = _safe(status_extended)
+        provider = _safe(provider)
+        region = _safe(region)
+        resource_uid = _safe(resource_uid)
+        resource_name = _safe(resource_name)
+
         table_rows = [
             {
                 "type": "tableRow",
@@ -1909,6 +1943,7 @@ class Jira:
                     f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/issue",
                     json=payload,
                     headers=headers,
+                    timeout=self.REQUEST_TIMEOUT,
                 )
 
                 if response.status_code != 201:
@@ -2113,6 +2148,7 @@ class Jira:
                 f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/issue",
                 json=payload,
                 headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
             )
 
             if response.status_code != 201:
diff --git a/prowler/lib/outputs/ocsf/ocsf.py b/prowler/lib/outputs/ocsf/ocsf.py
index 731d029284..53f27d0e1b 100644
--- a/prowler/lib/outputs/ocsf/ocsf.py
+++ b/prowler/lib/outputs/ocsf/ocsf.py
@@ -227,6 +227,10 @@ class OCSF(Output):
                             json_output = finding.json(exclude_none=True, indent=4)
                         self._file_descriptor.write(json_output)
                         self._file_descriptor.write(",")
+                    except OSError:
+                        # I/O errors (e.g. ENOSPC) are not recoverable per finding:
+                        # fail fast instead of logging once per finding.
+                        raise
                     except Exception as error:
                         logger.error(
                             f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -239,6 +243,10 @@ class OCSF(Output):
                     self._file_descriptor.truncate()
                     self._file_descriptor.write("]")
                     self._file_descriptor.close()
+        except OSError:
+            # Propagate unrecoverable I/O errors (e.g. ENOSPC) so the caller can
+            # fail fast instead of producing a corrupt output file.
+            raise
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
diff --git a/prowler/lib/outputs/outputs.py b/prowler/lib/outputs/outputs.py
index e4d935e3cf..a1f37a9dfc 100644
--- a/prowler/lib/outputs/outputs.py
+++ b/prowler/lib/outputs/outputs.py
@@ -7,45 +7,52 @@ from prowler.lib.outputs.common import Status
 from prowler.lib.outputs.finding import Finding
 
 
-def stdout_report(finding, color, verbose, status, fix):
+def stdout_report(finding, color, verbose, status, fix, provider=None):
     if finding.check_metadata.Provider == "aws":
         details = finding.region
-    if finding.check_metadata.Provider == "azure":
+    elif finding.check_metadata.Provider == "azure":
         details = finding.location
-    if finding.check_metadata.Provider == "gcp":
+    elif finding.check_metadata.Provider == "gcp":
         details = finding.location.lower()
-    if finding.check_metadata.Provider == "kubernetes":
+    elif finding.check_metadata.Provider == "kubernetes":
         details = finding.namespace.lower()
-    if finding.check_metadata.Provider == "github":
+    elif finding.check_metadata.Provider == "github":
         details = finding.owner
-    if finding.check_metadata.Provider == "m365":
+    elif finding.check_metadata.Provider == "m365":
         details = finding.location
-    if finding.check_metadata.Provider == "mongodbatlas":
+    elif finding.check_metadata.Provider == "mongodbatlas":
         details = finding.location
-    if finding.check_metadata.Provider == "nhn":
+    elif finding.check_metadata.Provider == "nhn":
         details = finding.location
-    if finding.check_metadata.Provider == "stackit":
+    elif finding.check_metadata.Provider == "stackit":
         details = finding.location
-    if finding.check_metadata.Provider == "llm":
+    elif finding.check_metadata.Provider == "llm":
         details = finding.check_metadata.CheckID
-    if finding.check_metadata.Provider == "iac":
+    elif finding.check_metadata.Provider == "iac":
         details = finding.check_metadata.CheckID
-    if finding.check_metadata.Provider == "oraclecloud":
+    elif finding.check_metadata.Provider == "oraclecloud":
         details = finding.region
-    if finding.check_metadata.Provider == "alibabacloud":
+    elif finding.check_metadata.Provider == "alibabacloud":
         details = finding.region
-    if finding.check_metadata.Provider == "openstack":
+    elif finding.check_metadata.Provider == "openstack":
         details = finding.region
-    if finding.check_metadata.Provider == "cloudflare":
+    elif finding.check_metadata.Provider == "cloudflare":
         details = finding.zone_name
-    if finding.check_metadata.Provider == "googleworkspace":
+    elif finding.check_metadata.Provider == "googleworkspace":
         details = finding.location
-    if finding.check_metadata.Provider == "vercel":
+    elif finding.check_metadata.Provider == "vercel":
         details = finding.region
-    if finding.check_metadata.Provider == "okta":
+    elif finding.check_metadata.Provider == "okta":
         details = finding.region
-    if finding.check_metadata.Provider == "scaleway":
+    elif finding.check_metadata.Provider == "scaleway":
         details = finding.region
+    else:
+        # Dynamic fallback: any external/custom provider
+        if provider is None:
+            from prowler.providers.common.provider import Provider
+
+            provider = Provider.get_global_provider()
+        details = provider.get_stdout_detail(finding)
 
     if (verbose or fix) and (not status or finding.status in status):
         if finding.muted:
@@ -65,12 +72,15 @@ def report(check_findings, provider, output_options):
         if hasattr(output_options, "verbose"):
             verbose = output_options.verbose
         if check_findings:
-            # TO-DO Generic Function
             if provider.type == "aws":
                 check_findings.sort(key=lambda x: x.region)
-
-            if provider.type == "azure":
+            elif provider.type == "azure":
                 check_findings.sort(key=lambda x: x.subscription)
+            else:
+                # Dynamic fallback: any external/custom provider
+                sort_key = provider.get_finding_sort_key()
+                if sort_key and isinstance(sort_key, str):
+                    check_findings.sort(key=lambda x: getattr(x, sort_key, ""))
 
             for finding in check_findings:
                 # Print findings by stdout
@@ -81,12 +91,16 @@ def report(check_findings, provider, output_options):
                 if hasattr(output_options, "fixer"):
                     fixer = output_options.fixer
                 color = set_report_color(finding.status, finding.muted)
+                # Pass the local `provider` through so the dynamic else inside
+                # `stdout_report` does not have to consult the global singleton
+                # — defeating the whole purpose of the new parameter.
                 stdout_report(
                     finding,
                     color,
                     verbose,
                     status,
                     fixer,
+                    provider=provider,
                 )
 
         else:  # No service resources in the whole account
diff --git a/prowler/lib/outputs/summary_table.py b/prowler/lib/outputs/summary_table.py
index e76728ccc8..43d4a547c1 100644
--- a/prowler/lib/outputs/summary_table.py
+++ b/prowler/lib/outputs/summary_table.py
@@ -121,6 +121,9 @@ def display_summary_table(
         elif provider.type == "scaleway":
             entity_type = "Organization"
             audited_entities = provider.identity.organization_id
+        else:
+            # Dynamic fallback: any external/custom provider
+            entity_type, audited_entities = provider.get_summary_entity()
 
         # Check if there are findings and that they are not all MANUAL
         if findings and not all(finding.status == "MANUAL" for finding in findings):
diff --git a/prowler/lib/scan/scan.py b/prowler/lib/scan/scan.py
index 2ce7263e2b..4bef660d33 100644
--- a/prowler/lib/scan/scan.py
+++ b/prowler/lib/scan/scan.py
@@ -4,8 +4,8 @@ from types import SimpleNamespace
 from typing import Generator
 
 from prowler.lib.check.check import (
+    _resolve_check_module,
     execute,
-    import_check,
     list_services,
     update_audit_metadata,
 )
@@ -426,9 +426,14 @@ class Scan:
                     # Recover service from check name
                     service = get_service_name_from_check_name(check_name)
                     try:
-                        # Import check module
-                        check_module_path = f"prowler.providers.{self._provider.type}.services.{service}.{check_name}.{check_name}"
-                        lib = import_check(check_module_path)
+                        # Import check module (built-in or entry point) —
+                        # delegates to `_resolve_check_module` so external
+                        # providers registered via entry points are resolved
+                        # correctly (their checks do not live under
+                        # `prowler.providers.{type}.services...`).
+                        lib = _resolve_check_module(
+                            self._provider.type, service, check_name
+                        )
                         # Recover functions from check
                         check_to_execute = getattr(lib, check_name)
                         check = check_to_execute()
diff --git a/prowler/providers/aws/aws_regions_by_service.json b/prowler/providers/aws/aws_regions_by_service.json
index 2e451910fb..0874d14a07 100644
--- a/prowler/providers/aws/aws_regions_by_service.json
+++ b/prowler/providers/aws/aws_regions_by_service.json
@@ -2582,6 +2582,7 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
+          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
@@ -2591,6 +2592,9 @@
           "ap-southeast-2",
           "ap-southeast-3",
           "ap-southeast-4",
+          "ap-southeast-5",
+          "ap-southeast-6",
+          "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
           "eu-central-1",
@@ -2604,6 +2608,7 @@
           "il-central-1",
           "me-central-1",
           "me-south-1",
+          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -7344,6 +7349,7 @@
     "lightsail": {
       "regions": {
         "aws": [
+          "ap-east-1",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-south-1",
@@ -7354,9 +7360,11 @@
           "ca-central-1",
           "eu-central-1",
           "eu-north-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
+          "sa-east-1",
           "us-east-1",
           "us-east-2",
           "us-west-2"
@@ -8269,7 +8277,9 @@
           "cn-north-1",
           "cn-northwest-1"
         ],
-        "aws-eusc": [],
+        "aws-eusc": [
+          "eusc-de-east-1"
+        ],
         "aws-us-gov": [
           "us-gov-east-1",
           "us-gov-west-1"
@@ -9220,6 +9230,7 @@
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
+          "sa-east-1",
           "us-east-1",
           "us-east-2",
           "us-west-2"
@@ -9986,6 +9997,8 @@
           "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
+          "ap-southeast-5",
+          "ap-southeast-7",
           "ca-central-1",
           "eu-central-1",
           "eu-south-2",
diff --git a/prowler/providers/aws/lib/ip_ranges/__init__.py b/prowler/providers/aws/lib/ip_ranges/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/lib/ip_ranges/ip_ranges.py b/prowler/providers/aws/lib/ip_ranges/ip_ranges.py
new file mode 100644
index 0000000000..3dbb9d1b17
--- /dev/null
+++ b/prowler/providers/aws/lib/ip_ranges/ip_ranges.py
@@ -0,0 +1,51 @@
+import json
+import urllib.error
+import urllib.request
+from ipaddress import ip_network
+
+from prowler.lib.logger import logger
+
+AWS_IP_RANGES_URL = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+AWS_IP_RANGES_TIMEOUT = 10
+
+
+def get_public_ip_networks() -> list:
+    """Fetch the AWS public IP prefixes as a list of ip_network objects.
+
+    The request verifies the server certificate against the system trust store,
+    matching urllib's default behaviour. This replaces the unmaintained
+    awsipranges package, whose latest release (0.3.3) calls
+    urllib.request.urlopen() with the cafile/capath arguments that Python 3.13
+    removed.
+
+    Returns an empty list when the feed cannot be fetched or parsed, and skips
+    individual malformed prefixes, so a transient or corrupt feed never aborts
+    the calling check.
+    """
+    try:
+        with urllib.request.urlopen(
+            AWS_IP_RANGES_URL, timeout=AWS_IP_RANGES_TIMEOUT
+        ) as response:
+            ranges = json.loads(response.read())
+    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as error:
+        logger.error(
+            f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+        )
+        return []
+
+    networks = []
+    for key, prefixes in (
+        ("ip_prefix", ranges.get("prefixes", [])),
+        ("ipv6_prefix", ranges.get("ipv6_prefixes", [])),
+    ):
+        for prefix in prefixes:
+            cidr = prefix.get(key)
+            if not cidr:
+                continue
+            try:
+                networks.append(ip_network(cidr))
+            except ValueError as error:
+                logger.warning(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+    return networks
diff --git a/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/__init__.py b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.metadata.json
new file mode 100644
index 0000000000..7625b6a626
--- /dev/null
+++ b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.metadata.json
@@ -0,0 +1,41 @@
+{
+  "Provider": "aws",
+  "CheckID": "bedrock_agent_role_least_privilege",
+  "CheckTitle": "Amazon Bedrock agent execution role follows least privilege",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis",
+    "TTPs/Privilege Escalation"
+  ],
+  "ServiceName": "bedrock",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Other",
+  "ResourceGroup": "ai_ml",
+  "Description": "**Bedrock Agent** execution roles (`agentResourceRoleArn`) should grant only the minimum permissions the agent needs. The evaluation FAILs when the role has an AWS-managed `*FullAccess` policy attached, has an inline statement allowing broad actions on `Resource: \"*\"`, or has no permissions boundary configured.",
+  "Risk": "An overly permissive **Bedrock Agent** execution role turns a successful **prompt injection** into AWS privilege escalation. A model coerced into calling tools can invoke any API the role allows — reading secrets, modifying IAM, exfiltrating data from S3, or pivoting laterally. **Least privilege** plus a **permissions boundary** keeps the blast radius bounded even when guardrails fail.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws iam put-role-permissions-boundary --role-name <execution_role_name> --permissions-boundary <boundary_policy_arn>",
+      "NativeIaC": "",
+      "Other": "1. Identify the Bedrock Agent's execution role (agentResourceRoleArn) in the IAM console\n2. Detach any AWS-managed *FullAccess policies (e.g. AmazonBedrockFullAccess, AdministratorAccess)\n3. Replace inline policies that use Resource: \"*\" with statements scoped to specific resource ARNs and minimal action sets\n4. Attach a permissions boundary that caps what the role can ever do, even if a future policy is added\n5. Re-run Prowler to confirm the check passes",
+      "Terraform": "```hcl\nresource \"aws_iam_role\" \"bedrock_agent\" {\n  name                 = \"<execution_role_name>\"\n  assume_role_policy   = data.aws_iam_policy_document.trust.json\n  permissions_boundary = aws_iam_policy.bedrock_agent_boundary.arn  # CRITICAL: caps maximum privileges\n}\n\nresource \"aws_iam_role_policy\" \"bedrock_agent_inline\" {\n  role   = aws_iam_role.bedrock_agent.name\n  policy = jsonencode({\n    Version = \"2012-10-17\",\n    Statement = [{\n      Effect   = \"Allow\",\n      Action   = [\"s3:GetObject\"],            # CRITICAL: narrow action\n      Resource = [\"arn:aws:s3:::my-rag-bucket/*\"]  # CRITICAL: narrow resource\n    }]\n  })\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Apply **least privilege** to every Bedrock Agent execution role: scope `Action` and `Resource` to exactly what the agent needs, avoid AWS-managed `*FullAccess` policies, and always attach a **permissions boundary** so that future policy edits cannot exceed an approved ceiling. Treat agent roles as high-risk because prompt injection can weaponize any granted permission.",
+      "Url": "https://hub.prowler.com/check/bedrock_agent_role_least_privilege"
+    }
+  },
+  "Categories": [
+    "gen-ai"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.py b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.py
new file mode 100644
index 0000000000..e53183d90f
--- /dev/null
+++ b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.py
@@ -0,0 +1,101 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.bedrock.bedrock_agent_client import (
+    bedrock_agent_client,
+)
+from prowler.providers.aws.services.iam.iam_client import iam_client
+from prowler.providers.aws.services.iam.lib.policy import check_admin_access
+from prowler.providers.aws.services.iam.lib.privilege_escalation import (
+    check_privilege_escalation,
+)
+
+
+class bedrock_agent_role_least_privilege(Check):
+    """Ensure Bedrock Agent execution roles follow least privilege.
+
+    A Bedrock Agent's execution role is evaluated against three criteria:
+    - No AWS-managed ``*FullAccess`` policy attached.
+    - No attached or inline policy granting administrative access or known
+      privilege escalation combinations.
+    - A permissions boundary is configured on the role.
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Run the least-privilege evaluation across all Bedrock Agents.
+
+        Returns:
+            A list of ``Check_Report_AWS`` with one entry per agent. The
+            status is ``FAIL`` when any of the criteria above is violated,
+            or when the execution role cannot be resolved in IAM.
+        """
+        findings = []
+        roles_by_arn = {role.arn: role for role in (iam_client.roles or [])}
+
+        for agent in bedrock_agent_client.agents.values():
+            report = Check_Report_AWS(metadata=self.metadata(), resource=agent)
+            report.status = "PASS"
+            report.status_extended = (
+                f"Bedrock Agent {agent.name} execution role follows least privilege."
+            )
+
+            role = roles_by_arn.get(agent.role_arn) if agent.role_arn else None
+            if role is None:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Bedrock Agent {agent.name} execution role could not be "
+                    f"resolved in IAM and cannot be evaluated for least privilege."
+                )
+                findings.append(report)
+                continue
+
+            violations = []
+
+            for policy in role.attached_policies:
+                policy_arn = policy.get("PolicyArn", "")
+                policy_name = policy.get("PolicyName") or policy_arn
+                if policy_arn.startswith(
+                    "arn:aws:iam::aws:policy/"
+                ) and policy_arn.endswith("FullAccess"):
+                    violations.append(
+                        f"managed policy {policy_name} grants full access"
+                    )
+                    continue
+                policy_obj = iam_client.policies.get(policy_arn)
+                if policy_obj is None or not policy_obj.document:
+                    continue
+                document = policy_obj.document
+                if check_admin_access(document):
+                    violations.append(
+                        f"managed policy {policy_name} grants administrative access"
+                    )
+                elif check_privilege_escalation(document):
+                    violations.append(
+                        f"managed policy {policy_name} allows privilege escalation"
+                    )
+
+            for inline_name in role.inline_policies:
+                policy_obj = iam_client.policies.get(f"{role.arn}:policy/{inline_name}")
+                if policy_obj is None or not policy_obj.document:
+                    continue
+                document = policy_obj.document
+                if check_admin_access(document):
+                    violations.append(
+                        f"inline policy {inline_name} grants administrative access"
+                    )
+                elif check_privilege_escalation(document):
+                    violations.append(
+                        f"inline policy {inline_name} allows privilege escalation"
+                    )
+
+            if not role.permissions_boundary:
+                violations.append("no permissions boundary configured")
+
+            if violations:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Bedrock Agent {agent.name} execution role violates least "
+                    f"privilege: {'; '.join(violations)}."
+                )
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json
index f9b8ee0df9..c85279e4a4 100644
--- a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json
+++ b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json
@@ -1,7 +1,7 @@
 {
   "Provider": "aws",
   "CheckID": "bedrock_api_key_no_long_term_credentials",
-  "CheckTitle": "Amazon Bedrock API key is expired",
+  "CheckTitle": "Amazon Bedrock long-term API key has expired",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
     "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
@@ -14,23 +14,24 @@
   "Severity": "high",
   "ResourceType": "AwsIamUser",
   "ResourceGroup": "IAM",
-  "Description": "**Bedrock API keys** are evaluated for **lifetime** and **expiration**.\n\nThe finding identifies keys that are long-lived, set to expire far in the future, or configured to `never expire`, and distinguishes them from keys that have already expired.",
-  "Risk": "Long-lived or non-expiring keys enable persistent access if compromised.\n- Confidentiality: unauthorized inference and exposure of prompts/outputs\n- Availability/Cost: uncontrolled usage and spend spikes\n- Integrity: actions can continue without timely revocation or rotation",
+  "Description": "AWS recommends Amazon Bedrock **long-term API keys** only for **exploration**; production workloads should use **short-term API keys** (session-scoped, valid up to **12 hours**). This check fails for any active long-term Bedrock API key, escalating to `critical` severity when configured to **never expire**. Already-expired keys pass — they can no longer authenticate.",
+  "Risk": "Long-term Bedrock API keys persist beyond a session until their stored expiration, and keys set to **never expire** grant indefinite access until manually revoked, enabling unauthorized inference, uncontrolled usage and spend, and activity that continues past timely revocation.",
   "RelatedUrl": "",
   "AdditionalURLs": [
-    "https://docs.aws.amazon.com/ja_jp/bedrock/latest/userguide/getting-started-api-keys.html",
-    "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials",
-    "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html"
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html",
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-generate.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds-programmatic-access.html#security-creds-alternatives-to-long-term-access-keys",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials"
   ],
   "Remediation": {
     "Code": {
       "CLI": "aws iam delete-service-specific-credential --user-name <username> --service-specific-credential-id <credential-id>",
       "NativeIaC": "",
-      "Other": "1. Sign in to the AWS Management Console and open IAM\n2. Go to Users > select <example_resource_name> > Security credentials\n3. In \"API keys for Amazon Bedrock\", find the non-expired key and click Delete\n4. Confirm deletion to remove the key (removes the long-term credential so the check passes)",
+      "Other": "1. Sign in to the AWS Management Console and open IAM\n2. Go to Users > select the IAM user backing the Bedrock API key > Security credentials\n3. In \"API keys for Amazon Bedrock\", select the active long-term key and click Delete\n4. For workloads that still need Bedrock access, generate a short-term API key from the Bedrock console (Short-term API keys tab), or call the Bedrock API with short-term credentials issued by AWS STS",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Prefer **short-term credentials** and **IAM roles**; avoid `never expire`.\n\nEnforce **least privilege**, strict **rotation**, and automatic **expiration** for any long-term key. Store secrets securely, monitor with audit logs, and revoke unused or stale keys quickly.",
+      "Text": "Use short-term Amazon Bedrock API keys for any non-exploratory workload — they are bound to the IAM principal's session, valid for at most 12 hours, scoped to a single Region, and can be auto-refreshed by the SDK. For existing long-term keys, delete the underlying IAM service-specific credential. If a long-term key must be retained for an exploration scenario, set an explicit short expiration and never select `never expire`.",
       "Url": "https://hub.prowler.com/check/bedrock_api_key_no_long_term_credentials"
     }
   },
@@ -40,5 +41,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": "This check verifies that Amazon Bedrock API keys have expiration dates set. API keys without expiration dates are considered long-term credentials and pose a security risk. The check follows security best practices for credential management and the principle of least privilege."
+  "Notes": "AWS recommends against using long-term Amazon Bedrock API keys outside of exploration; production workloads should use short-term API keys (session-scoped, valid up to 12 hours). The IAM `ListServiceSpecificCredentials` API only enumerates long-term keys — short-term keys are session-scoped credentials that never appear here. The check therefore passes only when an existing long-term key has already expired and can no longer authenticate; any active long-term key fails, with critical severity when it is configured to never expire."
 }
diff --git a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.py b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.py
index 2edffd7ccb..9697ecbff0 100644
--- a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.py
+++ b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.py
@@ -1,49 +1,62 @@
 from datetime import datetime, timezone
 
-from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.check.models import Check, Check_Report_AWS, Severity
 from prowler.providers.aws.services.iam.iam_client import iam_client
 
+# Days threshold above which a Bedrock long-term API key is considered effectively non-expiring.
+NEVER_EXPIRES_THRESHOLD_DAYS = 10000
+
 
 class bedrock_api_key_no_long_term_credentials(Check):
-    """
-    Bedrock API keys should be short-lived to reduce the risk of unauthorized access.
-    This check verifies if there are any long-term Bedrock API keys.
-    If there are, it checks if they are expired or will be expired.
-    If they are expired, it will be marked as PASS.
-    If they are not expired, it will be marked as FAIL and the severity will be critical if the key will never expire.
+    """Amazon Bedrock long-term API keys should not be used outside of exploration.
+
+    AWS recommends short-term Bedrock API keys (session-scoped, valid up to 12 hours)
+    for any non-exploratory workload. ``ListServiceSpecificCredentials`` only enumerates
+    long-term keys, so every key inspected here is by definition a long-term credential.
+
+    PASS when the long-term key has already expired (it can no longer authenticate).
+    FAIL (critical) when the key is configured to never expire.
+    FAIL (high) for any other active long-term key.
     """
 
     def execute(self):
-        """
-        Execute the Bedrock API key no long-term credentials check.
-
-        Iterate over all the Bedrock API keys and check if they are expired or will be expired.
-
-        Returns:
-            List[Check_Report_AWS]: A list of report objects with the results of the check.
-        """
-
         findings = []
         for api_key in iam_client.service_specific_credentials:
             if api_key.service_name != "bedrock.amazonaws.com":
                 continue
-            if api_key.expiration_date:
-                report = Check_Report_AWS(metadata=self.metadata(), resource=api_key)
-                # Check if the expiration date is in the future
-                if api_key.expiration_date > datetime.now(timezone.utc):
-                    report.status = "FAIL"
-                    # Get the days until the expiration date
-                    days_until_expiration = (
-                        api_key.expiration_date - datetime.now(timezone.utc)
-                    ).days
-                    if days_until_expiration > 10000:
-                        self.Severity = "critical"
-                        report.status_extended = f"Long-term Bedrock API key {api_key.id} in user {api_key.user.name} exists and never expires."
-                    else:
-                        report.status_extended = f"Long-term Bedrock API key {api_key.id} in user {api_key.user.name} exists and will expire in {days_until_expiration} days."
-                else:
-                    report.status = "PASS"
-                    report.status_extended = f"Long-term Bedrock API key {api_key.id} in user {api_key.user.name} exists but has expired."
-                findings.append(report)
+            if not api_key.expiration_date:
+                continue
+
+            report = Check_Report_AWS(metadata=self.metadata(), resource=api_key)
+            now = datetime.now(timezone.utc)
+
+            if api_key.expiration_date <= now:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Bedrock long-term API key {api_key.id} in user "
+                    f"{api_key.user.name} has already expired and can no longer "
+                    f"authenticate."
+                )
+            elif (api_key.expiration_date - now).days > NEVER_EXPIRES_THRESHOLD_DAYS:
+                report.status = "FAIL"
+                report.check_metadata.Severity = Severity.critical
+                report.status_extended = (
+                    f"Bedrock long-term API key {api_key.id} in user "
+                    f"{api_key.user.name} is configured to never expire. Use "
+                    f"short-term Bedrock API keys (session-scoped, valid up to "
+                    f"12 hours) for non-exploratory workloads instead."
+                )
+            else:
+                days_until_expiration = (api_key.expiration_date - now).days
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Bedrock long-term API key {api_key.id} in user "
+                    f"{api_key.user.name} is active and will expire in "
+                    f"{days_until_expiration} days. Use short-term Bedrock API "
+                    f"keys (session-scoped, valid up to 12 hours) for "
+                    f"non-exploratory workloads instead."
+                )
+
+            findings.append(report)
 
         return findings
diff --git a/prowler/providers/aws/services/bedrock/bedrock_service.py b/prowler/providers/aws/services/bedrock/bedrock_service.py
index 7222456341..aead63a67f 100644
--- a/prowler/providers/aws/services/bedrock/bedrock_service.py
+++ b/prowler/providers/aws/services/bedrock/bedrock_service.py
@@ -146,6 +146,7 @@ class BedrockAgent(AWSService):
         self.prompts = {}
         self.prompt_scanned_regions: set = set()
         self.__threading_call__(self._list_agents)
+        self.__threading_call__(self._get_agent, self.agents.values())
         self.__threading_call__(self._list_prompts)
         self.__threading_call__(self._get_prompt, self.prompts.values())
         self.__threading_call__(self._list_tags_for_resource, self.agents.values())
@@ -174,6 +175,22 @@ class BedrockAgent(AWSService):
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _get_agent(self, agent):
+        """Fetch full agent details to capture the execution role ARN.
+
+        list_agents only returns summaries (no agentResourceRoleArn), so we
+        need a per-agent GetAgent call. Stored on the Agent model for use by
+        checks like bedrock_agent_role_least_privilege.
+        """
+        logger.info("Bedrock Agent - Getting Agent...")
+        try:
+            agent_info = self.regional_clients[agent.region].get_agent(agentId=agent.id)
+            agent.role_arn = agent_info.get("agent", {}).get("agentResourceRoleArn")
+        except Exception as error:
+            logger.error(
+                f"{agent.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
     def _list_prompts(self, regional_client):
         """List all prompts in a region."""
         logger.info("Bedrock Agent - Listing Prompts...")
@@ -236,6 +253,7 @@ class Agent(BaseModel):
     name: str
     arn: str
     guardrail_id: Optional[str] = None
+    role_arn: Optional[str] = None
     region: str
     tags: Optional[list] = []
 
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json
index 20ed5f0adb..9070c7b0c7 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json
@@ -17,9 +17,8 @@
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
-    "https://www.clouddefense.ai/compliance-rules/cis-v130/monitoring/cis-v130-4-11",
     "https://support.icompaas.com/support/solutions/articles/62000084031-ensure-a-log-metric-filter-and-alarm-exist-for-changes-to-network-access-control-lists-nacl-",
-    "https://trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudWatchLogs/network-acl-changes-alarm.html",
+    "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudWatchLogs/network-acl-changes-alarm.html",
     "https://support.icompaas.com/support/solutions/articles/62000233134-4-11-ensure-network-access-control-list-nacl-changes-are-monitored-manual-"
   ],
   "Remediation": {
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.py
index 20d68a0121..68f45a8d27 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,16 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_changes_to_network_acls_alarm_configured(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?CreateNetworkAcl.+\$\.eventName\s*=\s*.?CreateNetworkAclEntry.+\$\.eventName\s*=\s*.?DeleteNetworkAcl.+\$\.eventName\s*=\s*.?DeleteNetworkAclEntry.+\$\.eventName\s*=\s*.?ReplaceNetworkAclEntry.+\$\.eventName\s*=\s*.?ReplaceNetworkAclAssociation.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "CreateNetworkAcl",
+                "CreateNetworkAclEntry",
+                "DeleteNetworkAcl",
+                "DeleteNetworkAclEntry",
+                "ReplaceNetworkAclEntry",
+                "ReplaceNetworkAclAssociation",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured.py
index 5f6eda3973..f7bf8e1d22 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,16 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_changes_to_network_gateways_alarm_configured(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?CreateCustomerGateway.+\$\.eventName\s*=\s*.?DeleteCustomerGateway.+\$\.eventName\s*=\s*.?AttachInternetGateway.+\$\.eventName\s*=\s*.?CreateInternetGateway.+\$\.eventName\s*=\s*.?DeleteInternetGateway.+\$\.eventName\s*=\s*.?DetachInternetGateway.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "CreateCustomerGateway",
+                "DeleteCustomerGateway",
+                "AttachInternetGateway",
+                "CreateInternetGateway",
+                "DeleteInternetGateway",
+                "DetachInternetGateway",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.metadata.json
index 82490a63da..89949cfbd6 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.metadata.json
@@ -37,5 +37,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": ""
+  "Notes": "Logging and Monitoring"
 }
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.py
index f8fcc8eacb..460765cb2f 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,18 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_changes_to_network_route_tables_alarm_configured(Check):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?ec2.amazonaws.com.+\$\.eventName\s*=\s*.?CreateRoute.+\$\.eventName\s*=\s*.?CreateRouteTable.+\$\.eventName\s*=\s*.?ReplaceRoute.+\$\.eventName\s*=\s*.?ReplaceRouteTableAssociation.+\$\.eventName\s*=\s*.?DeleteRouteTable.+\$\.eventName\s*=\s*.?DeleteRoute.+\$\.eventName\s*=\s*.?DisassociateRouteTable.?"
+        pattern = build_metric_filter_pattern(
+            event_source="ec2.amazonaws.com",
+            event_names=[
+                "CreateRoute",
+                "CreateRouteTable",
+                "ReplaceRoute",
+                "ReplaceRouteTableAssociation",
+                "DeleteRouteTable",
+                "DeleteRoute",
+                "DisassociateRouteTable",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured.py
index d7606647c4..be4fb0859d 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,21 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_changes_to_vpcs_alarm_configured(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?CreateVpc.+\$\.eventName\s*=\s*.?DeleteVpc.+\$\.eventName\s*=\s*.?ModifyVpcAttribute.+\$\.eventName\s*=\s*.?AcceptVpcPeeringConnection.+\$\.eventName\s*=\s*.?CreateVpcPeeringConnection.+\$\.eventName\s*=\s*.?DeleteVpcPeeringConnection.+\$\.eventName\s*=\s*.?RejectVpcPeeringConnection.+\$\.eventName\s*=\s*.?AttachClassicLinkVpc.+\$\.eventName\s*=\s*.?DetachClassicLinkVpc.+\$\.eventName\s*=\s*.?DisableVpcClassicLink.+\$\.eventName\s*=\s*.?EnableVpcClassicLink.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "CreateVpc",
+                "DeleteVpc",
+                "ModifyVpcAttribute",
+                "AcceptVpcPeeringConnection",
+                "CreateVpcPeeringConnection",
+                "DeleteVpcPeeringConnection",
+                "RejectVpcPeeringConnection",
+                "AttachClassicLinkVpc",
+                "DetachClassicLinkVpc",
+                "DisableVpcClassicLink",
+                "EnableVpcClassicLink",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.py
index 11bf08d99d..49bf9a03a3 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -15,7 +16,15 @@ class cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_change
     Check
 ):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?config.amazonaws.com.+\$\.eventName\s*=\s*.?StopConfigurationRecorder.+\$\.eventName\s*=\s*.?DeleteDeliveryChannel.+\$\.eventName\s*=\s*.?PutDeliveryChannel.+\$\.eventName\s*=\s*.?PutConfigurationRecorder.?"
+        pattern = build_metric_filter_pattern(
+            event_source="config.amazonaws.com",
+            event_names=[
+                "StopConfigurationRecorder",
+                "DeleteDeliveryChannel",
+                "PutDeliveryChannel",
+                "PutConfigurationRecorder",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.py
index eb272ecfb1..e9567315f4 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -15,7 +16,15 @@ class cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_change
     Check
 ):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?CreateTrail.+\$\.eventName\s*=\s*.?UpdateTrail.+\$\.eventName\s*=\s*.?DeleteTrail.+\$\.eventName\s*=\s*.?StartLogging.+\$\.eventName\s*=\s*.?StopLogging.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "CreateTrail",
+                "UpdateTrail",
+                "DeleteTrail",
+                "StartLogging",
+                "StopLogging",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures.py
index c217cbbaf6..1b2e5173bb 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,10 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_authentication_failures(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?ConsoleLogin.+\$\.errorMessage\s*=\s*.?Failed authentication.?"
+        pattern = build_metric_filter_pattern(
+            event_names=["ConsoleLogin"],
+            extra_clauses=[("errorMessage", "=", "Failed authentication")],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes.py
index af7ec82119..9976a885bb 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,32 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_aws_organizations_changes(Check):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?organizations\.amazonaws\.com.+\$\.eventName\s*=\s*.?AcceptHandshake.+\$\.eventName\s*=\s*.?AttachPolicy.+\$\.eventName\s*=\s*.?CancelHandshake.+\$\.eventName\s*=\s*.?CreateAccount.+\$\.eventName\s*=\s*.?CreateOrganization.+\$\.eventName\s*=\s*.?CreateOrganizationalUnit.+\$\.eventName\s*=\s*.?CreatePolicy.+\$\.eventName\s*=\s*.?DeclineHandshake.+\$\.eventName\s*=\s*.?DeleteOrganization.+\$\.eventName\s*=\s*.?DeleteOrganizationalUnit.+\$\.eventName\s*=\s*.?DeletePolicy.+\$\.eventName\s*=\s*.?EnableAllFeatures.+\$\.eventName\s*=\s*.?EnablePolicyType.+\$\.eventName\s*=\s*.?InviteAccountToOrganization.+\$\.eventName\s*=\s*.?LeaveOrganization.+\$\.eventName\s*=\s*.?DetachPolicy.+\$\.eventName\s*=\s*.?DisablePolicyType.+\$\.eventName\s*=\s*.?MoveAccount.+\$\.eventName\s*=\s*.?RemoveAccountFromOrganization.+\$\.eventName\s*=\s*.?UpdateOrganizationalUnit.+\$\.eventName\s*=\s*.?UpdatePolicy.?"
+        pattern = build_metric_filter_pattern(
+            event_source="organizations.amazonaws.com",
+            event_names=[
+                "AcceptHandshake",
+                "AttachPolicy",
+                "CancelHandshake",
+                "CreateAccount",
+                "CreateOrganization",
+                "CreateOrganizationalUnit",
+                "CreatePolicy",
+                "DeclineHandshake",
+                "DeleteOrganization",
+                "DeleteOrganizationalUnit",
+                "DeletePolicy",
+                "EnableAllFeatures",
+                "EnablePolicyType",
+                "InviteAccountToOrganization",
+                "LeaveOrganization",
+                "DetachPolicy",
+                "DisablePolicyType",
+                "MoveAccount",
+                "RemoveAccountFromOrganization",
+                "UpdateOrganizationalUnit",
+                "UpdatePolicy",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.py
index 4cfed985f7..20d1d62a5a 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,10 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk(Check):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?kms.amazonaws.com.+\$\.eventName\s*=\s*.?DisableKey.+\$\.eventName\s*=\s*.?ScheduleKeyDeletion.?"
+        pattern = build_metric_filter_pattern(
+            event_source="kms.amazonaws.com",
+            event_names=["DisableKey", "ScheduleKeyDeletion"],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.metadata.json
index 2d77c42704..6292de6071 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.metadata.json
@@ -17,8 +17,7 @@
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
-    "https://support.icompaas.com/support/solutions/articles/62000086674-ensure-a-log-metric-filter-and-alarm-exist-for-s3-bucket-policy-changes",
-    "https://www.tenable.com/audits/items/CIS_Amazon_Web_Services_Foundations_v5.0.0_L1.audit:8101350d6907e07863ac6748689b3e12"
+    "https://support.icompaas.com/support/solutions/articles/62000086674-ensure-a-log-metric-filter-and-alarm-exist-for-s3-bucket-policy-changes"
   ],
   "Remediation": {
     "Code": {
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.py
index 45d09b3528..d5fe1ef994 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,20 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_for_s3_bucket_policy_changes(Check):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?s3.amazonaws.com.+\$\.eventName\s*=\s*.?PutBucketAcl.+\$\.eventName\s*=\s*.?PutBucketPolicy.+\$\.eventName\s*=\s*.?PutBucketCors.+\$\.eventName\s*=\s*.?PutBucketLifecycle.+\$\.eventName\s*=\s*.?PutBucketReplication.+\$\.eventName\s*=\s*.?DeleteBucketPolicy.+\$\.eventName\s*=\s*.?DeleteBucketCors.+\$\.eventName\s*=\s*.?DeleteBucketLifecycle.+\$\.eventName\s*=\s*.?DeleteBucketReplication.?"
+        pattern = build_metric_filter_pattern(
+            event_source="s3.amazonaws.com",
+            event_names=[
+                "PutBucketAcl",
+                "PutBucketPolicy",
+                "PutBucketCors",
+                "PutBucketLifecycle",
+                "PutBucketReplication",
+                "DeleteBucketPolicy",
+                "DeleteBucketCors",
+                "DeleteBucketLifecycle",
+                "DeleteBucketReplication",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.metadata.json
index 75cba1ee62..b1c36be2d8 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.metadata.json
@@ -17,7 +17,6 @@
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
-    "https://www.clouddefense.ai/compliance-rules/cis-v140/monitoring/cis-v140-4-4",
     "https://www.intelligentdiscovery.io/controls/cloudwatch/cloudwatch-alarm-iam-policy-change"
   ],
   "Remediation": {
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.py
index f5efd04dde..4347a9b3aa 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,26 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_policy_changes(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?DeleteGroupPolicy.+\$\.eventName\s*=\s*.?DeleteRolePolicy.+\$\.eventName\s*=\s*.?DeleteUserPolicy.+\$\.eventName\s*=\s*.?PutGroupPolicy.+\$\.eventName\s*=\s*.?PutRolePolicy.+\$\.eventName\s*=\s*.?PutUserPolicy.+\$\.eventName\s*=\s*.?CreatePolicy.+\$\.eventName\s*=\s*.?DeletePolicy.+\$\.eventName\s*=\s*.?CreatePolicyVersion.+\$\.eventName\s*=\s*.?DeletePolicyVersion.+\$\.eventName\s*=\s*.?AttachRolePolicy.+\$\.eventName\s*=\s*.?DetachRolePolicy.+\$\.eventName\s*=\s*.?AttachUserPolicy.+\$\.eventName\s*=\s*.?DetachUserPolicy.+\$\.eventName\s*=\s*.?AttachGroupPolicy.+\$\.eventName\s*=\s*.?DetachGroupPolicy.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "DeleteGroupPolicy",
+                "DeleteRolePolicy",
+                "DeleteUserPolicy",
+                "PutGroupPolicy",
+                "PutRolePolicy",
+                "PutUserPolicy",
+                "CreatePolicy",
+                "DeletePolicy",
+                "CreatePolicyVersion",
+                "DeletePolicyVersion",
+                "AttachRolePolicy",
+                "DetachRolePolicy",
+                "AttachUserPolicy",
+                "DetachUserPolicy",
+                "AttachGroupPolicy",
+                "DetachGroupPolicy",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes.py
index a7972e420c..3557632904 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,16 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_security_group_changes(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?AuthorizeSecurityGroupIngress.+\$\.eventName\s*=\s*.?AuthorizeSecurityGroupEgress.+\$\.eventName\s*=\s*.?RevokeSecurityGroupIngress.+\$\.eventName\s*=\s*.?RevokeSecurityGroupEgress.+\$\.eventName\s*=\s*.?CreateSecurityGroup.+\$\.eventName\s*=\s*.?DeleteSecurityGroup.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "AuthorizeSecurityGroupIngress",
+                "AuthorizeSecurityGroupEgress",
+                "RevokeSecurityGroupIngress",
+                "RevokeSecurityGroupEgress",
+                "CreateSecurityGroup",
+                "DeleteSecurityGroup",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.metadata.json
index 20058c1ed8..76ffd832ff 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.metadata.json
@@ -21,7 +21,6 @@
     "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
     "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudWatchLogs/console-sign-in-without-mfa.html",
     "https://www.tenable.com/audits/items/CIS_Amazon_Web_Services_Foundations_v3.0.0_L1.audit:1957056ee174cc38502d5f5f1864333b",
-    "https://www.clouddefense.ai/compliance-rules/gdpr/data-protection/log-metric-filter-console-login-mfa",
     "https://www.intelligentdiscovery.io/controls/cloudwatch/cloudwatch-alarm-no-mfa",
     "https://support.icompaas.com/support/solutions/articles/62000083605-ensure-a-log-metric-filter-and-alarm-exist-for-management-console-sign-in-without-mfa"
   ],
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.py
index 8437600646..07475a6185 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,10 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_sign_in_without_mfa(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?ConsoleLogin.+\$\.additionalEventData\.MFAUsed\s*!=\s*.?Yes.?"
+        pattern = build_metric_filter_pattern(
+            event_names=["ConsoleLogin"],
+            extra_clauses=[("additionalEventData.MFAUsed", "!=", "Yes")],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py b/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py
index 84d70b4083..e5d104b840 100644
--- a/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py
+++ b/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py
@@ -3,6 +3,45 @@ import re
 from prowler.lib.check.models import Check_Report_AWS
 
 
+def build_metric_filter_pattern(
+    *,
+    event_names: list[str] | None = None,
+    event_source: str | None = None,
+    extra_clauses: list[tuple[str, str, str]] | None = None,
+) -> str:
+    """Build a regex pattern to match a CloudWatch Logs filterPattern string.
+
+    All clauses must be present for the pattern to match, regardless of the
+    order in which AWS stores them. Event names are matched exactly, so a
+    short name like ``CreateRoute`` will not be satisfied by a longer one
+    like ``CreateRouteTable``.
+
+    Pass the result directly to ``check_cloudwatch_log_metric_filter``.
+
+    Args:
+        event_names: AWS API action names to require (``$.eventName``).
+        event_source: optional service principal to require (``$.eventSource``),
+            e.g. ``"ec2.amazonaws.com"``.
+        extra_clauses: additional conditions as ``(field, operator, value)``
+            tuples, where ``operator`` is ``"="`` or ``"!="``. Example:
+            ``("additionalEventData.MFAUsed", "!=", "Yes")``.
+
+    Returns:
+        A regex string for use with ``re.search(..., flags=re.DOTALL)``.
+    """
+    parts: list[str] = []
+    if event_source is not None:
+        parts.append(rf"(?=.*\$\.eventSource\s*=\s*.?{re.escape(event_source)})")
+    for name in event_names or []:
+        parts.append(rf"(?=.*\$\.eventName\s*=\s*.?{re.escape(name)}\b)")
+    for field, operator, value in extra_clauses or []:
+        if operator not in ("=", "!="):
+            raise ValueError(f"unsupported operator {operator!r}; expected '=' or '!='")
+        op = r"\s*!=\s*" if operator == "!=" else r"\s*=\s*"
+        parts.append(rf"(?=.*\$\.{re.escape(field)}{op}.?{re.escape(value)})")
+    return "".join(parts)
+
+
 def check_cloudwatch_log_metric_filter(
     metric_filter_pattern: str,
     trails: list,
diff --git a/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py b/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py
index 0c745fc658..bc9f569f1b 100644
--- a/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py
+++ b/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py
@@ -7,6 +7,8 @@ from prowler.providers.aws.services.codepipeline.codepipeline_client import (
     codepipeline_client,
 )
 
+HTTP_TIMEOUT = 30
+
 
 class codepipeline_project_repo_private(Check):
     """Checks if AWS CodePipeline source repositories are configured as private.
@@ -87,9 +89,8 @@ class codepipeline_project_repo_private(Check):
             repo_url = repo_url[:-4]
 
         try:
-            context = ssl._create_unverified_context()
             req = urllib.request.Request(repo_url, method="HEAD")
-            response = urllib.request.urlopen(req, context=context)
+            response = urllib.request.urlopen(req, timeout=HTTP_TIMEOUT)
             return not response.geturl().endswith("sign_in")
-        except (urllib.error.HTTPError, urllib.error.URLError):
+        except (urllib.error.URLError, TimeoutError, ssl.SSLError):
             return False
diff --git a/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/__init__.py b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.metadata.json b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.metadata.json
new file mode 100644
index 0000000000..cbbd7a66dd
--- /dev/null
+++ b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.metadata.json
@@ -0,0 +1,44 @@
+{
+  "Provider": "aws",
+  "CheckID": "config_delegated_admin_and_org_aggregator_all_regions",
+  "CheckTitle": "AWS Config has a delegated administrator and an organization aggregator covering all AWS regions",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
+  "ServiceName": "config",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "AwsConfigConfigurationAggregator",
+  "ResourceGroup": "governance",
+  "Description": "**AWS Config** has a delegated administrator registered via AWS Organizations and at least one Configuration Aggregator with an OrganizationAggregationSource that covers all AWS regions, ensuring centralized org-wide configuration visibility.",
+  "Risk": "Without an org-wide **AWS Config** aggregator and a delegated administrator, configuration data is fragmented across accounts and regions, **compliance reporting** is incomplete, and **drift detection** is delayed. Adversaries or misconfigurations can persist in unmonitored accounts, eroding **audit readiness** and **regulatory posture**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html",
+    "https://docs.aws.amazon.com/config/latest/developerguide/set-up-aggregator-cli.html",
+    "https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-config.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws organizations register-delegated-administrator --account-id <ADMIN_ACCOUNT_ID> --service-principal config.amazonaws.com && aws configservice put-configuration-aggregator --configuration-aggregator-name org-aggregator --organization-aggregation-source RoleArn=<ROLE_ARN>,AllAwsRegions=true",
+      "NativeIaC": "",
+      "Other": "1. From the AWS Organizations management account, register the delegated administrator for config.amazonaws.com\n2. In the delegated admin account, open AWS Config\n3. Create a Configuration Aggregator and select Add my organization as the source\n4. Enable Include all AWS Regions\n5. Confirm an IAM role with AWSConfigRoleForOrganizations is attached\n6. Verify the aggregator status reaches SUCCEEDED for all member accounts",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Register a **delegated administrator** for AWS Config via AWS Organizations and create at least one **Configuration Aggregator** with an OrganizationAggregationSource that covers **all AWS regions**. This centralizes configuration data across the organization for unified compliance and audit reporting.",
+      "Url": "https://hub.prowler.com/check/config_delegated_admin_and_org_aggregator_all_regions"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "config_recorder_all_regions_enabled",
+    "guardduty_delegated_admin_enabled_all_regions"
+  ],
+  "Notes": "This check requires execution from the organization management account or delegated administrator account to access organization-level APIs."
+}
diff --git a/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.py b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.py
new file mode 100644
index 0000000000..f56ea191f8
--- /dev/null
+++ b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.py
@@ -0,0 +1,115 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.config.config_client import config_client
+from prowler.providers.aws.services.config.config_service import Aggregator
+
+
+class config_delegated_admin_and_org_aggregator_all_regions(Check):
+    """Ensure AWS Config has a delegated admin and an org aggregator covering all regions.
+
+    This check verifies that:
+    1. A delegated administrator is registered for the config.amazonaws.com
+       service principal via AWS Organizations.
+    2. At least one AWS Config Configuration Aggregator exists with an
+       OrganizationAggregationSource that covers all AWS regions
+       (AllAwsRegions=true).
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the check logic.
+
+        Returns:
+            A list of reports containing the result of the check. One finding per
+            aggregator-region, or a single synthetic FAIL when no aggregators
+            exist in any region.
+        """
+        findings = []
+
+        has_delegated_admin = (
+            bool(config_client.delegated_administrators)
+            and not config_client.delegated_administrators_lookup_failed
+        )
+        delegated_admin_unknown = config_client.delegated_administrators_lookup_failed
+
+        # No aggregators in any region: emit one synthetic FAIL anchored to the
+        # audited account in the default region.
+        if not config_client.aggregators:
+            synthetic = Aggregator(
+                name="unknown",
+                arn=config_client.get_unknown_arn(
+                    region=config_client.region,
+                    resource_type="config-aggregator",
+                ),
+                region=config_client.region,
+                all_aws_regions=False,
+                aws_regions=None,
+                organization_aggregation_source_present=False,
+            )
+            report = Check_Report_AWS(metadata=self.metadata(), resource=synthetic)
+            if delegated_admin_unknown:
+                delegated_state = (
+                    "delegated administrator status could not be determined"
+                )
+            elif has_delegated_admin:
+                delegated_state = "delegated administrator configured"
+            else:
+                delegated_state = (
+                    "no delegated administrator registered for config.amazonaws.com"
+                )
+            report.status = "FAIL"
+            report.status_extended = (
+                f"AWS Config has no Organization Aggregator configured in any "
+                f"region ({delegated_state})."
+            )
+            findings.append(report)
+            return findings
+
+        for region, aggregators_in_region in config_client.aggregators.items():
+            for aggregator in aggregators_in_region:
+                report = Check_Report_AWS(metadata=self.metadata(), resource=aggregator)
+
+                org_aware = aggregator.organization_aggregation_source_present
+                covers_all = aggregator.all_aws_regions
+
+                issues = []
+                if delegated_admin_unknown:
+                    issues.append(
+                        "delegated administrator status for config.amazonaws.com "
+                        "could not be determined"
+                    )
+                elif not has_delegated_admin:
+                    issues.append(
+                        "no delegated administrator registered for config.amazonaws.com"
+                    )
+                if not org_aware:
+                    issues.append(
+                        f"aggregator {aggregator.name} is not an organization aggregator"
+                    )
+                elif not covers_all:
+                    issues.append(
+                        f"aggregator {aggregator.name} does not cover all AWS regions"
+                    )
+
+                if issues:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"AWS Config aggregator {aggregator.name} in region "
+                        f"{region} has issues: {', '.join(issues)}."
+                    )
+                else:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"AWS Config aggregator {aggregator.name} in region "
+                        f"{region} is an organization aggregator covering all "
+                        f"AWS regions with delegated admin configured."
+                    )
+
+                # Support muting non-default regions if configured
+                if report.status == "FAIL" and (
+                    config_client.audit_config.get("mute_non_default_regions", False)
+                    and region != config_client.region
+                ):
+                    report.muted = True
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/config/config_service.py b/prowler/providers/aws/services/config/config_service.py
index 443cee2233..85ab22fd8e 100644
--- a/prowler/providers/aws/services/config/config_service.py
+++ b/prowler/providers/aws/services/config/config_service.py
@@ -1,5 +1,6 @@
 from typing import Optional
 
+from botocore.client import ClientError
 from pydantic.v1 import BaseModel
 
 from prowler.lib.logger import logger
@@ -12,10 +13,16 @@ class Config(AWSService):
         # Call AWSService's __init__
         super().__init__(__class__.__name__, provider)
         self.recorders = {}
+        self.aggregators: dict[str, list] = {}
+        self.delegated_administrators: list = []
+        self.delegated_administrators_lookup_failed: bool = False
         self.__threading_call__(self.describe_configuration_recorders)
         self.__threading_call__(
             self._describe_configuration_recorder_status, self.recorders.values()
         )
+        self.__threading_call__(self._describe_configuration_aggregators)
+        # Organizations API is not regional; single call.
+        self._list_config_delegated_administrators()
 
     def _get_recorder_arn_template(self, region):
         return f"arn:{self.audited_partition}:config:{region}:{self.audited_account}:recorder"
@@ -73,6 +80,108 @@ class Config(AWSService):
                 f"{recorder.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _describe_configuration_aggregators(self, regional_client):
+        """Describe AWS Config configuration aggregators per region.
+
+        An aggregator counts as organization-aware when its
+        OrganizationAggregationSource key is present in the response.
+        """
+        logger.info("Config - Describing Configuration Aggregators...")
+        try:
+            paginator = regional_client.get_paginator(
+                "describe_configuration_aggregators"
+            )
+            region_aggregators: list = []
+            for page in paginator.paginate():
+                for aggregator in page.get("ConfigurationAggregators", []):
+                    name = aggregator.get("ConfigurationAggregatorName", "")
+                    arn = aggregator.get("ConfigurationAggregatorArn", "")
+                    org_source = aggregator.get("OrganizationAggregationSource")
+                    org_aware = org_source is not None
+                    all_aws_regions = False
+                    aws_regions: Optional[list] = None
+                    if org_aware:
+                        all_aws_regions = org_source.get("AllAwsRegions", False)
+                        aws_regions = org_source.get("AwsRegions")
+                    if not self.audit_resources or (
+                        is_resource_filtered(arn, self.audit_resources)
+                    ):
+                        region_aggregators.append(
+                            Aggregator(
+                                name=name,
+                                arn=arn,
+                                region=regional_client.region,
+                                all_aws_regions=all_aws_regions,
+                                aws_regions=aws_regions,
+                                organization_aggregation_source_present=org_aware,
+                            )
+                        )
+            if region_aggregators:
+                self.aggregators[regional_client.region] = region_aggregators
+        except ClientError as error:
+            if error.response["Error"]["Code"] in (
+                "AccessDeniedException",
+                "AccessDenied",
+            ):
+                logger.warning(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def _list_config_delegated_administrators(self):
+        """List delegated administrators for the AWS Config service principal.
+
+        Uses the Organizations API directly (not regional). Sets
+        delegated_administrators_lookup_failed to True on AccessDenied so callers
+        can surface the unknown delegated-admin state in findings.
+        """
+        logger.info(
+            "Config - Listing delegated administrators for config.amazonaws.com..."
+        )
+        try:
+            org_client = self.session.client("organizations")
+            paginator = org_client.get_paginator("list_delegated_administrators")
+            for page in paginator.paginate(ServicePrincipal="config.amazonaws.com"):
+                for admin in page.get("DelegatedAdministrators", []):
+                    self.delegated_administrators.append(
+                        ConfigDelegatedAdministrator(
+                            id=admin.get("Id", ""),
+                            arn=admin.get("Arn", ""),
+                            name=admin.get("Name", ""),
+                            email=admin.get("Email", ""),
+                            status=admin.get("Status", ""),
+                            joined_method=admin.get("JoinedMethod", ""),
+                        )
+                    )
+        except ClientError as error:
+            error_code = error.response["Error"]["Code"]
+            if error_code in (
+                "AccessDeniedException",
+                "AccessDenied",
+                "AWSOrganizationsNotInUseException",
+            ):
+                self.delegated_administrators_lookup_failed = True
+                logger.warning(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                self.delegated_administrators_lookup_failed = True
+                logger.error(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            self.delegated_administrators_lookup_failed = True
+            logger.error(
+                f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
 
 class Recorder(BaseModel):
     name: str
@@ -80,3 +189,25 @@ class Recorder(BaseModel):
     recording: Optional[bool]
     last_status: Optional[str]
     region: str
+
+
+class Aggregator(BaseModel):
+    """Represents an AWS Config Configuration Aggregator."""
+
+    name: str
+    arn: str
+    region: str
+    all_aws_regions: bool = False
+    aws_regions: Optional[list] = None
+    organization_aggregation_source_present: bool = False
+
+
+class ConfigDelegatedAdministrator(BaseModel):
+    """Represents a delegated administrator registered for config.amazonaws.com."""
+
+    id: str
+    arn: str
+    name: str
+    email: str
+    status: str
+    joined_method: str
diff --git a/prowler/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/__init__.py b/prowler/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/elbv2_alb_drop_invalid_header_fields_enabled.metadata.json b/prowler/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/elbv2_alb_drop_invalid_header_fields_enabled.metadata.json
new file mode 100644
index 0000000000..0293501578
--- /dev/null
+++ b/prowler/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/elbv2_alb_drop_invalid_header_fields_enabled.metadata.json
@@ -0,0 +1,40 @@
+{
+  "Provider": "aws",
+  "CheckID": "elbv2_alb_drop_invalid_header_fields_enabled",
+  "CheckTitle": "Application Load Balancer should be configured to drop invalid HTTP header fields",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "TTPs/Initial Access",
+    "Effects/Data Exposure"
+  ],
+  "ServiceName": "elbv2",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "AwsElbv2LoadBalancer",
+  "ResourceGroup": "network",
+  "Description": "Ensure that Application Load Balancers (ALB) are configured to drop invalid HTTP header fields. The check fails when `routing.http.drop_invalid_header_fields.enabled` is not set to `true`. By default, ALBs do not remove HTTP headers that do not conform to RFC 7230.",
+  "Risk": "Forwarding non-RFC-compliant HTTP headers to backend targets enables HTTP desync (request smuggling):\n- **Confidentiality**: session/token theft, data exfiltration\n- **Integrity**: cache poisoning, request routing bypass, unauthorized actions\n- **Availability**: backend exhaustion.\nDropping invalid header fields removes a primary smuggling vector.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#drop-invalid-header-fields",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-4"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws elbv2 modify-load-balancer-attributes --load-balancer-arn <ALB_ARN> --attributes Key=routing.http.drop_invalid_header_fields.enabled,Value=true",
+      "NativeIaC": "```yaml\n# CloudFormation: enable drop invalid header fields on an ALB\nResources:\n  <example_resource_name>:\n    Type: AWS::ElasticLoadBalancingV2::LoadBalancer\n    Properties:\n      Type: application\n      Subnets:\n        - <example_subnet_id1>\n        - <example_subnet_id2>\n      LoadBalancerAttributes:\n        - Key: routing.http.drop_invalid_header_fields.enabled  # Critical: drop non-RFC-compliant headers\n          Value: true\n```",
+      "Other": "1. Open the Amazon EC2 console and choose Load Balancers.\n2. Select the Application Load Balancer.\n3. On the Attributes tab, choose Edit.\n4. Set 'Drop invalid header fields' to Enabled.\n5. Save changes.",
+      "Terraform": "```hcl\n# Terraform: enable drop invalid header fields on an ALB\nresource \"aws_lb\" \"<example_resource_name>\" {\n  name                       = \"<example_resource_name>\"\n  load_balancer_type         = \"application\"\n  subnets                    = [\"<example_subnet_id1>\", \"<example_subnet_id2>\"]\n  drop_invalid_header_fields = true # Critical: drop non-RFC-compliant headers\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable 'drop invalid header fields' on Application Load Balancers so non-RFC-compliant HTTP headers are removed before requests reach backend targets, reducing exposure to HTTP desync and request smuggling. Apply defense in depth and validate requests at the application layer as well.",
+      "Url": "https://hub.prowler.com/check/elbv2_alb_drop_invalid_header_fields_enabled"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/elbv2_alb_drop_invalid_header_fields_enabled.py b/prowler/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/elbv2_alb_drop_invalid_header_fields_enabled.py
new file mode 100644
index 0000000000..86740a253a
--- /dev/null
+++ b/prowler/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/elbv2_alb_drop_invalid_header_fields_enabled.py
@@ -0,0 +1,27 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client
+
+
+class elbv2_alb_drop_invalid_header_fields_enabled(Check):
+    def execute(self):
+        findings = []
+        for lb in elbv2_client.loadbalancersv2.values():
+            if lb.type == "application":
+                report = Check_Report_AWS(
+                    metadata=self.metadata(),
+                    resource=lb,
+                )
+                report.status = "PASS"
+                report.status_extended = (
+                    f"ELBv2 ALB {lb.name} is configured to drop invalid "
+                    "header fields."
+                )
+                if lb.drop_invalid_header_fields != "true":
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"ELBv2 ALB {lb.name} is not configured to drop "
+                        "invalid header fields."
+                    )
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/iam/iam_service.py b/prowler/providers/aws/services/iam/iam_service.py
index d6cb150178..fa01550b11 100644
--- a/prowler/providers/aws/services/iam/iam_service.py
+++ b/prowler/providers/aws/services/iam/iam_service.py
@@ -103,6 +103,9 @@ class IAM(AWSService):
         self._get_user_temporary_credentials_usage()
         self.organization_features = []
         self._list_organizations_features()
+        # ListRoles does not echo PermissionsBoundary; backfill via GetRole.
+        if self.roles:
+            self.__threading_call__(self._get_role_permissions_boundary, self.roles)
         # List missing tags
         self.__threading_call__(self._list_tags, self.users)
         self.__threading_call__(self._list_tags, self.roles)
@@ -133,6 +136,7 @@ class IAM(AWSService):
                                 arn=role["Arn"],
                                 assume_role_policy=role["AssumeRolePolicyDocument"],
                                 is_service_role=is_service_role(role),
+                                permissions_boundary=role.get("PermissionsBoundary"),
                             )
                         )
         except ClientError as error:
@@ -460,6 +464,34 @@ class IAM(AWSService):
                 f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _get_role_permissions_boundary(self, role):
+        """Backfill ``role.permissions_boundary`` via ``GetRole``.
+
+        ``ListRoles`` does not return ``PermissionsBoundary`` in practice, so
+        the value is fetched per role and stored on the ``Role`` model.
+
+        Args:
+            role: The ``Role`` instance to enrich.
+        """
+        try:
+            response = self.client.get_role(RoleName=role.name)
+            role.permissions_boundary = response.get("Role", {}).get(
+                "PermissionsBoundary"
+            )
+        except ClientError as error:
+            if error.response["Error"]["Code"] == "NoSuchEntity":
+                logger.warning(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            logger.error(
+                f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
     def _list_attached_role_policies(self):
         logger.info("IAM - List Attached Role Policies...")
         try:
@@ -1139,6 +1171,7 @@ class Role(BaseModel):
     is_service_role: bool
     attached_policies: list[dict] = []
     inline_policies: list[str] = []
+    permissions_boundary: Optional[dict] = None
     tags: Optional[list]
 
 
diff --git a/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py b/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py
index caf3629816..25703b979f 100644
--- a/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py
+++ b/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py
@@ -1,10 +1,9 @@
 import re
 from ipaddress import ip_address
 
-import awsipranges
-
 from prowler.lib.check.models import Check, Check_Report_AWS
 from prowler.lib.utils.utils import validate_ip_address
+from prowler.providers.aws.lib.ip_ranges.ip_ranges import get_public_ip_networks
 from prowler.providers.aws.services.ec2.ec2_client import ec2_client
 from prowler.providers.aws.services.route53.route53_client import route53_client
 from prowler.providers.aws.services.s3.s3_client import s3_client
@@ -21,6 +20,10 @@ class route53_dangling_ip_subdomain_takeover(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
 
+        # AWS public IP prefixes are fetched lazily, at most once per run, only
+        # when a dangling-candidate public IP is found.
+        aws_ip_networks = None
+
         # When --region is used, Route53 service gathers EIPs from all regions
         # to avoid false positives. Otherwise, use ec2_client data directly.
         if route53_client.all_account_elastic_ips:
@@ -42,6 +45,7 @@ class route53_dangling_ip_subdomain_takeover(Check):
             if record_set.type == "A" and not record_set.is_alias:
                 for record in record_set.records:
                     if validate_ip_address(record):
+                        record_ip = ip_address(record)
                         report = Check_Report_AWS(
                             metadata=self.metadata(), resource=record_set
                         )
@@ -53,14 +57,12 @@ class route53_dangling_ip_subdomain_takeover(Check):
                         report.status = "PASS"
                         report.status_extended = f"Route53 record {record} (name: {record_set.name}) in Hosted Zone {hosted_zone.name} is not a dangling IP."
                         # If Public IP check if it is in the AWS Account
-                        if (
-                            not ip_address(record).is_private
-                            and record not in public_ips
-                        ):
+                        if not record_ip.is_private and record not in public_ips:
                             report.status_extended = f"Route53 record {record} (name: {record_set.name}) in Hosted Zone {hosted_zone.name} does not belong to AWS and it is not a dangling IP."
                             # Check if potential dangling IP is within AWS Ranges
-                            aws_ip_ranges = awsipranges.get_ranges()
-                            if aws_ip_ranges.get(record):
+                            if aws_ip_networks is None:
+                                aws_ip_networks = get_public_ip_networks()
+                            if any(record_ip in network for network in aws_ip_networks):
                                 report.status = "FAIL"
                                 report.status_extended = f"Route53 record {record} (name: {record_set.name}) in Hosted Zone {hosted_zone.name} is a dangling IP which can lead to a subdomain takeover attack."
                         findings.append(report)
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/__init__.py b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.metadata.json b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.metadata.json
new file mode 100644
index 0000000000..0e127a7759
--- /dev/null
+++ b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.metadata.json
@@ -0,0 +1,39 @@
+{
+  "Provider": "aws",
+  "CheckID": "sagemaker_clarify_exists",
+  "CheckTitle": "Amazon SageMaker Clarify processing jobs exist in the region",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "sagemaker",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "Other",
+  "ResourceGroup": "ai_ml",
+  "Description": "**SageMaker Clarify** provides bias detection and model explainability for ML workloads.\n\nThis check verifies that at least one SageMaker processing job using the AWS-managed Clarify container image exists in each successfully scanned region. The absence of Clarify jobs indicates that responsible-AI controls such as bias detection and explainability are not in place.",
+  "Risk": "Without **SageMaker Clarify** processing jobs, ML models may be deployed without bias analysis or explainability reports. This can lead to:\n- **Regulatory non-compliance** with AI governance frameworks\n- **Undetected bias** in model predictions affecting protected groups\n- **Lack of accountability** for ML model decisions in production",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html",
+    "https://docs.aws.amazon.com/sagemaker/latest/dg-ecr-paths/sagemaker-algo-docker-registry-paths.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws sagemaker create-processing-job --processing-job-name clarify-bias-check --app-specification ImageUri=<clarify-image-uri> --role-arn <role-arn> --processing-resources 'ClusterConfig={InstanceCount=1,InstanceType=ml.m5.xlarge,VolumeSizeInGB=20}'",
+      "NativeIaC": "",
+      "Other": "1. Open the AWS Console and go to Amazon SageMaker\n2. Navigate to Processing > Processing jobs\n3. Click Create processing job\n4. Select the SageMaker Clarify container image for your region\n5. Configure input/output paths and the analysis configuration\n6. Click Create processing job",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Create SageMaker Clarify processing jobs to evaluate models for bias and explainability before deployment. Integrate Clarify into your ML pipeline to ensure responsible AI practices.",
+      "Url": "https://hub.prowler.com/check/sagemaker_clarify_exists"
+    }
+  },
+  "Categories": [
+    "gen-ai"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Results are generated per scanned region. Regions where `ListProcessingJobs` cannot be queried are omitted from the findings."
+}
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.py b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.py
new file mode 100644
index 0000000000..9c559613d3
--- /dev/null
+++ b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.py
@@ -0,0 +1,54 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.sagemaker.sagemaker_client import sagemaker_client
+
+
+class sagemaker_clarify_exists(Check):
+    """Check whether at least one SageMaker Clarify processing job exists per region.
+
+    A region is reported only when ListProcessingJobs succeeded for it; regions
+    where the API call failed (e.g. AccessDenied, unsupported region) are
+    skipped at the service layer and produce no finding.
+
+    - PASS: At least one processing job uses the AWS-managed Clarify container
+      image in the region (one finding per job).
+    - FAIL: No processing job uses the Clarify container image in the region
+      (one finding per region).
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the SageMaker Clarify exists check.
+
+        Returns:
+            A list of reports containing the result of the check.
+        """
+        findings = []
+        for region in sorted(sagemaker_client.processing_jobs_scanned_regions):
+            clarify_jobs = sorted(
+                (
+                    job
+                    for job in sagemaker_client.sagemaker_processing_jobs
+                    if job.region == region
+                    and job.image_uri
+                    and "sagemaker-clarify-processing" in job.image_uri
+                ),
+                key=lambda job: job.name,
+            )
+
+            if clarify_jobs:
+                for job in clarify_jobs:
+                    report = Check_Report_AWS(metadata=self.metadata(), resource=job)
+                    report.status = "PASS"
+                    report.status_extended = f"SageMaker Clarify processing job {job.name} exists in region {region}."
+                    findings.append(report)
+            else:
+                report = Check_Report_AWS(metadata=self.metadata(), resource={})
+                report.region = region
+                report.resource_id = "sagemaker-clarify"
+                report.resource_arn = f"arn:{sagemaker_client.audited_partition}:sagemaker:{region}:{sagemaker_client.audited_account}:processing-job"
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"No SageMaker Clarify processing jobs found in region {region}."
+                )
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/__init__.py b/prowler/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/sagemaker_models_monitor_enabled.metadata.json b/prowler/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/sagemaker_models_monitor_enabled.metadata.json
new file mode 100644
index 0000000000..d1d025fe7e
--- /dev/null
+++ b/prowler/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/sagemaker_models_monitor_enabled.metadata.json
@@ -0,0 +1,40 @@
+{
+  "Provider": "aws",
+  "CheckID": "sagemaker_models_monitor_enabled",
+  "CheckTitle": "Amazon SageMaker has a monitoring schedule scheduled",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
+  "ServiceName": "sagemaker",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "Other",
+  "ResourceGroup": "ai_ml",
+  "Description": "**SageMaker Models Monitor** detects data drift, model quality issues, and bias drift in production.",
+  "Risk": "Without an **active monitoring schedule**, data drift, model quality issues, and bias drift go undetected, so **model quality degrades silently** while downstream decisions such as fraud detection, access control, and pricing keep relying on a degrading model.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor.html",
+    "https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-scheduling.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable **Amazon SageMaker Model Monitor** and keep at least one **monitoring schedule** in the `Scheduled` state so data quality, model quality, and bias drift are continuously evaluated against a baseline.",
+      "Url": "https://hub.prowler.com/check/sagemaker_models_monitor_enabled"
+    }
+  },
+  "Categories": [
+    "gen-ai"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/sagemaker_models_monitor_enabled.py b/prowler/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/sagemaker_models_monitor_enabled.py
new file mode 100644
index 0000000000..f9f893a895
--- /dev/null
+++ b/prowler/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/sagemaker_models_monitor_enabled.py
@@ -0,0 +1,22 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.sagemaker.sagemaker_client import sagemaker_client
+
+
+class sagemaker_models_monitor_enabled(Check):
+    def execute(self):
+        findings = []
+        for monitoring_schedule in sagemaker_client.sagemaker_monitoring_schedules:
+            report = Check_Report_AWS(
+                metadata=self.metadata(), resource=monitoring_schedule
+            )
+            if monitoring_schedule.is_scheduled:
+                report.status = "PASS"
+                report.status_extended = f"SageMaker monitoring schedule {monitoring_schedule.name} is enabled in region {monitoring_schedule.region}."
+            elif not monitoring_schedule.has_schedules:
+                report.status = "FAIL"
+                report.status_extended = f"No SageMaker monitoring schedules found in region {monitoring_schedule.region}."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"No active SageMaker monitoring schedule in region {monitoring_schedule.region}; existing schedules are not in Scheduled status."
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_service.py b/prowler/providers/aws/services/sagemaker/sagemaker_service.py
index 0f73062452..20ea4c0280 100644
--- a/prowler/providers/aws/services/sagemaker/sagemaker_service.py
+++ b/prowler/providers/aws/services/sagemaker/sagemaker_service.py
@@ -15,17 +15,22 @@ class SageMaker(AWSService):
         self.sagemaker_notebook_instances = []
         self.sagemaker_models = []
         self.sagemaker_training_jobs = []
+        self.sagemaker_processing_jobs = []
+        self.processing_jobs_scanned_regions = set()
         self.sagemaker_domains = []
         self.endpoint_configs = {}
         self.sagemaker_model_registries = []
+        self.sagemaker_monitoring_schedules = []
 
         # Retrieve resources concurrently
         self.__threading_call__(self._list_notebook_instances)
         self.__threading_call__(self._list_models)
         self.__threading_call__(self._list_training_jobs)
+        self.__threading_call__(self._list_processing_jobs)
         self.__threading_call__(self._list_endpoint_configs)
         self.__threading_call__(self._list_domains)
         self.__threading_call__(self._list_model_package_groups)
+        self.__threading_call__(self._list_monitoring_schedules)
 
         # Describe resources concurrently
         self.__threading_call__(self._describe_model, self.sagemaker_models)
@@ -35,6 +40,9 @@ class SageMaker(AWSService):
         self.__threading_call__(
             self._describe_training_job, self.sagemaker_training_jobs
         )
+        self.__threading_call__(
+            self._describe_processing_job, self.sagemaker_processing_jobs
+        )
         self.__threading_call__(
             self._describe_endpoint_config, list(self.endpoint_configs.values())
         )
@@ -49,6 +57,9 @@ class SageMaker(AWSService):
         self.__threading_call__(
             self._list_tags_for_resource, self.sagemaker_training_jobs
         )
+        self.__threading_call__(
+            self._list_tags_for_resource, self.sagemaker_processing_jobs
+        )
         self.__threading_call__(
             self._list_tags_for_resource, list(self.endpoint_configs.values())
         )
@@ -126,6 +137,66 @@ class SageMaker(AWSService):
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _list_processing_jobs(self, regional_client):
+        """List SageMaker processing jobs in a region.
+
+        Populates ``self.sagemaker_processing_jobs`` with `ProcessingJob`
+        entries and adds ``regional_client.region`` to
+        ``self.processing_jobs_scanned_regions`` once pagination succeeds, so
+        regions where ``ListProcessingJobs`` fails are skipped by checks that
+        consume that set.
+
+        Args:
+            regional_client: Regional SageMaker boto3 client.
+        """
+        logger.info("SageMaker - listing processing jobs...")
+        try:
+            list_processing_jobs_paginator = regional_client.get_paginator(
+                "list_processing_jobs"
+            )
+            for page in list_processing_jobs_paginator.paginate():
+                for processing_job in page["ProcessingJobSummaries"]:
+                    if not self.audit_resources or (
+                        is_resource_filtered(
+                            processing_job["ProcessingJobArn"], self.audit_resources
+                        )
+                    ):
+                        self.sagemaker_processing_jobs.append(
+                            ProcessingJob(
+                                name=processing_job["ProcessingJobName"],
+                                region=regional_client.region,
+                                arn=processing_job["ProcessingJobArn"],
+                            )
+                        )
+            self.processing_jobs_scanned_regions.add(regional_client.region)
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def _describe_processing_job(self, processing_job):
+        """Describe a SageMaker processing job and enrich its image metadata.
+
+        Reads ``AppSpecification.ImageUri`` from ``DescribeProcessingJob`` and
+        stores it on ``processing_job.image_uri``. Errors are logged and
+        swallowed so a failure in one job does not abort the scan.
+
+        Args:
+            processing_job: ProcessingJob model to enrich in-place.
+        """
+        logger.info("SageMaker - describing processing job...")
+        try:
+            regional_client = self.regional_clients[processing_job.region]
+            describe_processing_job = regional_client.describe_processing_job(
+                ProcessingJobName=processing_job.name
+            )
+            app_spec = describe_processing_job.get("AppSpecification", {})
+            processing_job.image_uri = app_spec.get("ImageUri")
+        except Exception as error:
+            logger.error(
+                f"{processing_job.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
     def _describe_notebook_instance(self, notebook_instance):
         logger.info("SageMaker - describing notebook instances...")
         try:
@@ -377,6 +448,46 @@ class SageMaker(AWSService):
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _list_monitoring_schedules(self, regional_client):
+        logger.info("SageMaker - listing monitoring schedules...")
+        name = "SageMaker Monitoring Schedules"
+        arn = self.get_unknown_arn(
+            region=regional_client.region,
+            resource_type="monitoring-schedule",
+        )
+        has_schedules = False
+        is_scheduled = False
+        try:
+            paginator = regional_client.get_paginator("list_monitoring_schedules")
+            for page in paginator.paginate():
+                for schedule in page["MonitoringScheduleSummaries"]:
+                    if not self.audit_resources or (
+                        is_resource_filtered(
+                            schedule["MonitoringScheduleArn"], self.audit_resources
+                        )
+                    ):
+                        has_schedules = True
+                        if schedule["MonitoringScheduleStatus"] == "Scheduled":
+                            is_scheduled = True
+                            name = schedule["MonitoringScheduleName"]
+                            arn = schedule["MonitoringScheduleArn"]
+                            break
+                if is_scheduled:
+                    break
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+        self.sagemaker_monitoring_schedules.append(
+            MonitoringSchedule(
+                name=name,
+                region=regional_client.region,
+                arn=arn,
+                has_schedules=has_schedules,
+                is_scheduled=is_scheduled,
+            )
+        )
+
 
 class NotebookInstance(BaseModel):
     name: str
@@ -409,6 +520,25 @@ class TrainingJob(BaseModel):
     tags: Optional[list] = []
 
 
+class ProcessingJob(BaseModel):
+    """Represents a SageMaker processing job.
+
+    Attributes:
+        name: Processing job name.
+        region: AWS region where the job lives.
+        arn: Processing job ARN.
+        image_uri: Container image URI from `AppSpecification.ImageUri`,
+            populated by `_describe_processing_job`.
+        tags: Resource tags, populated by `_list_tags_for_resource`.
+    """
+
+    name: str
+    region: str
+    arn: str
+    image_uri: Optional[str] = None
+    tags: Optional[list] = []
+
+
 class ProductionVariant(BaseModel):
     name: str
     initial_instance_count: int
@@ -441,3 +571,11 @@ class ModelRegistry(BaseModel):
     region: str
     has_groups: bool = False
     has_approved_packages: bool = False
+
+
+class MonitoringSchedule(BaseModel):
+    name: str
+    region: str
+    arn: str
+    has_schedules: bool = False
+    is_scheduled: bool = False
diff --git a/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/__init__.py b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.metadata.json b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.metadata.json
new file mode 100644
index 0000000000..99748671ae
--- /dev/null
+++ b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.metadata.json
@@ -0,0 +1,44 @@
+{
+  "Provider": "aws",
+  "CheckID": "securityhub_delegated_admin_enabled_all_regions",
+  "CheckTitle": "Security Hub has delegated admin configured and is enabled in all regions with organization auto-enable",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
+  "ServiceName": "securityhub",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "AwsSecurityHubHub",
+  "ResourceGroup": "security",
+  "Description": "**AWS Security Hub** has a delegated administrator configured at the organization level, hubs are active in all opted-in regions, and organization auto-enable is active so that new member accounts are automatically enrolled.",
+  "Risk": "Without org-wide **AWS Security Hub** configuration, findings can be aggregated inconsistently, delegated admin may be missing in some regions, and new accounts will not be auto-enrolled. This fragments **security posture visibility**, delays **incident response**, and lets misconfigurations and compliance drift go undetected across the organization.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/designate-orgs-admin-account.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/accounts-orgs-auto-enable.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws securityhub enable-organization-admin-account --admin-account-id <ADMIN_ACCOUNT_ID> && aws securityhub update-organization-configuration --auto-enable --auto-enable-standards DEFAULT",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the AWS Organizations management account\n2. Open the AWS Organizations console\n3. Navigate to Services > AWS Security Hub\n4. Click Register delegated administrator and enter the security account ID\n5. Switch to the delegated admin account\n6. In Security Hub console, go to Settings > Accounts\n7. Enable auto-enable for new organization accounts\n8. Repeat hub enablement for all opted-in regions",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure a **delegated administrator** for AWS Security Hub via AWS Organizations. Enable Security Hub in **all opted-in regions** and turn on **auto-enable** so new member accounts are automatically enrolled. This ensures uniform security posture monitoring across the entire organization.",
+      "Url": "https://hub.prowler.com/check/securityhub_delegated_admin_enabled_all_regions"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "securityhub_enabled",
+    "guardduty_delegated_admin_enabled_all_regions"
+  ],
+  "Notes": "This check requires execution from the organization management account or delegated administrator account to access organization-level APIs."
+}
diff --git a/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.py b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.py
new file mode 100644
index 0000000000..4828752183
--- /dev/null
+++ b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.py
@@ -0,0 +1,84 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.securityhub.securityhub_client import (
+    securityhub_client,
+)
+
+
+class securityhub_delegated_admin_enabled_all_regions(Check):
+    """Ensure Security Hub has a delegated admin and is enabled in all regions.
+
+    This check verifies that:
+    1. A delegated administrator account is configured for Security Hub
+    2. Security Hub is active (ACTIVE status) in each region
+    3. Organization auto-enable is configured for new member accounts
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the check logic.
+
+        Returns:
+            A list of reports containing the result of the check for each region.
+        """
+        findings = []
+
+        # Build a set of regions that have an organization admin account configured
+        regions_with_admin = {
+            admin.region
+            for admin in securityhub_client.organization_admin_accounts
+            if admin.admin_status == "ENABLED"
+        }
+        admin_lookup_failed = securityhub_client.organization_admin_lookup_failed
+
+        for securityhub in securityhub_client.securityhubs:
+            report = Check_Report_AWS(metadata=self.metadata(), resource=securityhub)
+
+            # Check if this region has a delegated admin
+            has_delegated_admin = securityhub.region in regions_with_admin
+
+            # Check if hub is active
+            hub_active = securityhub.status == "ACTIVE"
+
+            # Check if auto-enable is configured for organization members
+            auto_enable_on = securityhub.organization_auto_enable
+
+            # Determine overall status
+            issues = []
+            if admin_lookup_failed:
+                issues.append("delegated administrator status could not be determined")
+            elif not has_delegated_admin:
+                issues.append("no delegated administrator configured")
+            if not hub_active:
+                issues.append("Security Hub not enabled")
+            if (
+                hub_active
+                and securityhub.organization_config_available
+                and not auto_enable_on
+            ):
+                # Only report auto-enable issue if hub is active and org config data
+                # is available (i.e., we could actually read AutoEnable from the API).
+                issues.append("organization auto-enable not configured")
+
+            if issues:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Security Hub in region {securityhub.region} has issues: "
+                    f"{', '.join(issues)}."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Security Hub in region {securityhub.region} has delegated "
+                    f"admin configured with hub active and organization auto-enable "
+                    f"enabled."
+                )
+
+            # Support muting non-default regions if configured
+            if report.status == "FAIL" and (
+                securityhub_client.audit_config.get("mute_non_default_regions", False)
+                and securityhub.region != securityhub_client.region
+            ):
+                report.muted = True
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/securityhub/securityhub_service.py b/prowler/providers/aws/services/securityhub/securityhub_service.py
index 0799c6e048..5e2d445742 100644
--- a/prowler/providers/aws/services/securityhub/securityhub_service.py
+++ b/prowler/providers/aws/services/securityhub/securityhub_service.py
@@ -13,8 +13,14 @@ class SecurityHub(AWSService):
         # Call AWSService's __init__
         super().__init__(__class__.__name__, provider)
         self.securityhubs = []
+        self.organization_admin_accounts = []
+        self.organization_admin_lookup_failed: bool = False
         self.__threading_call__(self._describe_hub)
         self.__threading_call__(self._list_tags, self.securityhubs)
+        self.__threading_call__(self._list_organization_admin_accounts)
+        self.__threading_call__(
+            self._describe_organization_configuration, self.securityhubs
+        )
 
     def _describe_hub(self, regional_client):
         logger.info("SecurityHub - Describing Hub...")
@@ -104,6 +110,95 @@ class SecurityHub(AWSService):
                 f"{resource.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _list_organization_admin_accounts(self, regional_client):
+        """List Security Hub delegated administrator accounts for the organization.
+
+        This API is only available to the organization management account or
+        a delegated administrator account.
+        """
+        logger.info("SecurityHub - listing organization admin accounts...")
+        try:
+            paginator = regional_client.get_paginator(
+                "list_organization_admin_accounts"
+            )
+            for page in paginator.paginate():
+                for admin in page.get("AdminAccounts", []):
+                    admin_account = OrganizationAdminAccount(
+                        admin_account_id=admin.get("AdminAccountId"),
+                        admin_status=admin.get("AdminStatus"),
+                        region=regional_client.region,
+                    )
+                    # Avoid duplicates across regions for the same admin account
+                    if not any(
+                        existing.admin_account_id == admin_account.admin_account_id
+                        and existing.region == admin_account.region
+                        for existing in self.organization_admin_accounts
+                    ):
+                        self.organization_admin_accounts.append(admin_account)
+        except ClientError as error:
+            self.organization_admin_lookup_failed = True
+            if error.response["Error"]["Code"] in (
+                "AccessDeniedException",
+                "InvalidAccessException",
+                "BadRequestException",
+            ):
+                logger.warning(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            self.organization_admin_lookup_failed = True
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def _describe_organization_configuration(self, securityhub):
+        """Describe the organization configuration for a Security Hub instance.
+
+        This provides information about auto-enable settings for the organization.
+        Only invoked for hubs in ACTIVE status.
+        """
+        logger.info("SecurityHub - describing organization configuration...")
+        try:
+            if securityhub.status != "ACTIVE":
+                return
+            regional_client = self.regional_clients[securityhub.region]
+            org_config = regional_client.describe_organization_configuration()
+            securityhub.organization_auto_enable = org_config.get("AutoEnable", False)
+            securityhub.auto_enable_standards = org_config.get(
+                "AutoEnableStandards", "NONE"
+            )
+            securityhub.organization_config_available = True
+        except ClientError as error:
+            if error.response["Error"]["Code"] in (
+                "AccessDeniedException",
+                "InvalidAccessException",
+                "BadRequestException",
+            ):
+                # Expected when not running from management or delegated admin account
+                logger.warning(
+                    f"{securityhub.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{securityhub.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            logger.error(
+                f"{securityhub.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+class OrganizationAdminAccount(BaseModel):
+    """Represents a Security Hub delegated administrator account."""
+
+    admin_account_id: str
+    admin_status: str  # ENABLED or DISABLE_IN_PROGRESS
+    region: str
+
 
 class SecurityHubHub(BaseModel):
     arn: str
@@ -112,4 +207,8 @@ class SecurityHubHub(BaseModel):
     standards: str
     integrations: str
     region: str
-    tags: Optional[list]
+    tags: Optional[list] = []
+    # Organization configuration fields
+    organization_auto_enable: bool = False
+    auto_enable_standards: str = "NONE"
+    organization_config_available: bool = False
diff --git a/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/__init__.py b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.metadata.json b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.metadata.json
new file mode 100644
index 0000000000..77096d6a20
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "aks_cluster_auto_upgrade_enabled",
+  "CheckTitle": "AKS cluster has automatic upgrade enabled",
+  "CheckType": [],
+  "ServiceName": "aks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.containerservice/managedclusters",
+  "ResourceGroup": "container",
+  "Description": "**AKS clusters** are evaluated for an **automatic upgrade channel** other than `none`. Automatic upgrades keep the Kubernetes control plane and node pools on supported patch/minor versions and reduce version drift across clusters.",
+  "Risk": "Without automatic upgrades, AKS clusters can remain on unsupported or vulnerable Kubernetes versions. Delayed patching increases exposure to **known CVEs**, control plane/node defects, and exploit chains that can affect workload **confidentiality**, **integrity**, and **availability**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/aks/auto-upgrade-cluster",
+    "https://learn.microsoft.com/en-us/azure/aks/supported-kubernetes-versions"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --auto-upgrade-channel patch",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure an AKS automatic upgrade channel so clusters receive Kubernetes version updates and security patches without relying only on manual upgrade processes. Use `patch` or `stable` for conservative production upgrades, reserve faster channels such as `rapid` for environments that can absorb quicker version changes, and avoid `none` unless a documented exception and manual patching process exists.",
+      "Url": "https://hub.prowler.com/check/aks_cluster_auto_upgrade_enabled"
+    }
+  },
+  "Categories": [
+    "vulnerabilities",
+    "cluster-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Automatic upgrade channels can change cluster versions during Azure-managed upgrade windows. Select a channel that matches the workload change tolerance and use planned maintenance windows, staging validation, and documented rollback procedures for production clusters."
+}
diff --git a/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.py b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.py
new file mode 100644
index 0000000000..9d1f8b48a1
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.py
@@ -0,0 +1,28 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.aks.aks_client import aks_client
+
+
+class aks_cluster_auto_upgrade_enabled(Check):
+    def execute(self) -> list[Check_Report_Azure]:
+        findings = []
+
+        for subscription_name, clusters in aks_client.clusters.items():
+            for cluster in clusters.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
+                report.subscription = subscription_name
+
+                auto_upgrade_channel = (
+                    (cluster.auto_upgrade_channel or "").strip().lower()
+                )
+                if auto_upgrade_channel and auto_upgrade_channel != "none":
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Cluster '{cluster.name}' has auto-upgrade channel."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Cluster '{cluster.name}' does not have auto-upgrade configured."
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/__init__.py b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.metadata.json b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.metadata.json
new file mode 100644
index 0000000000..90bbd45f3b
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.metadata.json
@@ -0,0 +1,39 @@
+{
+  "Provider": "azure",
+  "CheckID": "aks_cluster_defender_enabled",
+  "CheckTitle": "AKS cluster has Microsoft Defender security profile enabled",
+  "CheckType": [],
+  "ServiceName": "aks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "microsoft.containerservice/managedclusters",
+  "ResourceGroup": "container",
+  "Description": "**AKS clusters** are evaluated for the **Microsoft Defender security profile** (`securityProfile.defender.securityMonitoring.enabled=true`). Defender for Containers extends security monitoring, threat detection, vulnerability assessment, and security posture insights to Azure Kubernetes Service workloads.",
+  "Risk": "Without the Microsoft Defender security profile, AKS runtime threats such as **cryptomining**, suspicious Kubernetes API activity, vulnerable container images, and malicious workload behavior may go undetected. Compromised containers can pivot to cluster resources and cloud APIs, impacting **confidentiality**, **integrity**, and **availability**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-deployment-overview",
+    "https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest#az-aks-update",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/managedclusters"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --enable-defender",
+      "NativeIaC": "```bicep\n// AKS cluster with Microsoft Defender security monitoring enabled\nresource aks 'Microsoft.ContainerService/managedClusters@2024-05-01' = {\n  name: '<CLUSTER_NAME>'\n  location: '<LOCATION>'\n  identity: {\n    type: 'SystemAssigned'\n  }\n  properties: {\n    dnsPrefix: '<DNS_PREFIX>'\n    securityProfile: {\n      defender: {\n        logAnalyticsWorkspaceResourceId: '<LOG_ANALYTICS_WORKSPACE_RESOURCE_ID>'\n        securityMonitoring: {\n          enabled: true // Critical: enables Defender security monitoring for AKS\n        }\n      }\n    }\n    agentPoolProfiles: [\n      {\n        name: 'system'\n        count: 1\n        vmSize: 'Standard_DS2_v2'\n        mode: 'System'\n      }\n    ]\n  }\n}\n```",
+      "Other": "1. In Microsoft Defender for Cloud, enable the Containers plan for the subscription that contains the AKS cluster\n2. In the AKS cluster configuration, enable the Microsoft Defender security profile\n3. Verify that Defender security monitoring is enabled for the managed cluster",
+      "Terraform": "```hcl\nresource \"azurerm_log_analytics_workspace\" \"example\" {\n  name                = \"<workspace-name>\"\n  location            = \"<location>\"\n  resource_group_name = \"<resource-group>\"\n  sku                 = \"PerGB2018\"\n}\n\nresource \"azurerm_kubernetes_cluster\" \"example\" {\n  name                = \"<cluster-name>\"\n  location            = \"<location>\"\n  resource_group_name = \"<resource-group>\"\n  dns_prefix          = \"<dns-prefix>\"\n\n  default_node_pool {\n    name       = \"system\"\n    node_count = 1\n    vm_size    = \"Standard_DS2_v2\"\n  }\n\n  identity {\n    type = \"SystemAssigned\"\n  }\n\n  microsoft_defender {\n    log_analytics_workspace_id = azurerm_log_analytics_workspace.example.id\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable the Microsoft Defender security profile for AKS clusters and ensure the subscription has Defender for Containers enabled. Route security monitoring data to the appropriate workspace and review Defender alerts and recommendations as part of the cluster operations process.",
+      "Url": "https://hub.prowler.com/check/aks_cluster_defender_enabled"
+    }
+  },
+  "Categories": [
+    "threat-detection",
+    "cluster-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check evaluates the AKS managed cluster Defender security monitoring flag. Defender for Containers plan availability, billing, workspace routing, and alert response processes should be validated separately at the subscription and security operations levels."
+}
diff --git a/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.py b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.py
new file mode 100644
index 0000000000..08074754a6
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.py
@@ -0,0 +1,29 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.aks.aks_client import aks_client
+
+
+class aks_cluster_defender_enabled(Check):
+    def execute(self) -> list[Check_Report_Azure]:
+        findings = []
+
+        for subscription_name, clusters in aks_client.clusters.items():
+            for cluster in clusters.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
+                report.subscription = subscription_name
+
+                if cluster.defender_enabled is True:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Cluster '{cluster.name}' has Defender for Containers "
+                        "enabled."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"Cluster '{cluster.name}' does not have Defender for "
+                        "Containers enabled."
+                    )
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/aks/aks_service.py b/prowler/providers/azure/services/aks/aks_service.py
index 3d158a2f70..081edd7b17 100644
--- a/prowler/providers/azure/services/aks/aks_service.py
+++ b/prowler/providers/azure/services/aks/aks_service.py
@@ -1,5 +1,5 @@
 from dataclasses import dataclass
-from typing import List
+from typing import List, Optional
 
 from azure.mgmt.containerservice import ContainerServiceClient
 
@@ -55,6 +55,56 @@ class AKS(AzureService):
                                         )
                                     ],
                                     rbac_enabled=getattr(cluster, "enable_rbac", False),
+                                    auto_upgrade_channel=getattr(
+                                        getattr(cluster, "auto_upgrade_profile", None),
+                                        "upgrade_channel",
+                                        None,
+                                    ),
+                                    defender_enabled=bool(
+                                        getattr(
+                                            getattr(
+                                                getattr(
+                                                    getattr(
+                                                        cluster,
+                                                        "security_profile",
+                                                        None,
+                                                    ),
+                                                    "defender",
+                                                    None,
+                                                ),
+                                                "security_monitoring",
+                                                None,
+                                            ),
+                                            "enabled",
+                                            False,
+                                        )
+                                    ),
+                                    azure_monitor_enabled=(
+                                        bool(
+                                            getattr(
+                                                getattr(
+                                                    getattr(
+                                                        cluster,
+                                                        "azure_monitor_profile",
+                                                        None,
+                                                    ),
+                                                    "metrics",
+                                                    None,
+                                                ),
+                                                "enabled",
+                                                False,
+                                            )
+                                        )
+                                        if getattr(
+                                            cluster, "azure_monitor_profile", None
+                                        )
+                                        else False
+                                    ),
+                                    local_accounts_disabled=bool(
+                                        getattr(
+                                            cluster, "disable_local_accounts", False
+                                        )
+                                    ),
                                 )
                             }
                         )
@@ -82,3 +132,7 @@ class Cluster:
     agent_pool_profiles: List[ManagedClusterAgentPoolProfile]
     rbac_enabled: bool
     location: str
+    auto_upgrade_channel: Optional[str] = None
+    defender_enabled: bool = False
+    azure_monitor_enabled: bool = False
+    local_accounts_disabled: bool = False
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/__init__.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.metadata.json b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.metadata.json
new file mode 100644
index 0000000000..41246ff7a6
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "cosmosdb_account_automatic_failover_enabled",
+  "CheckTitle": "Cosmos DB account has automatic failover enabled",
+  "CheckType": [],
+  "ServiceName": "cosmosdb",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.documentdb/databaseaccounts",
+  "ResourceGroup": "database",
+  "Description": "**Azure Cosmos DB accounts** are evaluated for **automatic failover** configuration. When enabled, Cosmos DB automatically promotes a secondary region to primary during a regional outage, ensuring continuous availability without manual intervention.",
+  "Risk": "Without **automatic failover**, a regional outage requires **manual failover** which delays recovery and risks data unavailability. Applications dependent on the primary region experience downtime until an operator intervenes.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/high-availability",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/distribute-data-globally"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --enable-automatic-failover true",
+      "NativeIaC": "```bicep\n// Bicep: Enable automatic failover on a Cosmos DB account\nresource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  kind: 'GlobalDocumentDB'\n  properties: {\n    databaseAccountOfferType: 'Standard'\n    locations: [\n      { locationName: '<primary_region>', failoverPriority: 0 }\n      { locationName: '<secondary_region>', failoverPriority: 1 }\n    ]\n    enableAutomaticFailover: true // Critical: Promotes a secondary region during a primary region outage\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Cosmos DB account\n2. In the left menu, select Replicate data globally\n3. Click Automatic Failover\n4. Toggle Enable Automatic Failover to On\n5. Set failover priorities for each region\n6. Click Save",
+      "Terraform": "```hcl\n# Terraform: Enable automatic failover on a Cosmos DB account\nresource \"azurerm_cosmosdb_account\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<primary_region>\"\n  offer_type          = \"Standard\"\n  kind                = \"GlobalDocumentDB\"\n\n  geo_location {\n    location          = \"<primary_region>\"\n    failover_priority = 0\n  }\n\n  geo_location {\n    location          = \"<secondary_region>\"\n    failover_priority = 1\n  }\n\n  enable_automatic_failover = true # Critical: Promotes a secondary region during a primary region outage\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **automatic failover** on Cosmos DB accounts with **multi-region** deployments so a secondary region is promoted automatically when the primary region becomes unavailable. Configure **failover priorities** to reflect your recovery strategy, validate **RTO/RPO** expectations with periodic failover drills, and combine with **multi-region writes** where active-active is required.",
+      "Url": "https://hub.prowler.com/check/cosmosdb_account_automatic_failover_enabled"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.py
new file mode 100644
index 0000000000..7d7d2e5023
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.py
@@ -0,0 +1,29 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client
+
+
+class cosmosdb_account_automatic_failover_enabled(Check):
+    """Ensure that Cosmos DB accounts have automatic failover enabled."""
+
+    def execute(self) -> Check_Report_Azure:
+        """Execute the Cosmos DB automatic failover check.
+
+        Iterates over every Cosmos DB account fetched by the service and reports
+        PASS when `enableAutomaticFailover` is True, FAIL otherwise.
+
+        Returns:
+            A list of Check_Report_Azure with one report per Cosmos DB account.
+        """
+        findings = []
+        for subscription, accounts in cosmosdb_client.accounts.items():
+            for account in accounts:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
+                report.subscription = subscription
+                report.status = "FAIL"
+                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not have automatic failover enabled."
+                if account.enable_automatic_failover:
+                    report.status = "PASS"
+                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} has automatic failover enabled."
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/__init__.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.metadata.json b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.metadata.json
new file mode 100644
index 0000000000..1631aa5b3a
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "cosmosdb_account_backup_policy_continuous",
+  "CheckTitle": "Cosmos DB account uses continuous backup policy",
+  "CheckType": [],
+  "ServiceName": "cosmosdb",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.documentdb/databaseaccounts",
+  "ResourceGroup": "database",
+  "Description": "**Azure Cosmos DB accounts** are evaluated for **continuous backup** policy. Continuous backup provides **point-in-time restore (PITR)** enabling recovery to any point within the retention window, unlike periodic backup which only supports full restores at fixed intervals.",
+  "Risk": "**Periodic backup** limits recovery to the last backup snapshot. Data changes between snapshots are lost during restore. **Continuous backup** enables **granular recovery** from accidental deletes, corruption, or ransomware.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/continuous-backup-restore-introduction",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/migrate-continuous-backup",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/restore-account-continuous-backup"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --backup-policy-type Continuous --continuous-tier Continuous30Days",
+      "NativeIaC": "```bicep\n// Bicep: Switch a Cosmos DB account to Continuous backup (irreversible)\nresource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  kind: 'GlobalDocumentDB'\n  properties: {\n    databaseAccountOfferType: 'Standard'\n    locations: [{ locationName: resourceGroup().location }]\n    backupPolicy: {\n      type: 'Continuous' // Critical: Enables point-in-time restore. Migration from Periodic is one-way.\n      continuousModeProperties: {\n        tier: 'Continuous30Days' // or 'Continuous7Days' for the lower-cost tier\n      }\n    }\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Cosmos DB account\n2. In the left menu, select Backup & Restore\n3. Click Switch to Continuous backup\n4. Select the retention tier (Continuous30Days or Continuous7Days)\n5. Acknowledge that the migration from Periodic to Continuous is irreversible\n6. Click Save",
+      "Terraform": "```hcl\n# Terraform: Configure Cosmos DB account with Continuous backup (irreversible)\nresource \"azurerm_cosmosdb_account\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<example_resource_name>\"\n  offer_type          = \"Standard\"\n  kind                = \"GlobalDocumentDB\"\n\n  geo_location {\n    location          = \"<example_resource_name>\"\n    failover_priority = 0\n  }\n\n  backup {\n    type = \"Continuous\"          # Critical: Enables point-in-time restore. One-way migration from Periodic.\n    tier = \"Continuous30Days\"    # or \"Continuous7Days\" for the lower-cost tier\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Use **Continuous backup** for Cosmos DB accounts that require **point-in-time restore (PITR)**. Pick the retention tier (`Continuous7Days` or `Continuous30Days`) based on recovery objectives, and validate restore procedures with periodic drills. Note that switching from **Periodic** to **Continuous** is a **one-way** migration; plan the change and review pricing before applying.",
+      "Url": "https://hub.prowler.com/check/cosmosdb_account_backup_policy_continuous"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.py
new file mode 100644
index 0000000000..f1a00fc2e8
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.py
@@ -0,0 +1,30 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client
+
+
+class cosmosdb_account_backup_policy_continuous(Check):
+    """Ensure that Cosmos DB accounts use the continuous backup policy."""
+
+    def execute(self) -> Check_Report_Azure:
+        """Execute the Cosmos DB continuous-backup check.
+
+        Iterates over every Cosmos DB account fetched by the service and reports
+        PASS when `backupPolicy.type` is `Continuous`, FAIL otherwise (including
+        when the property is missing).
+
+        Returns:
+            A list of Check_Report_Azure with one report per Cosmos DB account.
+        """
+        findings = []
+        for subscription, accounts in cosmosdb_client.accounts.items():
+            for account in accounts:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
+                report.subscription = subscription
+                report.status = "FAIL"
+                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not use continuous backup policy."
+                if account.backup_policy_type == "Continuous":
+                    report.status = "PASS"
+                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} uses continuous backup policy."
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/__init__.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.metadata.json b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.metadata.json
new file mode 100644
index 0000000000..f9ddb2baa0
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "cosmosdb_account_minimum_tls_version",
+  "CheckTitle": "Cosmos DB account enforces TLS 1.2 or higher",
+  "CheckType": [],
+  "ServiceName": "cosmosdb",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.documentdb/databaseaccounts",
+  "ResourceGroup": "database",
+  "Description": "**Azure Cosmos DB accounts** are evaluated for **minimum TLS version**. TLS 1.0 and 1.1 are deprecated and contain known weaknesses. Enforcing **TLS 1.2** ensures all client connections negotiate modern, secure encryption protocols.",
+  "Risk": "Allowing **TLS 1.0/1.1** exposes client connections to **POODLE**, **BEAST**, and other protocol downgrade attacks that can compromise the **confidentiality** and **integrity** of data in transit, and may enable credential interception via weakened cipher suites.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/security",
+    "https://learn.microsoft.com/en-us/cli/azure/cosmosdb",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.documentdb/databaseaccounts"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --minimal-tls-version Tls12",
+      "NativeIaC": "```bicep\n// Bicep: Enforce minimum TLS 1.2 on a Cosmos DB account\nresource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  kind: 'GlobalDocumentDB'\n  properties: {\n    databaseAccountOfferType: 'Standard'\n    locations: [{ locationName: resourceGroup().location }]\n    minimalTlsVersion: 'Tls12' // Critical: Rejects client connections negotiating TLS 1.0 or 1.1\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Cosmos DB account\n2. In the left menu, select Networking\n3. Locate the Minimum TLS version setting\n4. Select TLS 1.2\n5. Click Save\n6. Validate that all client applications support TLS 1.2 before enforcing the change",
+      "Terraform": "```hcl\n# Terraform: Enforce minimum TLS 1.2 on a Cosmos DB account\nresource \"azurerm_cosmosdb_account\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<example_location>\"\n  offer_type          = \"Standard\"\n  kind                = \"GlobalDocumentDB\"\n\n  geo_location {\n    location          = \"<example_location>\"\n    failover_priority = 0\n  }\n\n  minimal_tls_version = \"Tls12\" # Critical: Rejects client connections negotiating TLS 1.0 or 1.1\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Set the Cosmos DB account **minimum TLS version** to at least **1.2** to block legacy protocols (`TLS 1.0`/`1.1`) vulnerable to known downgrade and cipher attacks. Inventory and update **client SDKs** and **drivers** to support TLS 1.2 prior to enforcement, and pair this control with **private endpoints**, **AAD/RBAC authentication**, and **handshake failure monitoring** to identify outdated clients.",
+      "Url": "https://hub.prowler.com/check/cosmosdb_account_minimum_tls_version"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.py
new file mode 100644
index 0000000000..5d85072367
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.py
@@ -0,0 +1,30 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client
+
+
+class cosmosdb_account_minimum_tls_version(Check):
+    """Ensure that Cosmos DB accounts enforce TLS 1.2 or higher."""
+
+    def execute(self) -> Check_Report_Azure:
+        """Execute the Cosmos DB minimum TLS version check.
+
+        Iterates over every Cosmos DB account fetched by the service and reports
+        PASS when `minimalTlsVersion` is `Tls12` or higher, FAIL otherwise
+        (including when the property is missing or set to a legacy value).
+
+        Returns:
+            A list of Check_Report_Azure with one report per Cosmos DB account.
+        """
+        findings = []
+        for subscription, accounts in cosmosdb_client.accounts.items():
+            for account in accounts:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
+                report.subscription = subscription
+                report.status = "FAIL"
+                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not enforce TLS 1.2 or higher."
+                if account.minimal_tls_version in {"Tls12", "Tls13"}:
+                    report.status = "PASS"
+                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} enforces TLS 1.2 or higher."
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/__init__.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.metadata.json b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.metadata.json
new file mode 100644
index 0000000000..2d8a61a54e
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "cosmosdb_account_public_network_access_disabled",
+  "CheckTitle": "Cosmos DB account has public network access disabled",
+  "CheckType": [],
+  "ServiceName": "cosmosdb",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.documentdb/databaseaccounts",
+  "ResourceGroup": "database",
+  "Description": "**Azure Cosmos DB accounts** are evaluated for **public network access**. Disabling public network access ensures the account is only reachable through **private endpoints** or **VNet service endpoints**, reducing the attack surface and preventing direct exposure of the data plane to the internet.",
+  "Risk": "Allowing **public network access** exposes the Cosmos DB data plane to the internet. Combined with leaked **connection strings**, weak **firewall rules**, or compromised **AAD tokens**, this enables **unauthorized data access**, **enumeration**, **brute force**, and **data exfiltration** from any source on the internet.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-private-endpoints",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-firewall",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.documentdb/databaseaccounts"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --public-network-access Disabled",
+      "NativeIaC": "```bicep\n// Bicep: Disable public network access on a Cosmos DB account\nresource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  kind: 'GlobalDocumentDB'\n  properties: {\n    databaseAccountOfferType: 'Standard'\n    locations: [{ locationName: resourceGroup().location }]\n    publicNetworkAccess: 'Disabled' // Critical: Blocks all public-internet traffic to the data plane\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Cosmos DB account\n2. In the left menu, select Networking\n3. Under Public network access, select Disabled\n4. Configure private endpoints or VNet service endpoints before saving so clients retain connectivity\n5. Click Save",
+      "Terraform": "```hcl\n# Terraform: Disable public network access on a Cosmos DB account\nresource \"azurerm_cosmosdb_account\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<example_location>\"\n  offer_type          = \"Standard\"\n  kind                = \"GlobalDocumentDB\"\n\n  geo_location {\n    location          = \"<example_location>\"\n    failover_priority = 0\n  }\n\n  public_network_access_enabled = false # Critical: Blocks all public-internet traffic to the data plane\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Disable **public network access** on Cosmos DB accounts and require connectivity via **private endpoints** or **VNet service endpoints**. Before enforcement, validate that all application workloads have private-network connectivity, and pair this control with **AAD/RBAC authentication**, **TLS 1.2+**, and **firewall rules** restricted to the minimum trusted ranges to uphold **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/cosmosdb_account_public_network_access_disabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.py
new file mode 100644
index 0000000000..ec2d29728d
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.py
@@ -0,0 +1,31 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client
+
+
+class cosmosdb_account_public_network_access_disabled(Check):
+    """Ensure that Cosmos DB accounts have public network access disabled."""
+
+    def execute(self) -> Check_Report_Azure:
+        """Execute the Cosmos DB public network access check.
+
+        Iterates over every Cosmos DB account fetched by the service and reports
+        PASS when `publicNetworkAccess` is `Disabled` or `SecuredByPerimeter`
+        (Microsoft Network Security Perimeter), FAIL otherwise (including when
+        the property is missing or set to `Enabled`).
+
+        Returns:
+            A list of Check_Report_Azure with one report per Cosmos DB account.
+        """
+        findings = []
+        for subscription, accounts in cosmosdb_client.accounts.items():
+            for account in accounts:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
+                report.subscription = subscription
+                report.status = "FAIL"
+                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not have public network access disabled (current value: {account.public_network_access!r})."
+                if account.public_network_access in {"Disabled", "SecuredByPerimeter"}:
+                    report.status = "PASS"
+                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} has public network access disabled."
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py
index c36af1d2e9..e7c53799a7 100644
--- a/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py
@@ -1,5 +1,5 @@
 from dataclasses import dataclass
-from typing import List
+from typing import List, Optional
 
 from azure.mgmt.cosmosdb import CosmosDBManagementClient
 
@@ -36,14 +36,29 @@ class CosmosDB(AzureService):
                                     name=private_endpoint_connection.name,
                                     type=private_endpoint_connection.type,
                                 )
-                                for private_endpoint_connection in getattr(
-                                    account, "private_endpoint_connections", []
+                                for private_endpoint_connection in (
+                                    getattr(account, "private_endpoint_connections", [])
+                                    or []
                                 )
                                 if private_endpoint_connection
                             ],
                             disable_local_auth=getattr(
                                 account, "disable_local_auth", False
                             ),
+                            enable_automatic_failover=getattr(
+                                account, "enable_automatic_failover", False
+                            ),
+                            backup_policy_type=getattr(
+                                getattr(account, "backup_policy", None),
+                                "type",
+                                None,
+                            ),
+                            public_network_access=getattr(
+                                account, "public_network_access", None
+                            ),
+                            minimal_tls_version=getattr(
+                                account, "minimal_tls_version", None
+                            ),
                         )
                     )
             except Exception as error:
@@ -71,3 +86,7 @@ class Account:
     location: str
     private_endpoint_connections: List[PrivateEndpointConnection]
     disable_local_auth: bool = False
+    enable_automatic_failover: bool = False
+    backup_policy_type: Optional[str] = None
+    public_network_access: Optional[str] = None
+    minimal_tls_version: Optional[str] = None
diff --git a/prowler/providers/azure/services/databricks/databricks_service.py b/prowler/providers/azure/services/databricks/databricks_service.py
index 7920500d88..b7367d3cbb 100644
--- a/prowler/providers/azure/services/databricks/databricks_service.py
+++ b/prowler/providers/azure/services/databricks/databricks_service.py
@@ -62,10 +62,21 @@ class Databricks(AzureService):
                     else:
                         managed_disk_encryption = None
 
+                    enable_no_public_ip = getattr(
+                        workspace_parameters, "enable_no_public_ip", None
+                    )
                     workspaces[subscription][workspace.id] = DatabricksWorkspace(
                         id=workspace.id,
                         name=workspace.name,
                         location=workspace.location,
+                        public_network_access=getattr(
+                            workspace, "public_network_access", None
+                        ),
+                        no_public_ip_enabled=(
+                            getattr(enable_no_public_ip, "value", None)
+                            if enable_no_public_ip
+                            else None
+                        ),
                         custom_managed_vnet_id=(
                             getattr(
                                 workspace_parameters, "custom_virtual_network_id", None
@@ -107,6 +118,8 @@ class DatabricksWorkspace(BaseModel):
         id: The unique identifier of the workspace.
         name: The name of the workspace.
         location: The Azure region where the workspace is deployed.
+        public_network_access: Whether public network access is "Enabled" or "Disabled", if configured.
+        no_public_ip_enabled: Whether secure cluster connectivity (no public IP) is enabled. None when the workspace does not expose this classic-compute setting (e.g. serverless workspaces).
         custom_managed_vnet_id: The ID of the custom managed virtual network, if configured.
         managed_disk_encryption: The encryption settings for the workspace's managed disks.
     """
@@ -114,5 +127,7 @@ class DatabricksWorkspace(BaseModel):
     id: str
     name: str
     location: str
+    public_network_access: Optional[str] = None
+    no_public_ip_enabled: Optional[bool] = None
     custom_managed_vnet_id: Optional[str] = None
     managed_disk_encryption: Optional[ManagedDiskEncryption] = None
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/__init__.py b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.metadata.json b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.metadata.json
new file mode 100644
index 0000000000..4062199474
--- /dev/null
+++ b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "databricks_workspace_no_public_ip_enabled",
+  "CheckTitle": "Databricks workspace has secure cluster connectivity (no public IP)",
+  "CheckType": [],
+  "ServiceName": "databricks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.databricks/workspaces",
+  "ResourceGroup": "ai_ml",
+  "Description": "**Azure Databricks workspaces** are evaluated for **secure cluster connectivity** (No Public IP / NPIP). When enabled, compute (cluster) nodes are deployed without public IP addresses and communicate with the control plane through a secure relay, reducing the workspace's exposure to the internet.",
+  "Risk": "Without **secure cluster connectivity**, Databricks compute nodes are assigned **public IP addresses** and are directly reachable from the internet. This enables **port scanning**, **lateral movement** from a compromised node, and **data exfiltration** that bypasses private-network controls.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/secure-cluster-connectivity",
+    "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/vnet-inject",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.databricks/workspaces"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az databricks workspace create --name <workspace_name> --resource-group <resource_group_name> --location <region> --sku premium --enable-no-public-ip",
+      "NativeIaC": "```bicep\n// Bicep: Deploy a Databricks workspace with secure cluster connectivity (No Public IP)\nresource workspace 'Microsoft.Databricks/workspaces@2023-02-01' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  sku: {\n    name: 'premium'\n  }\n  properties: {\n    managedResourceGroupId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>'\n    parameters: {\n      enableNoPublicIp: {\n        value: true // CRITICAL: Deploys cluster nodes without public IP addresses\n      }\n    }\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and start creating a new Azure Databricks workspace (No Public IP must be set at creation; it cannot be enabled on an existing workspace)\n2. On the Networking tab, set Deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) to Yes\n3. Complete the VNet injection configuration if required\n4. Review + create the workspace\n5. Migrate workloads to the new workspace and decommission the old one",
+      "Terraform": "```hcl\n# Terraform: Databricks workspace with secure cluster connectivity (No Public IP)\nresource \"azurerm_databricks_workspace\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<region>\"\n  sku                 = \"premium\"\n\n  custom_parameters {\n    no_public_ip = true # CRITICAL: Deploys cluster nodes without public IP addresses\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Deploy Databricks workspaces with **secure cluster connectivity (No Public IP)** so compute nodes have no public IP addresses. Because this is set at creation, plan a migration for existing workspaces, and pair it with **VNet injection**, **private endpoints / disabled public network access**, and least-privilege NSG rules to uphold **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/databricks_workspace_no_public_ip_enabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Secure cluster connectivity (No Public IP) applies to classic compute and is set at workspace creation. Serverless workspaces do not expose this setting (they have no customer-managed cluster nodes with public IPs) and are reported as MANUAL for verification."
+}
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.py b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.py
new file mode 100644
index 0000000000..13b7742ffa
--- /dev/null
+++ b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.py
@@ -0,0 +1,41 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.databricks.databricks_client import (
+    databricks_client,
+)
+
+
+class databricks_workspace_no_public_ip_enabled(Check):
+    """
+    Ensure Azure Databricks workspaces have secure cluster connectivity (no public IP) enabled.
+
+    This check evaluates whether each Azure Databricks workspace in the subscription is deployed with secure cluster connectivity (No Public IP / NPIP), so cluster nodes are not assigned public IP addresses.
+
+    Secure cluster connectivity is a classic-compute setting. Serverless workspaces do not expose it (they have no customer-managed cluster nodes with public IPs), so the workspace is reported as MANUAL for verification rather than failed.
+
+    - PASS: The workspace has secure cluster connectivity enabled (no_public_ip_enabled is True).
+    - FAIL: The workspace has secure cluster connectivity disabled (no_public_ip_enabled is False).
+    - MANUAL: The workspace does not expose the setting (no_public_ip_enabled is None, e.g. serverless workspaces).
+    """
+
+    def execute(self):
+        findings = []
+        for subscription, workspaces in databricks_client.workspaces.items():
+            subscription_name = databricks_client.subscriptions.get(
+                subscription, subscription
+            )
+            for workspace in workspaces.values():
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource=workspace
+                )
+                report.subscription = subscription
+                if workspace.no_public_ip_enabled is None:
+                    report.status = "MANUAL"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) does not expose secure cluster connectivity (no public IP) settings (for example, serverless workspaces have no public-IP cluster nodes); verify the network configuration manually."
+                elif workspace.no_public_ip_enabled:
+                    report.status = "PASS"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has secure cluster connectivity (no public IP) enabled."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) does not have secure cluster connectivity (no public IP) enabled."
+                findings.append(report)
+        return findings
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/__init__.py b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.metadata.json b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.metadata.json
new file mode 100644
index 0000000000..cb92d6df0f
--- /dev/null
+++ b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "databricks_workspace_public_network_access_disabled",
+  "CheckTitle": "Databricks workspace has public network access disabled",
+  "CheckType": [],
+  "ServiceName": "databricks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "microsoft.databricks/workspaces",
+  "ResourceGroup": "ai_ml",
+  "Description": "**Azure Databricks workspaces** are evaluated for **public network access**. Disabling public network access ensures the workspace is only reachable through **private endpoints**, reducing the attack surface and preventing direct exposure of the control plane and data plane to the internet.",
+  "Risk": "Allowing **public network access** exposes the Databricks workspace control plane and data plane to the internet. Combined with leaked **credentials**, **personal access tokens**, or unpatched vulnerabilities, this enables **unauthorized access**, **brute force**, and **data exfiltration** from any source on the internet.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/private-link",
+    "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/private-link#step-4-disable-public-network-access",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.databricks/workspaces"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az databricks workspace update --name <workspace_name> --resource-group <resource_group_name> --public-network-access Disabled",
+      "NativeIaC": "```bicep\n// Bicep: Disable public network access on a Databricks workspace\nresource workspace 'Microsoft.Databricks/workspaces@2023-02-01' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  sku: {\n    name: 'premium'\n  }\n  properties: {\n    managedResourceGroupId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>'\n    publicNetworkAccess: 'Disabled' // CRITICAL: Blocks all public-internet traffic to the workspace\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Databricks workspace\n2. In the left menu, select Networking\n3. Under Public network access, select Disabled\n4. Configure Azure Private Link private endpoints before saving so clients retain connectivity\n5. Click Save",
+      "Terraform": "```hcl\n# Terraform: Disable public network access on a Databricks workspace\nresource \"azurerm_databricks_workspace\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<region>\"\n  sku                 = \"premium\"\n\n  public_network_access_enabled = false # CRITICAL: Blocks all public-internet traffic to the workspace\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Disable **public network access** on Databricks workspaces and require connectivity via **Azure Private Link** private endpoints. Before enforcement, validate that all application workloads have private-network connectivity, and pair this control with **VNet injection**, **secure cluster connectivity (no public IP)**, and least-privilege access to uphold **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/databricks_workspace_public_network_access_disabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.py b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.py
new file mode 100644
index 0000000000..e8193cedb6
--- /dev/null
+++ b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.py
@@ -0,0 +1,35 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.databricks.databricks_client import (
+    databricks_client,
+)
+
+
+class databricks_workspace_public_network_access_disabled(Check):
+    """
+    Ensure Azure Databricks workspaces have public network access disabled.
+
+    This check evaluates whether each Azure Databricks workspace in the subscription restricts connectivity to private endpoints by disabling public network access.
+
+    - PASS: The workspace has public network access disabled (public_network_access is "Disabled").
+    - FAIL: The workspace has public network access enabled (or the value is not set).
+    """
+
+    def execute(self):
+        findings = []
+        for subscription, workspaces in databricks_client.workspaces.items():
+            subscription_name = databricks_client.subscriptions.get(
+                subscription, subscription
+            )
+            for workspace in workspaces.values():
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource=workspace
+                )
+                report.subscription = subscription
+                if workspace.public_network_access == "Disabled":
+                    report.status = "PASS"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has public network access disabled."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has public network access enabled."
+                findings.append(report)
+        return findings
diff --git a/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/__init__.py b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.metadata.json b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.metadata.json
new file mode 100644
index 0000000000..cae92490af
--- /dev/null
+++ b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "defender_ensure_defender_cspm_is_on",
+  "CheckTitle": "Microsoft Defender CSPM is set to On",
+  "CheckType": [],
+  "ServiceName": "defender",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.security/pricings",
+  "ResourceGroup": "security",
+  "Description": "**Microsoft Defender for Cloud** Cloud Security Posture Management (CSPM) plan is evaluated for **standard tier** activation. Defender CSPM provides advanced posture management capabilities including attack path analysis, cloud security explorer, agentless scanning, and governance rules.",
+  "Risk": "Without Defender CSPM, the subscription relies on **foundational CSPM** (free tier) which lacks attack path analysis, agentless vulnerability scanning, and security governance. Advanced threats exploiting misconfiguration chains go undetected.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management",
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-enhanced-security"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az security pricing create -n CloudPosture --tier Standard",
+      "NativeIaC": "```bicep\ntargetScope = 'subscription'\n\nresource defenderCSPM 'Microsoft.Security/pricings@2024-01-01' = {\n  name: 'CloudPosture'\n  properties: {\n    pricingTier: 'Standard' // Critical: enables Defender CSPM\n  }\n}\n```",
+      "Other": "1. Sign in to Azure portal\n2. Go to Microsoft Defender for Cloud\n3. Select Environment Settings\n4. Click on the subscription\n5. Set Cloud Security Posture Management (CSPM) to On\n6. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_security_center_subscription_pricing\" \"<example_resource_name>\" {\n  tier          = \"Standard\"  # Critical: enables Defender CSPM\n  resource_type = \"CloudPosture\"\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **Defender CSPM** standard tier for advanced cloud security posture management. Evaluate the cost against the security benefits \u2014 CSPM provides attack path analysis and agentless scanning.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_cspm_is_on"
+    }
+  },
+  "Categories": [
+    "threat-detection"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.py b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.py
new file mode 100644
index 0000000000..cf7957400c
--- /dev/null
+++ b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.py
@@ -0,0 +1,35 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.defender.defender_client import defender_client
+
+
+class defender_ensure_defender_cspm_is_on(Check):
+    """
+    Ensure Microsoft Defender Cloud Security Posture Management (CSPM) is set to On.
+
+    This check evaluates whether the Defender CSPM plan (CloudPosture pricing) is enabled with the Standard tier for each subscription.
+
+    - PASS: The CloudPosture pricing tier is "Standard" (Defender CSPM is on).
+    - FAIL: The CloudPosture pricing tier is not "Standard" (Defender CSPM is off).
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for subscription, pricings in defender_client.pricings.items():
+            subscription_name = defender_client.subscriptions.get(
+                subscription, subscription
+            )
+            if "CloudPosture" in pricings:
+                report = Check_Report_Azure(
+                    metadata=self.metadata(),
+                    resource=pricings["CloudPosture"],
+                )
+                report.subscription = subscription
+                report.resource_name = "Defender plan CSPM"
+                report.status = "PASS"
+                report.status_extended = f"Defender plan CSPM from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
+                if pricings["CloudPosture"].pricing_tier != "Standard":
+                    report.status = "FAIL"
+                    report.status_extended = f"Defender plan CSPM from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."
+
+                findings.append(report)
+        return findings
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/__init__.py b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.metadata.json b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.metadata.json
new file mode 100644
index 0000000000..1dac541283
--- /dev/null
+++ b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "mysql_flexible_server_geo_redundant_backup_enabled",
+  "CheckTitle": "MySQL flexible server has geo-redundant backup enabled",
+  "CheckType": [],
+  "ServiceName": "mysql",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.dbformysql/flexibleservers",
+  "ResourceGroup": "database",
+  "Description": "**Azure MySQL Flexible Server** is evaluated for **geo-redundant backup**. Geo-redundant backup stores backup copies in a paired Azure region, enabling restore and recovery from a full regional outage.",
+  "Risk": "Without **geo-redundant backup**, a regional disaster can cause **permanent data loss**. Locally redundant backups only protect against storage hardware failures within the same region and cannot be restored if the primary region becomes unavailable.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-backup-restore",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformysql/flexibleservers"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az mysql flexible-server create --name <server_name> --resource-group <resource_group_name> --location <region> --geo-redundant-backup Enabled",
+      "NativeIaC": "```bicep\n// Bicep: MySQL Flexible Server with geo-redundant backup (set at creation)\nresource mysql 'Microsoft.DBforMySQL/flexibleServers@2023-12-30' = {\n  name: '<example_resource_name>'\n  location: '<region>'\n  properties: {\n    backup: {\n      geoRedundantBackup: 'Enabled' // CRITICAL: stores backups in the paired region\n    }\n  }\n}\n```",
+      "Other": "1. Geo-redundant backup must be configured when the server is created; it cannot be enabled on an existing server\n2. In the Azure portal, start creating a new Azure Database for MySQL flexible server\n3. On the Basics tab, under Compute + storage, open Configure server\n4. Set Geographically redundant backup to Enabled and save\n5. Finish creating the server and migrate workloads to it",
+      "Terraform": "```hcl\n# Terraform: MySQL Flexible Server with geo-redundant backup (set at creation)\nresource \"azurerm_mysql_flexible_server\" \"<example_resource_name>\" {\n  name                         = \"<example_resource_name>\"\n  resource_group_name          = \"<example_resource_name>\"\n  location                     = \"<region>\"\n  geo_redundant_backup_enabled = true # CRITICAL: stores backups in the paired region\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **geo-redundant backup** on MySQL Flexible Servers so backups are replicated to the paired Azure region and can be restored during a regional outage. Because this is set at server creation, plan a migration for existing servers, and pair it with an appropriate backup retention period and periodic restore testing.",
+      "Url": "https://hub.prowler.com/check/mysql_flexible_server_geo_redundant_backup_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Geo-redundant backup for Azure MySQL Flexible Server can only be configured at server creation time and cannot be changed afterwards."
+}
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.py b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.py
new file mode 100644
index 0000000000..5b1685354c
--- /dev/null
+++ b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.py
@@ -0,0 +1,31 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.mysql.mysql_client import mysql_client
+
+
+class mysql_flexible_server_geo_redundant_backup_enabled(Check):
+    """
+    Ensure Azure MySQL Flexible Servers have geo-redundant backup enabled.
+
+    This check evaluates whether each Azure MySQL Flexible Server stores backups in a paired Azure region, enabling recovery from a full regional outage.
+
+    - PASS: The server has geo-redundant backup enabled (geo_redundant_backup is "Enabled").
+    - FAIL: The server does not have geo-redundant backup enabled.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for subscription_id, servers in mysql_client.flexible_servers.items():
+            subscription_name = mysql_client.subscriptions.get(
+                subscription_id, subscription_id
+            )
+            for server in servers.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
+                report.subscription = subscription_id
+                if server.geo_redundant_backup == "Enabled":
+                    report.status = "PASS"
+                    report.status_extended = f"Geo-redundant backup is enabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Geo-redundant backup is disabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                findings.append(report)
+        return findings
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/__init__.py b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.metadata.json b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.metadata.json
new file mode 100644
index 0000000000..22a9b93401
--- /dev/null
+++ b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "mysql_flexible_server_high_availability_enabled",
+  "CheckTitle": "MySQL flexible server has high availability enabled",
+  "CheckType": [],
+  "ServiceName": "mysql",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.dbformysql/flexibleservers",
+  "ResourceGroup": "database",
+  "Description": "**Azure MySQL Flexible Server** is evaluated for **high availability** mode. Zone-redundant or same-zone HA provisions a standby replica and provides automatic failover during planned and unplanned outages.",
+  "Risk": "Without **high availability**, a server or zone failure causes **downtime** until manual recovery or redeployment. Applications experience extended unavailability and potential data loss for in-flight transactions during unplanned outages.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-high-availability",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformysql/flexibleservers"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az mysql flexible-server update --name <server_name> --resource-group <resource_group_name> --high-availability ZoneRedundant",
+      "NativeIaC": "```bicep\n// Bicep: MySQL Flexible Server with zone-redundant high availability\nresource mysql 'Microsoft.DBforMySQL/flexibleServers@2023-12-30' = {\n  name: '<example_resource_name>'\n  location: '<region>'\n  sku: {\n    name: 'Standard_D2ds_v4'\n    tier: 'GeneralPurpose'\n  }\n  properties: {\n    highAvailability: {\n      mode: 'ZoneRedundant' // CRITICAL: provisions a standby replica with automatic failover\n    }\n  }\n}\n```",
+      "Other": "1. In the Azure portal, open your Azure Database for MySQL flexible server\n2. Under Settings, select High availability\n3. Enable High availability and choose Zone redundant (or Same zone)\n4. Save (high availability requires the General Purpose or Business Critical tier)",
+      "Terraform": "```hcl\n# Terraform: MySQL Flexible Server with zone-redundant high availability\nresource \"azurerm_mysql_flexible_server\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<region>\"\n  sku_name            = \"GP_Standard_D2ds_v4\"\n\n  high_availability {\n    mode = \"ZoneRedundant\" # CRITICAL: provisions a standby replica with automatic failover\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **high availability** (zone-redundant where supported, otherwise same-zone) on production MySQL Flexible Servers so a standby replica provides automatic failover. High availability requires the General Purpose or Business Critical tier; pair it with geo-redundant backup and periodic failover testing for full resilience.",
+      "Url": "https://hub.prowler.com/check/mysql_flexible_server_high_availability_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "High availability for Azure MySQL Flexible Server requires the General Purpose or Business Critical compute tier and is not available on the Burstable tier."
+}
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.py b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.py
new file mode 100644
index 0000000000..e1f3054baf
--- /dev/null
+++ b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.py
@@ -0,0 +1,34 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.mysql.mysql_client import mysql_client
+
+
+class mysql_flexible_server_high_availability_enabled(Check):
+    """
+    Ensure Azure MySQL Flexible Servers have high availability enabled.
+
+    This check evaluates whether each Azure MySQL Flexible Server is configured with high availability (zone-redundant or same-zone), providing automatic failover to a standby replica during outages.
+
+    - PASS: The server has high availability enabled (high_availability_mode is set and not "Disabled").
+    - FAIL: The server does not have high availability enabled.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for subscription_id, servers in mysql_client.flexible_servers.items():
+            subscription_name = mysql_client.subscriptions.get(
+                subscription_id, subscription_id
+            )
+            for server in servers.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
+                report.subscription = subscription_id
+                if (
+                    server.high_availability_mode is not None
+                    and server.high_availability_mode != "Disabled"
+                ):
+                    report.status = "PASS"
+                    report.status_extended = f"High availability is enabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"High availability is disabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                findings.append(report)
+        return findings
diff --git a/prowler/providers/azure/services/mysql/mysql_service.py b/prowler/providers/azure/services/mysql/mysql_service.py
index 565e14da01..b3a386a193 100644
--- a/prowler/providers/azure/services/mysql/mysql_service.py
+++ b/prowler/providers/azure/services/mysql/mysql_service.py
@@ -1,4 +1,5 @@
 from dataclasses import dataclass
+from typing import Optional
 
 from azure.mgmt.rdbms.mysql_flexibleservers import MySQLManagementClient
 
@@ -21,6 +22,8 @@ class MySQL(AzureService):
                 servers_list = client.servers.list()
                 servers.update({subscription_id: {}})
                 for server in servers_list:
+                    backup = getattr(server, "backup", None)
+                    ha = getattr(server, "high_availability", None)
                     servers[subscription_id].update(
                         {
                             server.id: FlexibleServer(
@@ -31,6 +34,10 @@ class MySQL(AzureService):
                                 configurations=self._get_configurations(
                                     client, server.id.split("/")[4], server.name
                                 ),
+                                geo_redundant_backup=getattr(
+                                    backup, "geo_redundant_backup", None
+                                ),
+                                high_availability_mode=getattr(ha, "mode", None),
                             )
                         }
                     )
@@ -78,3 +85,5 @@ class FlexibleServer:
     location: str
     version: str
     configurations: dict[Configuration]
+    geo_redundant_backup: Optional[str] = None
+    high_availability_mode: Optional[str] = None
diff --git a/prowler/providers/common/arguments.py b/prowler/providers/common/arguments.py
index 9745bab2ca..2e4d9c8896 100644
--- a/prowler/providers/common/arguments.py
+++ b/prowler/providers/common/arguments.py
@@ -10,24 +10,107 @@ provider_arguments_lib_path = "lib.arguments.arguments"
 validate_provider_arguments_function = "validate_arguments"
 init_provider_arguments_function = "init_parser"
 
+# Kept in sync with parser.py's argv normalisation; both consumers import this.
+PROVIDER_ALIASES = {
+    "microsoft365": "m365",
+    "oci": "oraclecloud",
+}
+
+
+def _invoked_provider_from_argv(available_providers: Sequence[str]) -> Optional[str]:
+    """Return the provider name the user invoked, or None.
+
+    Mirrors `ProwlerArgumentParser.parse()` resolution: only inspects
+    `sys.argv[1]`. Scanning the whole argv would misclassify
+    `prowler --output-directory stackit` as `stackit`.
+    """
+    available = set(available_providers)
+    if len(sys.argv) < 2:
+        return "aws" if "aws" in available else None
+    first = sys.argv[1]
+    if first in ("-h", "--help", "-v", "--version"):
+        return None
+    if first.startswith("-"):
+        return "aws" if "aws" in available else None
+    normalized = PROVIDER_ALIASES.get(first, first)
+    return normalized if normalized in available else None
+
 
 def init_providers_parser(self):
-    """init_providers_parser calls the provider init_parser function to load all the arguments and flags. Receives a ProwlerArgumentParser object"""
-    # We need to call the arguments parser for each provider
+    """Build the subparser of each available provider.
+
+    Built-in load failures are captured silently on
+    `self._builtin_load_failures`; the warn/exit decision is deferred to
+    `enforce_invoked_provider_loaded()` because `parse(args=...)` can
+    override `sys.argv` after this function ran.
+    """
+    self._builtin_load_failures = {}
     providers = Provider.get_available_providers()
     for provider in providers:
-        try:
-            getattr(
-                import_module(
-                    f"{providers_path}.{provider}.{provider_arguments_lib_path}"
-                ),
-                init_provider_arguments_function,
-            )(self)
-        except Exception as error:
-            logger.critical(
+        if Provider.is_builtin(provider):
+            try:
+                getattr(
+                    import_module(
+                        f"{providers_path}.{provider}.{provider_arguments_lib_path}"
+                    ),
+                    init_provider_arguments_function,
+                )(self)
+            except Exception as error:
+                self._builtin_load_failures[provider] = error
+        else:
+            cls = Provider._load_ep_provider(provider)
+            if cls and hasattr(cls, "init_parser"):
+                try:
+                    cls.init_parser(self)
+                except Exception as error:
+                    logger.warning(
+                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+
+
+def enforce_invoked_provider_loaded(self):
+    """Apply selective fail-loud over the failures captured at init time.
+
+    Called by `ProwlerArgumentParser.parse()` AFTER argv normalisation so
+    the invoked provider matches what argparse will dispatch to — including
+    the case where `parse(args=...)` overrode the ambient `sys.argv`.
+
+    Invoked + failed → critical + `sys.exit(1)`. Others → warning.
+    """
+    failures = getattr(self, "_builtin_load_failures", {})
+    if not failures:
+        return
+    invoked = _invoked_provider_from_argv(Provider.get_available_providers())
+    for provider, error in failures.items():
+        if provider == invoked:
+            continue
+        if isinstance(error, ImportError):
+            logger.warning(
+                f"Skipping built-in provider '{provider}' due to missing "
+                f"dependency: {error}. It will be unavailable in this "
+                f"invocation, but the CLI continues because you invoked a "
+                f"different provider."
+            )
+        else:
+            logger.warning(
+                f"Skipping built-in provider '{provider}': "
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
-            sys.exit(1)
+    if invoked is None or invoked not in failures:
+        return
+    error = failures[invoked]
+    if isinstance(error, ImportError):
+        logger.critical(
+            f"Failed to load arguments for built-in provider '{invoked}'. "
+            f"Missing dependency: {error}. "
+            f"Ensure all required dependencies are installed."
+        )
+        logger.debug("Full traceback:", exc_info=True)
+    else:
+        logger.critical(
+            f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+        )
+    sys.exit(1)
 
 
 def validate_provider_arguments(arguments: Namespace) -> tuple[bool, str]:
diff --git a/prowler/providers/common/builtin.py b/prowler/providers/common/builtin.py
new file mode 100644
index 0000000000..d60b5483d9
--- /dev/null
+++ b/prowler/providers/common/builtin.py
@@ -0,0 +1,29 @@
+"""Leaf helper for built-in provider detection.
+
+Lives in its own module — with no imports back into `prowler.lib.check` — so
+that callers in `prowler.lib.check.*` can ask "is this provider built-in?"
+without creating an import cycle through `prowler.providers.common.provider`
+(which transitively imports `prowler.config.config` and from there
+`prowler.lib.check.compliance_models` / `prowler.lib.check.external_tool_providers`).
+
+Same rationale as `prowler.lib.check.tool_wrapper`: extracting the predicate
+to a leaf module is the canonical way to break the cycle in this codebase.
+"""
+
+import importlib.util
+
+
+def is_builtin_provider(provider: str) -> bool:
+    """Return True if the provider's own package ships with the SDK.
+
+    Wraps `importlib.util.find_spec` in `try/except (ImportError, ValueError)`
+    because `find_spec` propagates `ModuleNotFoundError` when a parent package
+    in the dotted path does not exist (instead of returning `None`). The
+    try/except is what makes the call safe for external providers, whose
+    package does not live under `prowler.providers.{provider}`.
+    """
+    try:
+        spec = importlib.util.find_spec(f"prowler.providers.{provider}")
+        return spec is not None
+    except (ImportError, ValueError):
+        return False
diff --git a/prowler/providers/common/models.py b/prowler/providers/common/models.py
index ea70252f0a..120cc1a374 100644
--- a/prowler/providers/common/models.py
+++ b/prowler/providers/common/models.py
@@ -4,6 +4,7 @@ from os.path import isdir
 
 from pydantic.v1 import BaseModel
 
+from prowler.config.config import output_file_timestamp
 from prowler.providers.common.provider import Provider
 
 
@@ -69,3 +70,15 @@ class Connection:
 
     is_connected: bool = False
     error: Exception = None
+
+
+def default_output_options(provider, arguments, bulk_checks_metadata):
+    """Generic OutputOptions fallback for external providers that do not
+    implement get_output_options, so the run still produces output instead of
+    aborting. Honors arguments.output_filename and otherwise derives a name
+    from the provider type."""
+    output_options = ProviderOutputOptions(arguments, bulk_checks_metadata)
+    output_options.output_filename = getattr(arguments, "output_filename", None) or (
+        f"prowler-output-{provider.type}-{output_file_timestamp}"
+    )
+    return output_options
diff --git a/prowler/providers/common/provider.py b/prowler/providers/common/provider.py
index d11b015d54..77ae9180a3 100644
--- a/prowler/providers/common/provider.py
+++ b/prowler/providers/common/provider.py
@@ -1,4 +1,6 @@
 import importlib
+import importlib.metadata
+import importlib.util
 import os
 import pkgutil
 import sys
@@ -136,6 +138,106 @@ class Provider(ABC):
         """
         return set()
 
+    # --- Dynamic provider contract methods (not @abstractmethod for incremental migration) ---
+
+    _cli_help_text: str = ""
+
+    @classmethod
+    def from_cli_args(cls, arguments: Namespace, fixer_config: dict) -> "Provider":
+        """Instantiate the provider from CLI arguments and return the instance.
+
+        The caller wires the returned instance into the global provider slot
+        via Provider.set_global_provider(). Implementations that already call
+        set_global_provider(self) from __init__ are also supported — the call
+        site tolerates a None return in that case.
+        """
+        raise NotImplementedError(f"{cls.__name__} has not implemented from_cli_args()")
+
+    def get_output_options(self, arguments, _bulk_checks_metadata):
+        """Create the provider-specific OutputOptions."""
+        raise NotImplementedError(
+            f"{self.__class__.__name__} has not implemented get_output_options()"
+        )
+
+    def get_stdout_detail(self, _finding) -> str:
+        """Return the detail string for stdout reporting (region, location, etc.)."""
+        raise NotImplementedError(
+            f"{self.__class__.__name__} has not implemented get_stdout_detail()"
+        )
+
+    def get_finding_sort_key(self) -> Optional[str]:
+        """Return the attribute name to sort findings by, or None for no sorting."""
+        return None
+
+    def get_summary_entity(self) -> tuple:
+        """Return (entity_type, audited_entities) for the summary table."""
+        return (self.type, getattr(self.identity, "account_id", ""))
+
+    def get_finding_output_data(self, _check_output) -> dict:
+        """Return provider-specific fields for Finding.generate_output()."""
+        raise NotImplementedError(
+            f"{self.__class__.__name__} has not implemented get_finding_output_data()"
+        )
+
+    def get_html_assessment_summary(self) -> str:
+        """Return the HTML assessment summary card for this provider."""
+        raise NotImplementedError(
+            f"{self.__class__.__name__} has not implemented get_html_assessment_summary()"
+        )
+
+    def generate_compliance_output(
+        self,
+        _findings,
+        _bulk_compliance_frameworks,
+        _input_compliance_frameworks,
+        _output_options,
+        _generated_outputs,
+    ) -> None:
+        """Generate compliance CSV output for this provider's frameworks."""
+        raise NotImplementedError(
+            f"{self.__class__.__name__} has not implemented generate_compliance_output()"
+        )
+
+    def get_mutelist_finding_args(self) -> dict:
+        """Return extra kwargs for mutelist.is_finding_muted() besides 'finding'.
+
+        External providers must return a dict with the identity key their
+        Mutelist subclass expects, e.g. ``{"account_id": self.identity.account_id}``.
+        The ``finding`` kwarg is added automatically by the caller.
+        """
+        raise NotImplementedError(
+            f"{self.__class__.__name__} has not implemented get_mutelist_finding_args()"
+        )
+
+    def display_compliance_table(
+        self,
+        _findings: list,
+        _bulk_checks_metadata: dict,
+        _compliance_framework: str,
+        _output_filename: str,
+        _output_directory: str,
+        _compliance_overview: bool,
+    ) -> bool:
+        """Render a custom compliance table in the terminal.
+
+        External providers can override this to display a detailed
+        compliance table (e.g., per-section breakdown). Return True
+        if the table was rendered, False to fall back to the generic table.
+        """
+        raise NotImplementedError(
+            f"{self.__class__.__name__} has not implemented display_compliance_table()"
+        )
+
+    # Class-level flag: True for providers that delegate scanning to an external
+    # tool (e.g. Trivy, promptfoo) and bypass standard check/service loading and
+    # metadata validation. Subclasses override as `is_external_tool_provider = True`.
+    # Kept as a class attribute (not a property) so it can be read from the class
+    # without instantiation — the metadata validators in lib.check.models need to
+    # decide whether to relax validation before any provider instance exists.
+    is_external_tool_provider: bool = False
+
+    # --- End dynamic provider contract methods ---
+
     @staticmethod
     def get_excluded_regions_from_env() -> set:
         """Parse the PROWLER_AWS_DISALLOWED_REGIONS environment variable.
@@ -159,20 +261,57 @@ class Provider(ABC):
     @staticmethod
     def init_global_provider(arguments: Namespace) -> None:
         try:
-            provider_class_path = (
-                f"{providers_path}.{arguments.provider}.{arguments.provider}_provider"
-            )
-            provider_class_name = f"{arguments.provider.capitalize()}Provider"
-            provider_class = getattr(
-                import_module(provider_class_path), provider_class_name
-            )
+            # Delegate class resolution to the public, side-effect-free
+            # resolver.  init_global_provider owns the CLI-specific error
+            # handling: a missing transitive dep in a built-in becomes a
+            # logger.critical + sys.exit(1); a completely unknown provider
+            # re-raises so the outer try/except can sys.exit too.
+            try:
+                provider_class = Provider.get_class(arguments.provider)
+            except ImportError as e:
+                if Provider.is_builtin(arguments.provider):
+                    # Built-in's transitive dependency is missing — loud CLI error.
+                    logger.critical(
+                        f"Failed to load built-in provider '{arguments.provider}'. "
+                        f"Missing dependency: {e}. "
+                        f"Ensure all required dependencies are installed."
+                    )
+                    logger.debug("Full traceback:", exc_info=True)
+                    sys.exit(1)
+                # Unknown or missing external provider — propagate so the
+                # outer try/except can handle it (sys.exit(1) via generic
+                # exception handler).
+                raise
+
+            # Built-in wins on name collision — warn that a same-named
+            # plug-in is ignored.  This lives here (not in get_class) so
+            # that `prowler --help` and API callers that resolve a class
+            # without initialising a global provider do not see spurious
+            # warnings. Match by name only — never ep.load() a shadowing
+            # plug-in, or its module code would run during a built-in run.
+            if Provider.is_builtin(arguments.provider) and any(
+                ep.name == arguments.provider
+                for ep in importlib.metadata.entry_points(group="prowler.providers")
+            ):
+                logger.warning(
+                    f"Plug-in provider '{arguments.provider}' registered "
+                    f"via entry points is being IGNORED — a built-in with "
+                    f"the same name exists. To use your plug-in, register "
+                    f"it under a different name."
+                )
 
             fixer_config = load_and_validate_config_file(
                 arguments.provider, arguments.fixer_config
             )
 
+            # Dispatch by exact provider name (equality, not substring) so
+            # external plug-ins whose names contain a built-in substring
+            # (e.g. `awsx`, `azure_gov`, `iac_v2`) cannot be silently routed
+            # to the wrong built-in branch. Anything that doesn't match a
+            # built-in falls through to the dynamic else and uses the
+            # contract's `from_cli_args`.
             if not isinstance(Provider._global, provider_class):
-                if "aws" in provider_class_name.lower():
+                if arguments.provider == "aws":
                     excluded_regions = (
                         set(arguments.excluded_region)
                         if getattr(arguments, "excluded_region", None)
@@ -196,7 +335,7 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "azure" in provider_class_name.lower():
+                elif arguments.provider == "azure":
                     provider_class(
                         az_cli_auth=arguments.az_cli_auth,
                         sp_env_auth=arguments.sp_env_auth,
@@ -209,7 +348,7 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "gcp" in provider_class_name.lower():
+                elif arguments.provider == "gcp":
                     provider_class(
                         retries_max_attempts=arguments.gcp_retries_max_attempts,
                         organization_id=arguments.organization_id,
@@ -223,7 +362,7 @@ class Provider(ABC):
                         fixer_config=fixer_config,
                         skip_api_check=arguments.skip_api_check,
                     )
-                elif "kubernetes" in provider_class_name.lower():
+                elif arguments.provider == "kubernetes":
                     provider_class(
                         kubeconfig_file=arguments.kubeconfig_file,
                         context=arguments.context,
@@ -233,7 +372,7 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "m365" in provider_class_name.lower():
+                elif arguments.provider == "m365":
                     provider_class(
                         region=arguments.region,
                         config_path=arguments.config_file,
@@ -247,7 +386,7 @@ class Provider(ABC):
                         init_modules=arguments.init_modules,
                         fixer_config=fixer_config,
                     )
-                elif "nhn" in provider_class_name.lower():
+                elif arguments.provider == "nhn":
                     provider_class(
                         username=arguments.nhn_username,
                         password=arguments.nhn_password,
@@ -256,7 +395,7 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "stackit" in provider_class_name.lower():
+                elif arguments.provider == "stackit":
                     provider_class(
                         project_id=arguments.stackit_project_id,
                         service_account_key_path=getattr(
@@ -275,7 +414,7 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "github" in provider_class_name.lower():
+                elif arguments.provider == "github":
                     orgs = []
                     repos = []
 
@@ -307,13 +446,13 @@ class Provider(ABC):
                         exclude_workflows=getattr(arguments, "exclude_workflows", []),
                         fixer_config=fixer_config,
                     )
-                elif "googleworkspace" in provider_class_name.lower():
+                elif arguments.provider == "googleworkspace":
                     provider_class(
                         config_path=arguments.config_file,
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "cloudflare" in provider_class_name.lower():
+                elif arguments.provider == "cloudflare":
                     provider_class(
                         filter_zones=arguments.region,
                         filter_accounts=arguments.account_id,
@@ -321,7 +460,7 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "iac" in provider_class_name.lower():
+                elif arguments.provider == "iac":
                     provider_class(
                         scan_path=arguments.scan_path,
                         scan_repository_url=arguments.scan_repository_url,
@@ -334,13 +473,13 @@ class Provider(ABC):
                         oauth_app_token=arguments.oauth_app_token,
                         provider_uid=arguments.provider_uid,
                     )
-                elif "llm" in provider_class_name.lower():
+                elif arguments.provider == "llm":
                     provider_class(
                         max_concurrency=arguments.max_concurrency,
                         config_path=arguments.config_file,
                         fixer_config=fixer_config,
                     )
-                elif "image" in provider_class_name.lower():
+                elif arguments.provider == "image":
                     provider_class(
                         images=arguments.images,
                         image_list_file=arguments.image_list_file,
@@ -358,7 +497,7 @@ class Provider(ABC):
                         registry_insecure=arguments.registry_insecure,
                         registry_list_images=arguments.registry_list_images,
                     )
-                elif "mongodbatlas" in provider_class_name.lower():
+                elif arguments.provider == "mongodbatlas":
                     provider_class(
                         atlas_public_key=arguments.atlas_public_key,
                         atlas_private_key=arguments.atlas_private_key,
@@ -367,7 +506,7 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "oraclecloud" in provider_class_name.lower():
+                elif arguments.provider == "oraclecloud":
                     provider_class(
                         oci_config_file=arguments.oci_config_file,
                         profile=arguments.profile,
@@ -378,7 +517,7 @@ class Provider(ABC):
                         fixer_config=fixer_config,
                         use_instance_principal=arguments.use_instance_principal,
                     )
-                elif "openstack" in provider_class_name.lower():
+                elif arguments.provider == "openstack":
                     provider_class(
                         clouds_yaml_file=getattr(arguments, "clouds_yaml_file", None),
                         clouds_yaml_content=getattr(
@@ -403,7 +542,7 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "alibabacloud" in provider_class_name.lower():
+                elif arguments.provider == "alibabacloud":
                     provider_class(
                         role_arn=arguments.role_arn,
                         role_session_name=arguments.role_session_name,
@@ -415,14 +554,14 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "vercel" in provider_class_name.lower():
+                elif arguments.provider == "vercel":
                     provider_class(
                         projects=getattr(arguments, "project", None),
                         config_path=arguments.config_file,
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "okta" in provider_class_name.lower():
+                elif arguments.provider == "okta":
                     provider_class(
                         okta_org_domain=getattr(arguments, "okta_org_domain", ""),
                         okta_client_id=getattr(arguments, "okta_client_id", ""),
@@ -435,7 +574,7 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
-                elif "scaleway" in provider_class_name.lower():
+                elif arguments.provider == "scaleway":
                     # Credentials are read from the SCW_ACCESS_KEY /
                     # SCW_SECRET_KEY env vars by the provider itself; there
                     # are no credential CLI flags to avoid leaking secrets.
@@ -447,6 +586,18 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
+                else:
+                    # Dynamic fallback: any external/custom provider.
+                    # Honor the from_cli_args type hint (-> Provider): if the
+                    # implementation returns an instance, wire it as the global
+                    # provider here. Implementations that call
+                    # set_global_provider(self) from __init__ return None and
+                    # remain supported (the condition below is a no-op for them).
+                    provider_instance = provider_class.from_cli_args(
+                        arguments, fixer_config
+                    )
+                    if provider_instance is not None:
+                        Provider.set_global_provider(provider_instance)
 
         except TypeError as error:
             logger.critical(
@@ -459,17 +610,141 @@ class Provider(ABC):
             )
             sys.exit(1)
 
+    # Cache for entry-point provider classes {name: class}
+    _ep_providers: dict = {}
+
     @staticmethod
     def get_available_providers() -> list[str]:
         """get_available_providers returns a list of the available providers"""
-        providers = []
-        # Dynamically import the package based on its string path
+        providers = set()
+        # Built-in providers from local package
         prowler_providers = importlib.import_module(providers_path)
-        # Iterate over all modules found in the prowler_providers package
         for _, provider, ispkg in pkgutil.iter_modules(prowler_providers.__path__):
             if provider != "common" and ispkg:
-                providers.append(provider)
-        return providers
+                providers.add(provider)
+        # External providers registered via entry points
+        for ep in importlib.metadata.entry_points(group="prowler.providers"):
+            providers.add(ep.name)
+        return sorted(providers)
+
+    @staticmethod
+    def is_tool_wrapper_provider(provider: str) -> bool:
+        """Return True if the provider delegates scanning to an external tool.
+
+        Delegates to `prowler.lib.check.tool_wrapper.is_tool_wrapper_provider`,
+        the leaf module that holds the actual logic. Kept on `Provider` as a
+        convenience entry point for callers that already import `Provider`.
+        """
+        from prowler.lib.check.tool_wrapper import is_tool_wrapper_provider as _impl
+
+        return _impl(provider)
+
+    @staticmethod
+    def is_builtin(provider: str) -> bool:
+        """Return True if the provider's own package is importable as a built-in.
+
+        Delegates to `prowler.providers.common.builtin.is_builtin_provider`,
+        the leaf module that holds the actual check. Kept on `Provider` as a
+        convenience entry point for callers that already import `Provider`.
+        Call sites in `prowler.lib.check.*` should import from the leaf
+        directly to avoid the import cycle through this module.
+        """
+        from prowler.providers.common.builtin import is_builtin_provider as _impl
+
+        return _impl(provider)
+
+    @staticmethod
+    def _load_ep_provider(name: str):
+        """Load an external provider class from entry points, with cache.
+
+        Caches both hits and misses so repeated lookups for unknown names do
+        not re-iterate entry_points(). Symmetric with
+        tool_wrapper._ep_class_cache.
+        """
+        if name in Provider._ep_providers:
+            return Provider._ep_providers[name]
+        for ep in importlib.metadata.entry_points(group="prowler.providers"):
+            if ep.name == name:
+                try:
+                    cls = ep.load()
+                    Provider._ep_providers[name] = cls
+                    return cls
+                except Exception as error:
+                    logger.warning(
+                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+        Provider._ep_providers[name] = None
+        return None
+
+    @staticmethod
+    def get_class(provider: str) -> type:
+        """Resolve the provider class for a name (built-in or entry-point).
+
+        Does not call ``sys.exit`` and does not initialize the global
+        provider (it may populate the ``_ep_providers`` memoization cache).
+        Collision warnings are emitted by ``init_global_provider``, not here.
+        The caller handles errors (CLI exits; the API can return HTTP 400).
+
+        Args:
+            provider: Provider name, e.g. ``"aws"`` or an external plug-in.
+
+        Returns:
+            The provider class (a subclass of :class:`Provider`).
+
+        Raises:
+            ImportError: If not found as built-in or entry point, a built-in's
+                transitive dependency is missing, or an entry point resolves to
+                an object that is not a subclass of :class:`Provider`.
+        """
+        if Provider.is_builtin(provider):
+            provider_class_path = f"{providers_path}.{provider}.{provider}_provider"
+            provider_class_name = f"{provider.capitalize()}Provider"
+            # Let ImportError propagate — the caller decides whether to
+            # sys.exit (CLI) or return HTTP 400 (API).
+            module = import_module(provider_class_path)
+            try:
+                return getattr(module, provider_class_name)
+            except AttributeError as error:
+                # is_builtin already confirmed this is a built-in, so the
+                # module MUST define the expected class. A missing class is a
+                # broken built-in contract — raise rather than fall back to a
+                # same-named external plug-in, which would contradict
+                # is_builtin and silently return a foreign class.
+                raise ImportError(
+                    f"Built-in provider '{provider}' module "
+                    f"'{provider_class_path}' does not define expected class "
+                    f"'{provider_class_name}'"
+                ) from error
+
+        cls = Provider._load_ep_provider(provider)
+        if cls is None:
+            raise ImportError(
+                f"Provider '{provider}' not found as built-in or entry point"
+            )
+        # ep.load() can return any object; enforce the public contract that
+        # get_class returns a Provider subclass. isinstance(cls, type) guards
+        # issubclass against a TypeError when cls is not a class at all.
+        if not (isinstance(cls, type) and issubclass(cls, Provider)):
+            raise ImportError(
+                f"Entry-point provider '{provider}' resolved to {cls!r}, "
+                f"which is not a subclass of Provider"
+            )
+        return cls
+
+    @staticmethod
+    def get_providers_help_text() -> dict:
+        """Returns a dict of {provider_name: cli_help_text} for all available providers."""
+        help_text = {}
+        for name in Provider.get_available_providers():
+            try:
+                cls = Provider.get_class(name)
+                help_text[name] = getattr(cls, "_cli_help_text", "")
+            except Exception as error:
+                logger.warning(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+                help_text[name] = ""
+        return help_text
 
     @staticmethod
     def update_provider_config(audit_config: dict, variable: str, value: str):
diff --git a/prowler/providers/gcp/exceptions/exceptions.py b/prowler/providers/gcp/exceptions/exceptions.py
index 5c5845951c..09cb642cba 100644
--- a/prowler/providers/gcp/exceptions/exceptions.py
+++ b/prowler/providers/gcp/exceptions/exceptions.py
@@ -34,11 +34,17 @@ class GCPBaseException(ProwlerException):
             "message": "Error loading Service Account Private Key credentials from dictionary",
             "remediation": "Check the dictionary and ensure it contains a Service Account Private Key.",
         },
+        (3011, "GCPGetOrganizationProjectsError"): {
+            "message": "Error retrieving projects under the organization via the Cloud Asset API",
+            "remediation": "Ensure the Cloud Asset API is enabled in the credentials' project and that the principal has 'roles/cloudasset.viewer' bound at the organization level. See https://cloud.google.com/asset-inventory/docs/access-control.",
+        },
     }
 
     def __init__(self, code, file=None, original_exception=None, message=None):
         provider = "GCP"
-        error_info = self.GCP_ERROR_CODES.get((code, self.__class__.__name__))
+        # Copy the catalog entry so a custom message does not mutate the
+        # class-level GCP_ERROR_CODES shared across exception instances.
+        error_info = dict(self.GCP_ERROR_CODES.get((code, self.__class__.__name__)))
         if message:
             error_info["message"] = message
         super().__init__(
@@ -104,3 +110,10 @@ class GCPLoadServiceAccountKeyFromDictError(GCPCredentialsError):
         super().__init__(
             3010, file=file, original_exception=original_exception, message=message
         )
+
+
+class GCPGetOrganizationProjectsError(GCPBaseException):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            3011, file=file, original_exception=original_exception, message=message
+        )
diff --git a/prowler/providers/gcp/gcp_provider.py b/prowler/providers/gcp/gcp_provider.py
index 5017b84c42..39b3392fdf 100644
--- a/prowler/providers/gcp/gcp_provider.py
+++ b/prowler/providers/gcp/gcp_provider.py
@@ -21,6 +21,8 @@ from prowler.providers.common.models import Audit_Metadata, Connection
 from prowler.providers.common.provider import Provider
 from prowler.providers.gcp.config import DEFAULT_RETRY_ATTEMPTS
 from prowler.providers.gcp.exceptions.exceptions import (
+    GCPBaseException,
+    GCPGetOrganizationProjectsError,
     GCPInvalidProviderIdError,
     GCPLoadADCFromDictError,
     GCPLoadServiceAccountKeyFromDictError,
@@ -621,10 +623,7 @@ class GcpProvider(Provider):
             credentials_file: str
 
         Returns:
-            dict[str, GCPProject]
-
-        Usage:
-            >>> GcpProvider.get_projects(credentials=credentials, organization_id=organization_id)
+            dict of project_id and GCPProject object
         """
         projects = {}
         try:
@@ -632,7 +631,10 @@ class GcpProvider(Provider):
                 try:
                     # Initialize Cloud Asset Inventory API for recursive project retrieval
                     asset_service = discovery.build(
-                        "cloudasset", "v1", credentials=credentials
+                        "cloudasset",
+                        "v1",
+                        credentials=credentials,
+                        num_retries=DEFAULT_RETRY_ATTEMPTS,
                     )
                     # Set the scope to the specified organization and filter for projects
                     scope = f"organizations/{organization_id}"
@@ -643,7 +645,7 @@ class GcpProvider(Provider):
                     )
 
                     while request is not None:
-                        response = request.execute()
+                        response = request.execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
 
                         for asset in response.get("assets", []):
                             # Extract labels and other project details
@@ -688,13 +690,25 @@ class GcpProvider(Provider):
                         )
                 except HttpError as http_error:
                     if "Cloud Asset API has not been used" in str(http_error):
-                        logger.error(
-                            f"Projects cannot be retrieved from the Organization since Cloud Asset API has not been used before or it is disabled [{http_error.__traceback__.tb_lineno}]. Enable it by visiting https://console.developers.google.com/apis/api/cloudasset.googleapis.com/ then retry."
+                        message = (
+                            "Projects cannot be retrieved from the Organization since the Cloud Asset API "
+                            "has not been used before or it is disabled. Enable it by visiting "
+                            "https://console.developers.google.com/apis/api/cloudasset.googleapis.com/ then retry."
                         )
                     else:
-                        logger.error(
-                            f"{http_error.__class__.__name__}[{http_error.__traceback__.tb_lineno}]: {http_error}"
+                        message = (
+                            f"Cloud Asset API call failed while listing projects under organization "
+                            f"'{organization_id}': {http_error}. Ensure the credentials' principal has "
+                            "'roles/cloudasset.viewer' bound at the organization level."
                         )
+                    logger.critical(
+                        f"{http_error.__class__.__name__}[{http_error.__traceback__.tb_lineno}]: {message}"
+                    )
+                    raise GCPGetOrganizationProjectsError(
+                        file=__file__,
+                        original_exception=http_error,
+                        message=message,
+                    )
             else:
                 try:
                     # Initialize Cloud Resource Manager API for simple project listing
@@ -781,8 +795,10 @@ class GcpProvider(Provider):
                             labels={},
                             lifecycle_state="ACTIVE",
                         )
-                # If no projects were able to be accessed via API, add them manually from the credentials file
-                elif credentials_file:
+                # If no projects were able to be accessed via API, add them manually from the credentials file.
+                # Skip this fallback when an organization scan was explicitly requested: silently
+                # downgrading scope to the service account's home project hides permission errors.
+                elif credentials_file and not organization_id:
                     with open(credentials_file, "r", encoding="utf-8") as file:
                         project_id = json.load(file)["project_id"]
                         # Handle empty or null project names
@@ -798,6 +814,8 @@ class GcpProvider(Provider):
                             labels={},
                             lifecycle_state="ACTIVE",
                         )
+        except GCPBaseException as gcp_error:
+            raise gcp_error
         except Exception as error:
             logger.critical(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
diff --git a/prowler/providers/gcp/services/cloudfunction/__init__.py b/prowler/providers/gcp/services/cloudfunction/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_client.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_client.py
new file mode 100644
index 0000000000..a252da1be7
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+    CloudFunction,
+)
+
+cloudfunction_client = CloudFunction(Provider.get_global_provider())
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.metadata.json b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.metadata.json
new file mode 100644
index 0000000000..72c908bf80
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.metadata.json
@@ -0,0 +1,40 @@
+{
+  "Provider": "gcp",
+  "CheckID": "cloudfunction_function_inside_vpc",
+  "CheckTitle": "Cloud Function is connected to a VPC network",
+  "CheckType": [],
+  "ServiceName": "cloudfunction",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "cloudfunctions.googleapis.com/Function",
+  "Description": "Cloud Functions are attached to a **Serverless VPC Access connector** so egress traffic is routed through a private VPC network instead of the public internet.\n\nThe evaluation reviews each function's network configuration to confirm that a connector is configured.",
+  "Risk": "Without a VPC connector, Cloud Functions cannot privately reach internal resources such as `Cloud SQL`, `Memorystore`, or `GKE`, forcing those services to be exposed over public IPs. This expands the **attack surface**, weakens **confidentiality** of internal traffic, and breaks network segmentation controls required by most security frameworks.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://cloud.google.com/functions/docs/networking/connecting-vpc",
+    "https://cloud.google.com/vpc/docs/serverless-vpc-access"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "gcloud functions deploy <FUNCTION_NAME> --region=<REGION> --vpc-connector=projects/<PROJECT_ID>/locations/<REGION>/connectors/<CONNECTOR_NAME> --egress-settings=all-traffic",
+      "NativeIaC": "",
+      "Other": "1. In Google Cloud Console, go to Cloud Functions\n2. Select the function and click Edit\n3. Under Connections, select the VPC connector for your network\n4. Set Egress settings to route all traffic through the VPC connector\n5. Save and redeploy the function",
+      "Terraform": "```hcl\nresource \"google_cloudfunctions2_function\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  location = \"us-central1\"\n\n  service_config {\n    vpc_connector                 = \"<example_resource_id>\" # Critical: routes egress through the VPC\n    vpc_connector_egress_settings = \"ALL_TRAFFIC\"\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Apply **defense in depth** by routing Cloud Function egress through a **Serverless VPC Access connector** when the function must reach internal resources.\n\nScope each connector to **least privilege** subnets so functions cannot reach unintended endpoints.",
+      "Url": "https://hub.prowler.com/check/cloudfunction_function_inside_vpc"
+    }
+  },
+  "Categories": [
+    "trust-boundaries"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "cloudfunction_function_not_publicly_accessible",
+    "cloudsql_instance_public_ip",
+    "compute_instance_public_ip"
+  ],
+  "Notes": "A VPC connector must be created in the same region as the Cloud Function. This check only verifies that a connector is attached; it does not validate egress settings or connector configuration."
+}
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py
new file mode 100644
index 0000000000..46866b350d
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py
@@ -0,0 +1,39 @@
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.cloudfunction.cloudfunction_client import (
+    cloudfunction_client,
+)
+
+
+class cloudfunction_function_inside_vpc(Check):
+    """Check that Cloud Functions are attached to a Serverless VPC Access connector.
+
+    Verifies that each active Cloud Function has a `vpcConnector` configured so
+    egress traffic flows through a private VPC network instead of the public
+    internet. Functions in non-`ACTIVE` states are skipped because their network
+    configuration is transient.
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        """Execute the VPC-connector check across all Cloud Functions.
+
+        Returns:
+            A list of `Check_Report_GCP` findings, one per active Cloud
+            Function. Status is `PASS` when a `vpc_connector` is set and `FAIL`
+            otherwise.
+        """
+        findings = []
+        for function in cloudfunction_client.functions:
+            if function.state != "ACTIVE":
+                continue
+            report = Check_Report_GCP(metadata=self.metadata(), resource=function)
+            if function.vpc_connector:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Cloud Function {function.name} is connected to a VPC via "
+                    f"connector: {function.vpc_connector}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Cloud Function {function.name} is not connected to any VPC network."
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
new file mode 100644
index 0000000000..d1043151b7
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
@@ -0,0 +1,84 @@
+from typing import Optional
+
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.gcp.config import DEFAULT_RETRY_ATTEMPTS
+from prowler.providers.gcp.gcp_provider import GcpProvider
+from prowler.providers.gcp.lib.service.service import GCPService
+
+
+class CloudFunction(GCPService):
+    """Cloud Functions v2 service client.
+
+    Enumerates Cloud Functions across every accessible project and region
+    using the `cloudfunctions.googleapis.com` v2 API and exposes them through
+    the `functions` attribute.
+    """
+
+    def __init__(self, provider: GcpProvider) -> None:
+        """Initialize the service and preload Cloud Functions."""
+        super().__init__("cloudfunctions", provider, api_version="v2")
+        self.functions = []
+        self._get_functions()
+
+    def _get_functions(self) -> None:
+        """Fetch Cloud Functions for every project and location."""
+        for project_id in self.project_ids:
+            try:
+                locations = self.client.projects().locations()
+                locations_request = locations.list(name=f"projects/{project_id}")
+                while locations_request is not None:
+                    locations_response = locations_request.execute(
+                        num_retries=DEFAULT_RETRY_ATTEMPTS
+                    )
+                    for location in locations_response.get("locations", []):
+                        location_id = location["locationId"]
+                        try:
+                            functions = locations.functions()
+                            request = functions.list(
+                                parent=f"projects/{project_id}/locations/{location_id}"
+                            )
+                            while request is not None:
+                                response = request.execute(
+                                    num_retries=DEFAULT_RETRY_ATTEMPTS
+                                )
+                                for fn in response.get("functions", []):
+                                    service_config = fn.get("serviceConfig", {})
+                                    self.functions.append(
+                                        Function(
+                                            name=fn["name"].split("/")[-1],
+                                            project_id=project_id,
+                                            location=location_id,
+                                            state=fn.get("state", "UNKNOWN"),
+                                            vpc_connector=service_config.get(
+                                                "vpcConnector"
+                                            ),
+                                        )
+                                    )
+                                request = functions.list_next(
+                                    previous_request=request,
+                                    previous_response=response,
+                                )
+                        except Exception as error:
+                            logger.error(
+                                f"{location_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                            )
+                    locations_request = locations.list_next(
+                        previous_request=locations_request,
+                        previous_response=locations_response,
+                    )
+            except Exception as error:
+                logger.error(
+                    f"{project_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+
+class Function(BaseModel):
+    """Cloud Function resource consumed by GCP checks."""
+
+    name: str
+    project_id: str
+    location: str
+    state: str
+    vpc_connector: Optional[str] = None
diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.metadata.json b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.metadata.json
new file mode 100644
index 0000000000..3e66f9cdd3
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "gcp",
+  "CheckID": "cloudsql_instance_high_availability_enabled",
+  "CheckTitle": "Cloud SQL instance has high availability (REGIONAL) configured",
+  "CheckType": [],
+  "ServiceName": "cloudsql",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "sqladmin.googleapis.com/Instance",
+  "Description": "Ensures that Cloud SQL instances have high availability configured by setting availabilityType to REGIONAL. A REGIONAL instance maintains a standby replica in a different zone within the same region and automatically fails over on zone-level outages.",
+  "Risk": "Instances with ZONAL availability have no standby replica. A zone-level outage will cause database downtime until manual recovery, violating availability requirements and potentially breaching SLAs and ISMS-P 2.12.1 disaster preparedness controls.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://cloud.google.com/sql/docs/postgres/high-availability",
+    "https://cloud.google.com/sql/docs/sqlserver/high-availability"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "gcloud sql instances patch <INSTANCE_NAME> --availability-type=REGIONAL",
+      "NativeIaC": "",
+      "Other": "1. Go to Google Cloud Console > SQL > Instances.\n2. Click the instance name, then Edit.\n3. Under Availability, select Multiple zones (Highly available).\n4. Click Save.",
+      "Terraform": "```hcl\nresource \"google_sql_database_instance\" \"example\" {\n  name             = \"<instance_name>\"\n  database_version = \"POSTGRES_15\"\n  region           = \"<region>\"\n\n  settings {\n    tier = \"db-custom-2-7680\"\n\n    availability_type = \"REGIONAL\"  # Critical: enables HA standby replica\n\n    backup_configuration {\n      enabled    = true\n      start_time = \"02:00\"\n    }\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Set availabilityType to REGIONAL for all production Cloud SQL instances. This creates a standby replica in a different zone and enables automatic failover, reducing RTO in the event of a zone outage.",
+      "Url": "https://hub.prowler.com/check/cloudsql_instance_high_availability_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "cloudsql_instance_automated_backups"
+  ],
+  "Notes": "Enabling HA increases instance cost approximately 2x due to the standby replica. ZONAL instances are acceptable for non-production workloads where downtime is tolerable."
+}
diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.py
new file mode 100644
index 0000000000..37bf576345
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.py
@@ -0,0 +1,41 @@
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client
+
+
+class cloudsql_instance_high_availability_enabled(Check):
+    """Check that Cloud SQL primary instances are configured for high availability.
+
+    Verifies that each Cloud SQL primary instance has `availabilityType` set to
+    `REGIONAL`, which provisions a standby replica in a different zone within
+    the same region and enables automatic failover on zone-level outages. Read
+    replicas are skipped because they inherit availability from their primary.
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        """Execute the high availability check across all Cloud SQL instances.
+
+        Returns:
+            A list of `Check_Report_GCP` findings, one per Cloud SQL primary
+            instance. Status is `PASS` when `availability_type == "REGIONAL"`
+            and `FAIL` otherwise.
+        """
+        findings = []
+        for instance in cloudsql_client.instances:
+            if instance.instance_type != "CLOUD_SQL_INSTANCE":
+                continue
+            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
+            if instance.availability_type == "REGIONAL":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Database instance {instance.name} has high availability "
+                    f"(REGIONAL) configured."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Database instance {instance.name} does not have high "
+                    f"availability configured (current: "
+                    f"{instance.availability_type})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_service.py b/prowler/providers/gcp/services/cloudsql/cloudsql_service.py
index 137169999a..1fe706bb02 100644
--- a/prowler/providers/gcp/services/cloudsql/cloudsql_service.py
+++ b/prowler/providers/gcp/services/cloudsql/cloudsql_service.py
@@ -46,6 +46,9 @@ class CloudSQL(GCPService):
                                     "authorizedNetworks", []
                                 ),
                                 flags=settings.get("databaseFlags", []),
+                                availability_type=settings.get(
+                                    "availabilityType", "ZONAL"
+                                ),
                                 instance_type=instance.get(
                                     "instanceType", "CLOUD_SQL_INSTANCE"
                                 ),
@@ -76,6 +79,7 @@ class Instance(BaseModel):
     ssl_mode: str
     automated_backups: bool
     flags: list
+    availability_type: str = "ZONAL"
     instance_type: str = "CLOUD_SQL_INSTANCE"
     cmek_key_name: Optional[str] = None
     project_id: str
diff --git a/prowler/providers/gcp/services/iam/iam_service.py b/prowler/providers/gcp/services/iam/iam_service.py
index 13e96276e7..987a86068c 100644
--- a/prowler/providers/gcp/services/iam/iam_service.py
+++ b/prowler/providers/gcp/services/iam/iam_service.py
@@ -37,6 +37,7 @@ class IAM(GCPService):
                                 display_name=account.get("displayName", ""),
                                 project_id=project_id,
                                 uniqueId=account.get("uniqueId", ""),
+                                disabled=account.get("disabled", False),
                             )
                         )
 
@@ -102,6 +103,7 @@ class ServiceAccount(BaseModel):
     keys: list[Key] = []
     project_id: str
     uniqueId: str
+    disabled: bool = False
 
 
 class AccessApproval(GCPService):
diff --git a/prowler/providers/gcp/services/iam/iam_service_account_unused/iam_service_account_unused.py b/prowler/providers/gcp/services/iam/iam_service_account_unused/iam_service_account_unused.py
index 12440aff25..912237b9e5 100644
--- a/prowler/providers/gcp/services/iam/iam_service_account_unused/iam_service_account_unused.py
+++ b/prowler/providers/gcp/services/iam/iam_service_account_unused/iam_service_account_unused.py
@@ -19,7 +19,12 @@ class iam_service_account_unused(Check):
                 resource_id=account.email,
                 location=iam_client.region,
             )
-            if account.uniqueId in sa_ids_used:
+            if account.disabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Service Account {account.email} is disabled and cannot be used."
+                )
+            elif account.uniqueId in sa_ids_used:
                 report.status = "PASS"
                 report.status_extended = f"Service Account {account.email} was used over the last {max_unused_days} days."
             else:
diff --git a/prowler/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.metadata.json b/prowler/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.metadata.json
index 5efe894b04..7312ffefeb 100644
--- a/prowler/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.metadata.json
+++ b/prowler/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.metadata.json
@@ -1,14 +1,14 @@
 {
   "Provider": "gcp",
   "CheckID": "kms_key_rotation_enabled",
-  "CheckTitle": "KMS key is rotated at least annually",
+  "CheckTitle": "KMS key has automatic rotation enabled",
   "CheckType": [],
   "ServiceName": "kms",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "low",
   "ResourceType": "cloudkms.googleapis.com/CryptoKey",
-  "Description": "Google Cloud KMS customer-managed keys have **automatic rotation** enabled or a rotation interval  `365` days.\n\nThe evaluation reviews each key's rotation settings to confirm periodic creation of new key versions.",
+  "Description": "Google Cloud KMS customer-managed keys have **automatic rotation** enabled, regardless of the rotation interval.\n\nThe evaluation reviews each key's rotation settings to confirm that a rotation period is configured so new key versions are created periodically.",
   "Risk": "Without timely rotation, a stolen key can decrypt an expanding volume of data, eroding **confidentiality**. Prolonged key lifetimes widen windows for misuse, impact **integrity** of protected workloads, and make emergency rollover harder, risking **availability** disruptions.",
   "RelatedUrl": "",
   "AdditionalURLs": [
@@ -17,13 +17,13 @@
   ],
   "Remediation": {
     "Code": {
-      "CLI": "gcloud kms keys update <KEY_NAME> --keyring=<KEY_RING> --location=<LOCATION> --rotation-period=365d --next-rotation-time=<RFC3339_TIME>",
+      "CLI": "gcloud kms keys update <KEY_NAME> --keyring=<KEY_RING> --location=<LOCATION> --rotation-period=<PERIOD> --next-rotation-time=<RFC3339_TIME>",
       "NativeIaC": "",
-      "Other": "1. In Google Cloud Console, go to Security > Key Management > Key rings\n2. Open the key ring and select the key\n3. Click Edit rotation schedule (or Set rotation schedule)\n4. Set Rotation period to 365 days or less\n5. Set Next rotation date/time\n6. Click Save",
-      "Terraform": "```hcl\nresource \"google_kms_crypto_key\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  key_ring = \"<example_resource_id>\"\n  purpose  = \"ENCRYPT_DECRYPT\"\n\n  rotation_period = \"31536000s\" # Critical: sets automatic rotation to 365 days (<= 365 ensures PASS)\n}\n```"
+      "Other": "1. In Google Cloud Console, go to Security > Key Management > Key rings\n2. Open the key ring and select the key\n3. Click Edit rotation schedule (or Set rotation schedule)\n4. Set a Rotation period\n5. Set Next rotation date/time\n6. Click Save",
+      "Terraform": "```hcl\nresource \"google_kms_crypto_key\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  key_ring = \"<example_resource_id>\"\n  purpose  = \"ENCRYPT_DECRYPT\"\n\n  rotation_period = \"7776000s\" # Critical: enables automatic rotation (any period ensures PASS)\n}\n```"
     },
     "Recommendation": {
-      "Text": "Enable **auto-rotation** for customer-managed keys with an interval  `365` days.\n\nAdopt a **key lifecycle** policy: enforce **least privilege** on key usage, apply **separation of duties** between key admins and users, monitor key access, and rehearse emergency rotation to minimize blast radius.",
+      "Text": "Enable **auto-rotation** for customer-managed keys by configuring a rotation period.\n\nAdopt a **key lifecycle** policy: enforce **least privilege** on key usage, apply **separation of duties** between key admins and users, monitor key access, and rehearse emergency rotation to minimize blast radius.",
       "Url": "https://hub.prowler.com/check/kms_key_rotation_enabled"
     }
   },
@@ -31,6 +31,8 @@
     "encryption"
   ],
   "DependsOn": [],
-  "RelatedTo": [],
+  "RelatedTo": [
+    "kms_key_rotation_max_90_days"
+  ],
   "Notes": ""
 }
diff --git a/prowler/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.py b/prowler/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.py
index 577a7c9f99..ae924ca380 100644
--- a/prowler/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.py
+++ b/prowler/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled.py
@@ -1,5 +1,3 @@
-import datetime
-
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.kms.kms_client import kms_client
 
@@ -9,36 +7,16 @@ class kms_key_rotation_enabled(Check):
         findings = []
         for key in kms_client.crypto_keys:
             report = Check_Report_GCP(metadata=self.metadata(), resource=key)
-            now = datetime.datetime.now()
-            condition_next_rotation_time = False
-            if key.next_rotation_time:
-                try:
-                    next_rotation_time = datetime.datetime.strptime(
-                        key.next_rotation_time, "%Y-%m-%dT%H:%M:%S.%fZ"
-                    )
-                except ValueError:
-                    next_rotation_time = datetime.datetime.strptime(
-                        key.next_rotation_time, "%Y-%m-%dT%H:%M:%SZ"
-                    )
-                condition_next_rotation_time = (
-                    abs((next_rotation_time - now).days) <= 90
-                )
-            condition_rotation_period = False
             if key.rotation_period:
-                condition_rotation_period = (
-                    int(key.rotation_period[:-1]) // (24 * 3600) <= 90
-                )
-            if condition_rotation_period and condition_next_rotation_time:
                 report.status = "PASS"
-                report.status_extended = f"Key {key.name} is rotated every 90 days or less and the next rotation time is in less than 90 days."
+                report.status_extended = (
+                    f"Key {key.name} has automatic rotation enabled."
+                )
             else:
                 report.status = "FAIL"
-                if condition_rotation_period:
-                    report.status_extended = f"Key {key.name} is rotated every 90 days or less but the next rotation time is in more than 90 days."
-                elif condition_next_rotation_time:
-                    report.status_extended = f"Key {key.name} is not rotated every 90 days or less but the next rotation time is in less than 90 days."
-                else:
-                    report.status_extended = f"Key {key.name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
+                report.status_extended = (
+                    f"Key {key.name} does not have automatic rotation enabled."
+                )
             findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/kms/kms_key_rotation_max_90_days/__init__.py b/prowler/providers/gcp/services/kms/kms_key_rotation_max_90_days/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/kms/kms_key_rotation_max_90_days/kms_key_rotation_max_90_days.metadata.json b/prowler/providers/gcp/services/kms/kms_key_rotation_max_90_days/kms_key_rotation_max_90_days.metadata.json
new file mode 100644
index 0000000000..f1597fee53
--- /dev/null
+++ b/prowler/providers/gcp/services/kms/kms_key_rotation_max_90_days/kms_key_rotation_max_90_days.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "gcp",
+  "CheckID": "kms_key_rotation_max_90_days",
+  "CheckTitle": "KMS key is rotated every 90 days or less",
+  "CheckType": [],
+  "ServiceName": "kms",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "cloudkms.googleapis.com/CryptoKey",
+  "Description": "Google Cloud KMS customer-managed keys are rotated with an interval of `90` days or less, in line with the CIS Benchmark.\n\nThe evaluation reviews each key's rotation settings to confirm that both the rotation period and the next rotation time stay within 90 days.",
+  "Risk": "Without timely rotation, a stolen key can decrypt an expanding volume of data, eroding **confidentiality**. Prolonged key lifetimes widen windows for misuse, impact **integrity** of protected workloads, and make emergency rollover harder, risking **availability** disruptions.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudKMS/rotate-kms-encryption-keys.html",
+    "https://cloud.google.com/iam/docs/manage-access-service-accounts"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "gcloud kms keys update <KEY_NAME> --keyring=<KEY_RING> --location=<LOCATION> --rotation-period=90d --next-rotation-time=<RFC3339_TIME>",
+      "NativeIaC": "",
+      "Other": "1. In Google Cloud Console, go to Security > Key Management > Key rings\n2. Open the key ring and select the key\n3. Click Edit rotation schedule (or Set rotation schedule)\n4. Set Rotation period to 90 days or less\n5. Set Next rotation date/time\n6. Click Save",
+      "Terraform": "```hcl\nresource \"google_kms_crypto_key\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  key_ring = \"<example_resource_id>\"\n  purpose  = \"ENCRYPT_DECRYPT\"\n\n  rotation_period = \"7776000s\" # Critical: sets automatic rotation to 90 days (<= 90 ensures PASS)\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **auto-rotation** for customer-managed keys with an interval of `90` days or less.\n\nAdopt a **key lifecycle** policy: enforce **least privilege** on key usage, apply **separation of duties** between key admins and users, monitor key access, and rehearse emergency rotation to minimize blast radius.",
+      "Url": "https://hub.prowler.com/check/kms_key_rotation_max_90_days"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "kms_key_rotation_enabled"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/gcp/services/kms/kms_key_rotation_max_90_days/kms_key_rotation_max_90_days.py b/prowler/providers/gcp/services/kms/kms_key_rotation_max_90_days/kms_key_rotation_max_90_days.py
new file mode 100644
index 0000000000..cbca4f0e91
--- /dev/null
+++ b/prowler/providers/gcp/services/kms/kms_key_rotation_max_90_days/kms_key_rotation_max_90_days.py
@@ -0,0 +1,44 @@
+import datetime
+
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.kms.kms_client import kms_client
+
+
+class kms_key_rotation_max_90_days(Check):
+    def execute(self) -> Check_Report_GCP:
+        findings = []
+        for key in kms_client.crypto_keys:
+            report = Check_Report_GCP(metadata=self.metadata(), resource=key)
+            now = datetime.datetime.now()
+            condition_next_rotation_time = False
+            if key.next_rotation_time:
+                try:
+                    next_rotation_time = datetime.datetime.strptime(
+                        key.next_rotation_time, "%Y-%m-%dT%H:%M:%S.%fZ"
+                    )
+                except ValueError:
+                    next_rotation_time = datetime.datetime.strptime(
+                        key.next_rotation_time, "%Y-%m-%dT%H:%M:%SZ"
+                    )
+                condition_next_rotation_time = (
+                    abs((next_rotation_time - now).days) <= 90
+                )
+            condition_rotation_period = False
+            if key.rotation_period:
+                condition_rotation_period = (
+                    int(key.rotation_period[:-1]) // (24 * 3600) <= 90
+                )
+            if condition_rotation_period and condition_next_rotation_time:
+                report.status = "PASS"
+                report.status_extended = f"Key {key.name} is rotated every 90 days or less and the next rotation time is in less than 90 days."
+            else:
+                report.status = "FAIL"
+                if condition_rotation_period:
+                    report.status_extended = f"Key {key.name} is rotated every 90 days or less but the next rotation time is in more than 90 days."
+                elif condition_next_rotation_time:
+                    report.status_extended = f"Key {key.name} is not rotated every 90 days or less but the next rotation time is in less than 90 days."
+                else:
+                    report.status_extended = f"Key {key.name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.py
index 4654be4d29..84bf078dac 100644
--- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.py
+++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.py
@@ -1,5 +1,8 @@
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.logging.logging_client import logging_client
+from prowler.providers.gcp.services.logging.logging_service import (
+    get_projects_covered_by_aggregated_metric,
+)
 from prowler.providers.gcp.services.monitoring.monitoring_client import (
     monitoring_client,
 )
@@ -10,12 +13,10 @@ class logging_log_metric_filter_and_alert_for_audit_configuration_changes_enable
 ):
     def execute(self) -> Check_Report_GCP:
         findings = []
+        metric_filter = 'protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:*'
         projects_with_metric = set()
         for metric in logging_client.metrics:
-            if (
-                'protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:*'
-                in metric.filter
-            ):
+            if metric_filter in metric.filter:
                 report = Check_Report_GCP(
                     metadata=self.metadata(),
                     resource=metric,
@@ -33,6 +34,11 @@ class logging_log_metric_filter_and_alert_for_audit_configuration_changes_enable
                             break
                 findings.append(report)
 
+        # Credit projects whose logs are centrally monitored via an org-level
+        # aggregated sink to a bucket-scoped metric + alert (instead of failing them).
+        centrally_covered = get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, metric_filter
+        )
         for project in logging_client.project_ids:
             if project not in projects_with_metric:
                 report = Check_Report_GCP(
@@ -46,8 +52,12 @@ class logging_log_metric_filter_and_alert_for_audit_configuration_changes_enable
                         else "GCP Project"
                     ),
                 )
-                report.status = "FAIL"
-                report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
+                if project in centrally_covered:
+                    report.status = "PASS"
+                    report.status_extended = f"Log metric filter {centrally_covered[project]} found with an alert, covering project {project} via an organization-level aggregated sink."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
                 findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.py
index 166f7b7ee8..e7d74f3f8e 100644
--- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.py
+++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.py
@@ -1,5 +1,8 @@
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.logging.logging_client import logging_client
+from prowler.providers.gcp.services.logging.logging_service import (
+    get_projects_covered_by_aggregated_metric,
+)
 from prowler.providers.gcp.services.monitoring.monitoring_client import (
     monitoring_client,
 )
@@ -8,12 +11,10 @@ from prowler.providers.gcp.services.monitoring.monitoring_client import (
 class logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled(Check):
     def execute(self) -> Check_Report_GCP:
         findings = []
+        metric_filter = 'resource.type="gcs_bucket" AND protoPayload.methodName="storage.setIamPermissions"'
         projects_with_metric = set()
         for metric in logging_client.metrics:
-            if (
-                'resource.type="gcs_bucket" AND protoPayload.methodName="storage.setIamPermissions"'
-                in metric.filter
-            ):
+            if metric_filter in metric.filter:
                 metric_name = getattr(metric, "name", None) or "unknown"
                 report = Check_Report_GCP(
                     metadata=self.metadata(),
@@ -36,6 +37,9 @@ class logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled(
                             break
                 findings.append(report)
 
+        centrally_covered = get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, metric_filter
+        )
         for project in logging_client.project_ids:
             if project not in projects_with_metric:
                 project_obj = logging_client.projects.get(project)
@@ -46,8 +50,12 @@ class logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled(
                     location=logging_client.region,
                     resource_name=(getattr(project_obj, "name", None) or "GCP Project"),
                 )
-                report.status = "FAIL"
-                report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
+                if project in centrally_covered:
+                    report.status = "PASS"
+                    report.status_extended = f"Log metric filter {centrally_covered[project]} found with an alert, covering project {project} via an organization-level aggregated sink."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
                 findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.py
index 7902f9ed72..cf7cdb1679 100644
--- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.py
+++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.py
@@ -1,5 +1,8 @@
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.logging.logging_client import logging_client
+from prowler.providers.gcp.services.logging.logging_service import (
+    get_projects_covered_by_aggregated_metric,
+)
 from prowler.providers.gcp.services.monitoring.monitoring_client import (
     monitoring_client,
 )
@@ -10,9 +13,10 @@ class logging_log_metric_filter_and_alert_for_compute_configuration_changes_enab
 ):
     def execute(self) -> Check_Report_GCP:
         findings = []
+        metric_filter = 'protoPayload.serviceName="compute.googleapis.com"'
         projects_with_metric = set()
         for metric in logging_client.metrics:
-            if 'protoPayload.serviceName="compute.googleapis.com"' in metric.filter:
+            if metric_filter in metric.filter:
                 report = Check_Report_GCP(
                     metadata=self.metadata(),
                     resource=metric,
@@ -30,6 +34,9 @@ class logging_log_metric_filter_and_alert_for_compute_configuration_changes_enab
                             break
                 findings.append(report)
 
+        centrally_covered = get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, metric_filter
+        )
         for project in logging_client.project_ids:
             if project not in projects_with_metric:
                 report = Check_Report_GCP(
@@ -43,8 +50,12 @@ class logging_log_metric_filter_and_alert_for_compute_configuration_changes_enab
                         else "GCP Project"
                     ),
                 )
-                report.status = "FAIL"
-                report.status_extended = f"There are no log metric filters or alerts associated for Compute Engine configuration changes in project {project}."
+                if project in centrally_covered:
+                    report.status = "PASS"
+                    report.status_extended = f"Log metric filter {centrally_covered[project]} found with an alert, covering project {project} via an organization-level aggregated sink."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"There are no log metric filters or alerts associated for Compute Engine configuration changes in project {project}."
                 findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.py
index 1e6584e5fb..f836dc25b2 100644
--- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.py
+++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.py
@@ -1,5 +1,8 @@
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.logging.logging_client import logging_client
+from prowler.providers.gcp.services.logging.logging_service import (
+    get_projects_covered_by_aggregated_metric,
+)
 from prowler.providers.gcp.services.monitoring.monitoring_client import (
     monitoring_client,
 )
@@ -8,12 +11,10 @@ from prowler.providers.gcp.services.monitoring.monitoring_client import (
 class logging_log_metric_filter_and_alert_for_custom_role_changes_enabled(Check):
     def execute(self) -> Check_Report_GCP:
         findings = []
+        metric_filter = 'resource.type="iam_role" AND (protoPayload.methodName="google.iam.admin.v1.CreateRole" OR protoPayload.methodName="google.iam.admin.v1.DeleteRole" OR protoPayload.methodName="google.iam.admin.v1.UpdateRole")'
         projects_with_metric = set()
         for metric in logging_client.metrics:
-            if (
-                'resource.type="iam_role" AND (protoPayload.methodName="google.iam.admin.v1.CreateRole" OR protoPayload.methodName="google.iam.admin.v1.DeleteRole" OR protoPayload.methodName="google.iam.admin.v1.UpdateRole")'
-                in metric.filter
-            ):
+            if metric_filter in metric.filter:
                 report = Check_Report_GCP(
                     metadata=self.metadata(),
                     resource=metric,
@@ -31,6 +32,9 @@ class logging_log_metric_filter_and_alert_for_custom_role_changes_enabled(Check)
                             break
                 findings.append(report)
 
+        centrally_covered = get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, metric_filter
+        )
         for project in logging_client.project_ids:
             if project not in projects_with_metric:
                 report = Check_Report_GCP(
@@ -44,8 +48,12 @@ class logging_log_metric_filter_and_alert_for_custom_role_changes_enabled(Check)
                         else "GCP Project"
                     ),
                 )
-                report.status = "FAIL"
-                report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
+                if project in centrally_covered:
+                    report.status = "PASS"
+                    report.status_extended = f"Log metric filter {centrally_covered[project]} found with an alert, covering project {project} via an organization-level aggregated sink."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
                 findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.py
index 8c8927ec32..b7bc619ea4 100644
--- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.py
+++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.py
@@ -1,5 +1,8 @@
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.logging.logging_client import logging_client
+from prowler.providers.gcp.services.logging.logging_service import (
+    get_projects_covered_by_aggregated_metric,
+)
 from prowler.providers.gcp.services.monitoring.monitoring_client import (
     monitoring_client,
 )
@@ -8,12 +11,10 @@ from prowler.providers.gcp.services.monitoring.monitoring_client import (
 class logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled(Check):
     def execute(self) -> Check_Report_GCP:
         findings = []
+        metric_filter = '(protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner") OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")'
         projects_with_metric = set()
         for metric in logging_client.metrics:
-            if (
-                '(protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner") OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")'
-                in metric.filter
-            ):
+            if metric_filter in metric.filter:
                 metric_name = getattr(metric, "name", None) or "unknown"
                 report = Check_Report_GCP(
                     metadata=self.metadata(),
@@ -36,6 +37,9 @@ class logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled(
                             break
                 findings.append(report)
 
+        centrally_covered = get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, metric_filter
+        )
         for project in logging_client.project_ids:
             if project not in projects_with_metric:
                 project_obj = logging_client.projects.get(project)
@@ -47,8 +51,12 @@ class logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled(
                     location=logging_client.region,
                     resource_name=(getattr(project_obj, "name", None) or "GCP Project"),
                 )
-                report.status = "FAIL"
-                report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
+                if project in centrally_covered:
+                    report.status = "PASS"
+                    report.status_extended = f"Log metric filter {centrally_covered[project]} found with an alert, covering project {project} via an organization-level aggregated sink."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
                 findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.py
index 3e499db10a..3c03ab0fde 100644
--- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.py
+++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.py
@@ -1,5 +1,8 @@
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.logging.logging_client import logging_client
+from prowler.providers.gcp.services.logging.logging_service import (
+    get_projects_covered_by_aggregated_metric,
+)
 from prowler.providers.gcp.services.monitoring.monitoring_client import (
     monitoring_client,
 )
@@ -10,9 +13,10 @@ class logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes
 ):
     def execute(self) -> Check_Report_GCP:
         findings = []
+        metric_filter = 'protoPayload.methodName="cloudsql.instances.update"'
         projects_with_metric = set()
         for metric in logging_client.metrics:
-            if 'protoPayload.methodName="cloudsql.instances.update"' in metric.filter:
+            if metric_filter in metric.filter:
                 report = Check_Report_GCP(
                     metadata=self.metadata(),
                     resource=metric,
@@ -30,6 +34,9 @@ class logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes
                             break
                 findings.append(report)
 
+        centrally_covered = get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, metric_filter
+        )
         for project in logging_client.project_ids:
             if project not in projects_with_metric:
                 report = Check_Report_GCP(
@@ -43,8 +50,12 @@ class logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes
                         else "GCP Project"
                     ),
                 )
-                report.status = "FAIL"
-                report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
+                if project in centrally_covered:
+                    report.status = "PASS"
+                    report.status_extended = f"Log metric filter {centrally_covered[project]} found with an alert, covering project {project} via an organization-level aggregated sink."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
                 findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.py
index e2b7cdcc13..0e05838f05 100644
--- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.py
+++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.py
@@ -1,5 +1,8 @@
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.logging.logging_client import logging_client
+from prowler.providers.gcp.services.logging.logging_service import (
+    get_projects_covered_by_aggregated_metric,
+)
 from prowler.providers.gcp.services.monitoring.monitoring_client import (
     monitoring_client,
 )
@@ -8,12 +11,10 @@ from prowler.providers.gcp.services.monitoring.monitoring_client import (
 class logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled(Check):
     def execute(self) -> Check_Report_GCP:
         findings = []
+        metric_filter = 'resource.type="gce_firewall_rule" AND (protoPayload.methodName:"compute.firewalls.patch" OR protoPayload.methodName:"compute.firewalls.insert" OR protoPayload.methodName:"compute.firewalls.delete")'
         projects_with_metric = set()
         for metric in logging_client.metrics:
-            if (
-                'resource.type="gce_firewall_rule" AND (protoPayload.methodName:"compute.firewalls.patch" OR protoPayload.methodName:"compute.firewalls.insert" OR protoPayload.methodName:"compute.firewalls.delete")'
-                in metric.filter
-            ):
+            if metric_filter in metric.filter:
                 report = Check_Report_GCP(
                     metadata=self.metadata(),
                     resource=metric,
@@ -31,6 +32,9 @@ class logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled(
                             break
                 findings.append(report)
 
+        centrally_covered = get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, metric_filter
+        )
         for project in logging_client.project_ids:
             if project not in projects_with_metric:
                 report = Check_Report_GCP(
@@ -44,8 +48,12 @@ class logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled(
                         else "GCP Project"
                     ),
                 )
-                report.status = "FAIL"
-                report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
+                if project in centrally_covered:
+                    report.status = "PASS"
+                    report.status_extended = f"Log metric filter {centrally_covered[project]} found with an alert, covering project {project} via an organization-level aggregated sink."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
                 findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.py
index c8b15ce1ee..1330ad7a9a 100644
--- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.py
+++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.py
@@ -1,5 +1,8 @@
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.logging.logging_client import logging_client
+from prowler.providers.gcp.services.logging.logging_service import (
+    get_projects_covered_by_aggregated_metric,
+)
 from prowler.providers.gcp.services.monitoring.monitoring_client import (
     monitoring_client,
 )
@@ -8,12 +11,10 @@ from prowler.providers.gcp.services.monitoring.monitoring_client import (
 class logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled(Check):
     def execute(self) -> Check_Report_GCP:
         findings = []
+        metric_filter = 'resource.type="gce_network" AND (protoPayload.methodName:"compute.networks.insert" OR protoPayload.methodName:"compute.networks.patch" OR protoPayload.methodName:"compute.networks.delete" OR protoPayload.methodName:"compute.networks.removePeering" OR protoPayload.methodName:"compute.networks.addPeering")'
         projects_with_metric = set()
         for metric in logging_client.metrics:
-            if (
-                'resource.type="gce_network" AND (protoPayload.methodName:"compute.networks.insert" OR protoPayload.methodName:"compute.networks.patch" OR protoPayload.methodName:"compute.networks.delete" OR protoPayload.methodName:"compute.networks.removePeering" OR protoPayload.methodName:"compute.networks.addPeering")'
-                in metric.filter
-            ):
+            if metric_filter in metric.filter:
                 report = Check_Report_GCP(
                     metadata=self.metadata(),
                     resource=metric,
@@ -31,6 +32,9 @@ class logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled(Check)
                             break
                 findings.append(report)
 
+        centrally_covered = get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, metric_filter
+        )
         for project in logging_client.project_ids:
             if project not in projects_with_metric:
                 report = Check_Report_GCP(
@@ -44,8 +48,12 @@ class logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled(Check)
                         else "GCP Project"
                     ),
                 )
-                report.status = "FAIL"
-                report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
+                if project in centrally_covered:
+                    report.status = "PASS"
+                    report.status_extended = f"Log metric filter {centrally_covered[project]} found with an alert, covering project {project} via an organization-level aggregated sink."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
                 findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.py
index f840d75852..27f25879e8 100644
--- a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.py
+++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.py
@@ -1,5 +1,8 @@
 from prowler.lib.check.models import Check, Check_Report_GCP
 from prowler.providers.gcp.services.logging.logging_client import logging_client
+from prowler.providers.gcp.services.logging.logging_service import (
+    get_projects_covered_by_aggregated_metric,
+)
 from prowler.providers.gcp.services.monitoring.monitoring_client import (
     monitoring_client,
 )
@@ -8,12 +11,10 @@ from prowler.providers.gcp.services.monitoring.monitoring_client import (
 class logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled(Check):
     def execute(self) -> Check_Report_GCP:
         findings = []
+        metric_filter = 'resource.type="gce_route" AND (protoPayload.methodName:"compute.routes.delete" OR protoPayload.methodName:"compute.routes.insert")'
         projects_with_metric = set()
         for metric in logging_client.metrics:
-            if (
-                'resource.type="gce_route" AND (protoPayload.methodName:"compute.routes.delete" OR protoPayload.methodName:"compute.routes.insert")'
-                in metric.filter
-            ):
+            if metric_filter in metric.filter:
                 report = Check_Report_GCP(
                     metadata=self.metadata(),
                     resource=metric,
@@ -31,6 +32,9 @@ class logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled(
                             break
                 findings.append(report)
 
+        centrally_covered = get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, metric_filter
+        )
         for project in logging_client.project_ids:
             if project not in projects_with_metric:
                 report = Check_Report_GCP(
@@ -44,8 +48,12 @@ class logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled(
                         else "GCP Project"
                     ),
                 )
-                report.status = "FAIL"
-                report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
+                if project in centrally_covered:
+                    report.status = "PASS"
+                    report.status_extended = f"Log metric filter {centrally_covered[project]} found with an alert, covering project {project} via an organization-level aggregated sink."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"There are no log metric filters or alerts associated in project {project}."
                 findings.append(report)
 
         return findings
diff --git a/prowler/providers/gcp/services/logging/logging_service.py b/prowler/providers/gcp/services/logging/logging_service.py
index 637c8782b2..7d8843584e 100644
--- a/prowler/providers/gcp/services/logging/logging_service.py
+++ b/prowler/providers/gcp/services/logging/logging_service.py
@@ -1,9 +1,12 @@
+import re
+
 from pydantic.v1 import BaseModel
 
 from prowler.lib.logger import logger
 from prowler.providers.gcp.config import DEFAULT_RETRY_ATTEMPTS
 from prowler.providers.gcp.gcp_provider import GcpProvider
 from prowler.providers.gcp.lib.service.service import GCPService
+from prowler.providers.gcp.services.monitoring.monitoring_service import Monitoring
 
 
 class Logging(GCPService):
@@ -12,6 +15,7 @@ class Logging(GCPService):
         self.sinks = []
         self.metrics = []
         self._get_sinks()
+        self._get_org_sinks()
         self._get_metrics()
 
     def _get_sinks(self):
@@ -39,6 +43,38 @@ class Logging(GCPService):
                     f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                 )
 
+    def _get_org_sinks(self):
+        """Fetch org-level sinks with includeChildren so child projects are not falsely failed."""
+        org_ids = set()
+        for project in self.projects.values():
+            if project.organization:
+                org_ids.add(project.organization.id)
+
+        for org_id in org_ids:
+            try:
+                request = self.client.sinks().list(parent=f"organizations/{org_id}")
+                while request is not None:
+                    response = request.execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+
+                    for sink in response.get("sinks", []):
+                        self.sinks.append(
+                            Sink(
+                                name=sink["name"],
+                                destination=sink["destination"],
+                                filter=sink.get("filter", "all"),
+                                project_id=f"organizations/{org_id}",
+                                include_children=sink.get("includeChildren", False),
+                            )
+                        )
+
+                    request = self.client.sinks().list_next(
+                        previous_request=request, previous_response=response
+                    )
+            except Exception as error:
+                logger.error(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
     def _get_metrics(self):
         for project_id in self.project_ids:
             try:
@@ -57,6 +93,7 @@ class Logging(GCPService):
                                 type=metric["metricDescriptor"]["type"],
                                 filter=metric["filter"],
                                 project_id=project_id,
+                                bucket_name=metric.get("bucketName", ""),
                             )
                         )
 
@@ -76,6 +113,7 @@ class Sink(BaseModel):
     destination: str
     filter: str
     project_id: str
+    include_children: bool = False
 
 
 class Metric(BaseModel):
@@ -83,3 +121,140 @@ class Metric(BaseModel):
     type: str
     filter: str
     project_id: str
+    bucket_name: str = ""
+
+
+# A positive selector of the Admin Activity stream: a ``logName`` predicate
+# (``:`` has-substring or ``=`` equals) or a ``log_id()`` call. Written verbose
+# so each fragment stays legible; ``(?![a-z_])`` keeps a longer stream name
+# (``.../activity_v2``) from impersonating Admin Activity.
+_ACTIVITY_SELECTOR = re.compile(
+    r"""
+    (?: logName \s* [:=] \s* | log_id \s* \( \s* )   # logName: / logName= / log_id(
+    ["']? [^"'\s)]*                                  # optional quote, then path prefix
+    cloudaudit\.googleapis\.com/activity (?![a-z_])  # the Admin Activity stream itself
+    """,
+    re.IGNORECASE | re.VERBOSE,
+)
+
+# The same selector for *any* Cloud Audit stream (activity, data_access,
+# system_event, policy, access_transparency, …). Used to strip the OR-combined
+# audit clauses so we can prove nothing restrictive is left over.
+_CLOUDAUDIT_SELECTOR = re.compile(
+    r"""
+    (?: logName \s* [:=] \s* | log_id \s* \( \s* )   # logName: / logName= / log_id(
+    ["']? [^"'\s)]*                                  # optional quote, then path prefix
+    cloudaudit\.googleapis\.com/[a-z_]+              # any cloudaudit stream
+    ["']? \s* \)?                                    # optional closing quote / paren
+    """,
+    re.IGNORECASE | re.VERBOSE,
+)
+
+# Operators that exclude or narrow coverage. Any of these means we cannot prove
+# the sink delivers the *whole* Admin Activity stream, so it is not credited.
+_NEGATION_OR_RESTRICTION = re.compile(
+    r"""
+      \bNOT\b                       # NOT exclusion
+    | \bAND\b                       # AND conjunction (restriction)
+    | != | !:                       # "!=" / "!:" inequality
+    | (?:^|[\s(]) -\s* [A-Za-z_]    # leading "-" exclusion operator
+    """,
+    re.IGNORECASE | re.VERBOSE,
+)
+
+
+def _sink_delivers_activity_logs(sink_filter: str) -> bool:
+    """True only when a sink's filter *provably* exports the full Admin Activity
+    audit stream (or everything).
+
+    Crediting flips a child project to PASS on a CIS security control, so the
+    match is deliberately conservative: a false FAIL is safe, a false PASS is
+    not. A non-``"all"`` filter is credited only when
+
+      1. it positively selects the Admin Activity stream
+         (``logName:.../activity``, ``logName="...activity"`` or
+         ``log_id("...activity")``);
+      2. it carries no operator that excludes or narrows the stream — ``NOT`` /
+         ``-`` / ``!=`` (negation) or ``AND`` (restriction); and
+      3. nothing but ``OR``-combined Cloud Audit selectors remains once those are
+         stripped — an ``OR`` only widens coverage, but any leftover predicate
+         (``severity>=ERROR``, ``resource.type=...``) could narrow it.
+
+    Sink filters encode the stream URL-encoded (``...%2Factivity``) or as a path
+    — normalize before matching.
+    """
+    if not sink_filter or sink_filter.strip().lower() == "all":
+        return True
+    normalized = sink_filter.replace("%2F", "/").replace("%2f", "/")
+    # 1. The Admin Activity stream must be positively selected.
+    if not _ACTIVITY_SELECTOR.search(normalized):
+        return False
+    # 2. No operator may exclude or narrow that coverage.
+    if _NEGATION_OR_RESTRICTION.search(normalized):
+        return False
+    # 3. Only OR-combined audit selectors may remain — strip them and the OR
+    #    glue; anything left is a predicate we cannot prove is full-coverage.
+    remainder = _CLOUDAUDIT_SELECTOR.sub(" ", normalized)
+    remainder = re.sub(r"\bOR\b|[()\s]", " ", remainder, flags=re.IGNORECASE)
+    return remainder.strip() == ""
+
+
+def get_projects_covered_by_aggregated_metric(
+    logging_client: Logging,
+    monitoring_client: Monitoring,
+    metric_filter: str,
+) -> dict[str, str]:
+    """Return {project_id: metric_name} for scanned projects whose logs are routed,
+    via an organization-level sink with includeChildren=True, to a bucket that holds
+    a bucket-scoped log metric matching ``metric_filter`` that has an alert policy.
+
+    The CIS GCP logging-metric checks are written per-project, but a common (and
+    recommended) topology centralizes monitoring: an org-level aggregated sink ships
+    every child project's logs into one bucket, where a single bucket-scoped metric
+    + alert covers them all. Without crediting that, those child projects are falsely
+    failed. Mirrors the org-sink handling already in ``logging_sink_created`` (#11355).
+
+    A sink is credited when it exports everything (``filter == "all"``) or when its
+    filter carries the Admin Activity audit stream — the only stream the CIS metric
+    filters can match (see ``_sink_delivers_activity_logs``).
+    """
+    # Buckets that hold a matching, alerted, bucket-scoped metric -> metric name.
+    bucket_to_metric = {}
+    for metric in logging_client.metrics:
+        if not getattr(metric, "bucket_name", ""):
+            continue
+        if metric_filter not in metric.filter:
+            continue
+        if any(
+            metric.name in policy_filter
+            for alert_policy in monitoring_client.alert_policies
+            for policy_filter in alert_policy.filters
+        ):
+            bucket_to_metric[metric.bucket_name] = metric.name
+    if not bucket_to_metric:
+        return {}
+
+    # Org resources whose includeChildren sink targets one of those buckets.
+    org_to_metric = {}
+    for sink in logging_client.sinks:
+        if not getattr(sink, "include_children", False):
+            continue
+        if not _sink_delivers_activity_logs(getattr(sink, "filter", "all")):
+            continue
+        for bucket, metric_name in bucket_to_metric.items():
+            # sink.destination e.g. "logging.googleapis.com/projects/.../buckets/X";
+            # metric.bucket_name e.g. "projects/.../buckets/X".
+            if sink.destination.endswith(bucket):
+                org_to_metric[sink.project_id] = metric_name
+                break
+    if not org_to_metric:
+        return {}
+
+    # Scanned projects sitting under a covering organization.
+    covered = {}
+    for project_id in logging_client.project_ids:
+        project = logging_client.projects.get(project_id)
+        organization = getattr(project, "organization", None) if project else None
+        if organization and f"organizations/{organization.id}" in org_to_metric:
+            covered[project_id] = org_to_metric[f"organizations/{organization.id}"]
+    return covered
diff --git a/prowler/providers/gcp/services/logging/logging_sink_created/logging_sink_created.py b/prowler/providers/gcp/services/logging/logging_sink_created/logging_sink_created.py
index 30104a050d..a7846e3dd8 100644
--- a/prowler/providers/gcp/services/logging/logging_sink_created/logging_sink_created.py
+++ b/prowler/providers/gcp/services/logging/logging_sink_created/logging_sink_created.py
@@ -5,26 +5,30 @@ from prowler.providers.gcp.services.logging.logging_client import logging_client
 class logging_sink_created(Check):
     def execute(self) -> Check_Report_GCP:
         findings = []
+
+        # Map project_id -> sink for direct project-level sinks
         projects_with_logging_sink = {}
         for sink in logging_client.sinks:
-            if sink.filter == "all":
+            if sink.filter == "all" and not sink.include_children:
                 projects_with_logging_sink[sink.project_id] = sink
 
+        # Collect org resource names that have a covering sink (includeChildren=True)
+        covering_org_sinks = {}
+        for sink in logging_client.sinks:
+            if sink.filter == "all" and sink.include_children:
+                covering_org_sinks[sink.project_id] = sink
+
         for project in logging_client.project_ids:
-            if project not in projects_with_logging_sink.keys():
-                project_obj = logging_client.projects.get(project)
-                report = Check_Report_GCP(
-                    metadata=self.metadata(),
-                    resource=project_obj,
-                    resource_id=project,
-                    project_id=project,
-                    location=logging_client.region,
-                    resource_name=(getattr(project_obj, "name", None) or "GCP Project"),
-                )
-                report.status = "FAIL"
-                report.status_extended = f"There are no logging sinks to export copies of all the log entries in project {project}."
-                findings.append(report)
-            else:
+            project_obj = logging_client.projects.get(project)
+
+            # Determine whether this project is covered by an org-level sink
+            org = getattr(project_obj, "organization", None) if project_obj else None
+            org_resource = f"organizations/{org.id}" if org else None
+            covering_sink = (
+                covering_org_sinks.get(org_resource) if org_resource else None
+            )
+
+            if project in projects_with_logging_sink:
                 sink = projects_with_logging_sink[project]
                 sink_name = getattr(sink, "name", None) or "unknown"
                 report = Check_Report_GCP(
@@ -40,4 +44,31 @@ class logging_sink_created(Check):
                 report.status = "PASS"
                 report.status_extended = f"Sink {sink_name} is enabled exporting copies of all the log entries in project {project}."
                 findings.append(report)
+            elif covering_sink:
+                sink_name = getattr(covering_sink, "name", None) or "unknown"
+                report = Check_Report_GCP(
+                    metadata=self.metadata(),
+                    resource=covering_sink,
+                    resource_id=sink_name,
+                    project_id=project,
+                    location=logging_client.region,
+                    resource_name=(
+                        sink_name if sink_name != "unknown" else "Logging Sink"
+                    ),
+                )
+                report.status = "PASS"
+                report.status_extended = f"Sink {sink_name} at organization level is exporting copies of all the log entries in project {project}."
+                findings.append(report)
+            else:
+                report = Check_Report_GCP(
+                    metadata=self.metadata(),
+                    resource=project_obj,
+                    resource_id=project,
+                    project_id=project,
+                    location=logging_client.region,
+                    resource_name=(getattr(project_obj, "name", None) or "GCP Project"),
+                )
+                report.status = "FAIL"
+                report.status_extended = f"There are no logging sinks to export copies of all the log entries in project {project}."
+                findings.append(report)
         return findings
diff --git a/prowler/providers/m365/lib/powershell/m365_powershell.py b/prowler/providers/m365/lib/powershell/m365_powershell.py
index 1bc8aa4075..4dae094d90 100644
--- a/prowler/providers/m365/lib/powershell/m365_powershell.py
+++ b/prowler/providers/m365/lib/powershell/m365_powershell.py
@@ -950,6 +950,32 @@ class M365PowerShell(PowerShellSession):
             "Get-TeamsProtectionPolicy | ConvertTo-Json -Depth 10", json_parse=True
         )
 
+    def get_mailboxes(self) -> dict:
+        """
+        Get Exchange Online Recipient-Facing Mailboxes.
+
+        Retrieves all recipient-facing mailboxes from Exchange Online with the
+        properties needed to evaluate primary SMTP domain policy.
+
+        Returns:
+            dict: Mailbox information in JSON format.
+
+        Example:
+            >>> get_mailboxes()
+            [
+                {
+                    "Identity": "user1@contoso.com",
+                    "DisplayName": "User One",
+                    "PrimarySmtpAddress": "user1@contoso.com",
+                    "RecipientTypeDetails": "UserMailbox"
+                }
+            ]
+        """
+        return self.execute(
+            "Get-EXOMailbox -ResultSize Unlimited | Select-Object Identity, DisplayName, PrimarySmtpAddress, RecipientTypeDetails | ConvertTo-Json -Depth 10",
+            json_parse=True,
+        )
+
     def get_shared_mailboxes(self) -> dict:
         """
         Get Exchange Online Shared Mailboxes.
diff --git a/prowler/providers/m365/services/admincenter/admincenter_service.py b/prowler/providers/m365/services/admincenter/admincenter_service.py
index 45be16d11a..3899dced67 100644
--- a/prowler/providers/m365/services/admincenter/admincenter_service.py
+++ b/prowler/providers/m365/services/admincenter/admincenter_service.py
@@ -175,17 +175,23 @@ class AdminCenter(M365Service):
         try:
             groups_list = await self.client.groups.get()
             groups.update({})
-            for group in groups_list.value:
-                groups.update(
-                    {
-                        group.id: Group(
-                            id=group.id,
-                            name=getattr(group, "display_name", ""),
-                            visibility=getattr(group, "visibility", ""),
-                            group_types=getattr(group, "group_types", []) or [],
-                        )
-                    }
-                )
+            while groups_list:
+                for group in getattr(groups_list, "value", []) or []:
+                    groups.update(
+                        {
+                            group.id: Group(
+                                id=group.id,
+                                name=getattr(group, "display_name", ""),
+                                visibility=getattr(group, "visibility", ""),
+                                group_types=getattr(group, "group_types", []) or [],
+                            )
+                        }
+                    )
+
+                next_link = getattr(groups_list, "odata_next_link", None)
+                if not next_link:
+                    break
+                groups_list = await self.client.groups.with_url(next_link).get()
 
         except Exception as error:
             logger.error(
diff --git a/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/__init__.py b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.metadata.json b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.metadata.json
new file mode 100644
index 0000000000..42b3acaeb6
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.metadata.json
@@ -0,0 +1,44 @@
+{
+  "Provider": "m365",
+  "CheckID": "entra_conditional_access_policy_no_deleted_object_references",
+  "CheckTitle": "Conditional Access policies must not reference deleted users, groups, or roles",
+  "CheckType": [],
+  "ServiceName": "entra",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every object identifier referenced by any Conditional Access policy under conditions.users (includeUsers, excludeUsers, includeGroups, excludeGroups, includeRoles, excludeRoles) must resolve to an existing Microsoft Entra object. This check audits all Conditional Access policies regardless of state and reports any whose user, group, or role references no longer resolve in the directory.",
+  "Risk": "When a user, group, or directory role referenced by a Conditional Access policy stops resolving (account or group deleted, role template removed), the reference becomes orphaned. include* references silently shrink the policy's enforcement scope; exclude* references can cause the policy to evaluate unexpectedly. This is a common root cause of MFA-not-applied incidents.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccessusers?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/unifiedroledefinition-get?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com)\n2. Navigate to Protection > Conditional Access > Policies\n3. Open each policy reported by this check\n4. Under Assignments > Users, remove every user, group, or role identifier reported as deleted\n5. Save the policy and re-run the audit\n6. For ongoing hygiene, audit Conditional Access policies after any bulk user/group/role cleanup",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Audit each Conditional Access policy quarterly and remove references to deleted users, groups, or directory roles. Stale references in include collections silently shrink enforcement scope; stale references in exclude collections can cause policies to behave unexpectedly. Treat both as misconfigurations regardless of policy state.",
+      "Url": "https://hub.prowler.com/check/entra_conditional_access_policy_no_deleted_object_references"
+    }
+  },
+  "Categories": [
+    "identity-access",
+    "e3"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "entra_conditional_access_policy_directory_sync_account_excluded"
+  ],
+  "Notes": "The check runs against all Conditional Access policies regardless of state (enabled, disabled, enabledForReportingButNotEnforced) — stale references in disabled policies are a misconfiguration that becomes live the moment the policy is re-enabled. Only HTTP 404 responses flag an identifier as deleted (FAIL). Transient Graph errors (5xx, throttling, insufficient permissions) are not treated as deletions; a policy whose references could not be resolved for those reasons is reported as MANUAL so it is not silently considered clean."
+}
diff --git a/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.py b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.py
new file mode 100644
index 0000000000..e5c5eff389
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.py
@@ -0,0 +1,157 @@
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.entra.entra_client import entra_client
+from prowler.providers.m365.services.entra.entra_service import (
+    CONDITIONAL_ACCESS_SENTINEL_IDS,
+    ConditionalAccessPolicyState,
+)
+
+
+class entra_conditional_access_policy_no_deleted_object_references(Check):
+    """
+    Ensure Conditional Access policies do not reference deleted directory objects.
+
+    Stale references to deleted users, groups, or directory roles silently change
+    the runtime behavior of a Conditional Access policy: include* references
+    shrink enforcement scope, exclude* references can change exemption logic.
+    Either way, the policy stops behaving the way the operator believes it does.
+
+    The directory-object existence check runs once at service init time and is
+    cached on the entra client. This check reads from that cache and reports any
+    policy whose users/groups/roles inclusion or exclusion collections name an
+    identifier that no longer resolves in Microsoft Entra ID.
+
+    Identifiers whose Graph lookup failed with a non-404 error (5xx, throttling,
+    insufficient permissions) are cached separately: they could not be verified
+    as present or deleted, so the policy is reported as MANUAL rather than being
+    silently treated as clean.
+
+    - PASS: The policy references no deleted users, groups, or roles.
+    - FAIL: The policy references at least one deleted user, group, or role.
+    - MANUAL: At least one referenced identifier could not be resolved due to a
+      transient Graph error, so the policy could not be fully evaluated.
+    """
+
+    def execute(self) -> list[CheckReportM365]:
+        findings = []
+        unresolved = entra_client.unresolved_directory_object_references
+        errored = entra_client.errored_directory_object_references
+
+        for policy_id, policy in entra_client.conditional_access_policies.items():
+            report = CheckReportM365(
+                metadata=self.metadata(),
+                resource=policy,
+                resource_name=policy.display_name,
+                resource_id=policy_id,
+            )
+
+            orphans = self._collect_references_in(policy, unresolved)
+            unverified = self._collect_references_in(policy, errored)
+
+            if orphans:
+                # A confirmed deletion takes precedence over unverified ones.
+                report.status = "FAIL"
+                report.status_extended = self._format_failure(
+                    policy.display_name, orphans, unverified, policy.state
+                )
+            elif unverified:
+                # Nothing confirmed deleted, but we could not verify every
+                # reference — do not claim the policy is clean.
+                report.status = "MANUAL"
+                report.status_extended = self._format_manual(
+                    policy.display_name, unverified
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Conditional Access policy {policy.display_name} references no "
+                    f"deleted directory objects."
+                )
+
+            findings.append(report)
+
+        return findings
+
+    @staticmethod
+    def _collect_references_in(policy, id_set):
+        """Walk the six identifier collections and return references in ``id_set``.
+
+        Args:
+            policy: The Conditional Access policy to inspect.
+            id_set: Set of ``(type, id)`` pairs to match references against.
+
+        Returns:
+            list[tuple[str, str, str]]: ``(type, id, side)`` tuples where
+                ``type`` is one of ``user|group|role``, ``id`` is the Graph
+                identifier, and ``side`` is one of ``include|exclude``.
+        """
+        if not policy.conditions or not policy.conditions.user_conditions:
+            return []
+
+        uc = policy.conditions.user_conditions
+        collections = (
+            ("user", "include", uc.included_users),
+            ("user", "exclude", uc.excluded_users),
+            ("group", "include", uc.included_groups),
+            ("group", "exclude", uc.excluded_groups),
+            ("role", "include", uc.included_roles),
+            ("role", "exclude", uc.excluded_roles),
+        )
+
+        matches = []
+        for type_, side, identifiers in collections:
+            for identifier in identifiers:
+                if identifier in CONDITIONAL_ACCESS_SENTINEL_IDS:
+                    continue
+                if (type_, identifier) in id_set:
+                    matches.append((type_, identifier, side))
+        return matches
+
+    @staticmethod
+    def _group_by_type(references):
+        """Group ``(type, id, side)`` references into a deterministic message part."""
+        by_type = {"user": [], "group": [], "role": []}
+        for type_, identifier, side in references:
+            by_type[type_].append(f"{identifier} ({side})")
+
+        parts = []
+        for type_ in ("user", "group", "role"):
+            if by_type[type_]:
+                joined = ", ".join(sorted(by_type[type_]))
+                parts.append(f"{type_}s: {joined}")
+        return "; ".join(parts)
+
+    @classmethod
+    def _format_failure(cls, display_name, orphans, unverified, state=None):
+        # Surface report-only mode explicitly: the stale references are not yet
+        # enforced, but become live the moment the policy is turned on.
+        report_only = (
+            " The policy is in report-only mode, so these references are not "
+            "enforced yet but will take effect once it is enabled."
+            if state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING
+            else ""
+        )
+
+        # If some references also could not be resolved, say so rather than
+        # implying the rest of the policy is fully clean.
+        unverified_note = (
+            f" Additionally, {len(unverified)} reference(s) could not be verified "
+            f"due to transient Microsoft Graph errors."
+            if unverified
+            else ""
+        )
+
+        return (
+            f"Conditional Access policy {display_name} references "
+            f"{len(orphans)} deleted directory object(s) — "
+            f"{cls._group_by_type(orphans)}.{report_only}{unverified_note}"
+        )
+
+    @classmethod
+    def _format_manual(cls, display_name, unverified):
+        return (
+            f"Conditional Access policy {display_name} could not be fully evaluated: "
+            f"{len(unverified)} reference(s) could not be resolved due to transient "
+            f"Microsoft Graph errors (5xx, throttling, or insufficient permissions) — "
+            f"{cls._group_by_type(unverified)}. Re-run the scan or review the policy "
+            f"manually."
+        )
diff --git a/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/__init__.py b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.metadata.json b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.metadata.json
new file mode 100644
index 0000000000..0cc14e2965
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.metadata.json
@@ -0,0 +1,42 @@
+{
+  "Provider": "m365",
+  "CheckID": "entra_directory_sync_object_takeover_blocked",
+  "CheckTitle": "Microsoft Entra directory sync must block object takeover (soft- and hard-matching)",
+  "CheckType": [],
+  "ServiceName": "entra",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "When on-premises directory synchronization is enabled, both blockSoftMatchEnabled and blockCloudObjectTakeoverThroughHardMatchEnabled must be true. Without these blocks, an attacker who can write to on-premises AD can craft an object that matches a privileged cloud account and take it over.",
+  "Risk": "An attacker with write access to on-premises Active Directory can create an object whose UPN, SMTP address, or ImmutableID matches an existing cloud-only account (e.g. Global Administrator). When the sync engine processes this object, it merges the on-premises identity into the cloud account, effectively granting the attacker full control of that privileged account.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/graph/api/resources/onpremisesdirectorysynchronization?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/resources/onpremisesdirectorysynchronizationfeature?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-syncservice-features"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Open Microsoft Entra admin center\n2. Navigate to Identity > Hybrid management > Microsoft Entra Connect > Connect Sync\n3. Enable 'Block soft match' and 'Block cloud object takeover through hard match'\n4. Alternatively, use Microsoft Graph API to set both features to true on the onPremisesDirectorySynchronization resource",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable both blockSoftMatchEnabled and blockCloudObjectTakeoverThroughHardMatchEnabled on the on-premises directory synchronization configuration. These should remain enabled permanently except during time-boxed migration windows.",
+      "Url": "https://hub.prowler.com/check/entra_directory_sync_object_takeover_blocked"
+    }
+  },
+  "Categories": [
+    "identity-access",
+    "e3"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "entra_password_hash_sync_enabled",
+    "entra_seamless_sso_disabled"
+  ],
+  "Notes": "This check only applies to hybrid tenants with on-premises directory synchronization enabled. Cloud-only tenants receive a PASS since the attack path does not exist."
+}
diff --git a/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.py b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.py
new file mode 100644
index 0000000000..d1f00a70ff
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.py
@@ -0,0 +1,118 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.entra.entra_client import entra_client
+
+
+class entra_directory_sync_object_takeover_blocked(Check):
+    """Check that directory sync blocks object takeover via soft-match and hard-match.
+
+    When on-premises directory synchronization is enabled, an attacker who can
+    write to on-premises AD can craft an object that matches a privileged cloud
+    account and take it over. Both blockSoftMatchEnabled and
+    blockCloudObjectTakeoverThroughHardMatchEnabled must be true to prevent this.
+
+    The attack path only exists on hybrid tenants, so the tenant's
+    organization.onPremisesSyncEnabled is evaluated first. Microsoft Graph
+    returns an onPremisesSynchronization object (with all features disabled) even
+    for cloud-only tenants, so the directory sync features must not be evaluated
+    unless on-premises synchronization is actually enabled.
+
+    - PASS: The tenant is cloud-only, or both block flags are enabled.
+    - FAIL: On-premises sync is enabled and either block flag is disabled.
+    - MANUAL: On-premises sync is enabled but the settings cannot be read
+      (insufficient permissions) or were not returned by Microsoft Graph.
+    """
+
+    def execute(self) -> List[CheckReportM365]:
+        findings = []
+
+        organizations = entra_client.organizations or []
+        on_premises_sync_enabled = any(
+            organization.on_premises_sync_enabled for organization in organizations
+        )
+
+        # Cloud-only tenant: the object takeover attack path does not exist, so
+        # the directory sync features are not evaluated even if Microsoft Graph
+        # returns an (all-disabled) onPremisesSynchronization object.
+        if organizations and not on_premises_sync_enabled:
+            for organization in organizations:
+                report = CheckReportM365(
+                    self.metadata(),
+                    resource=organization,
+                    resource_id=organization.id,
+                    resource_name=organization.name,
+                )
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Entra organization {organization.name} is cloud-only "
+                    "(no on-premises sync), object takeover protection is not "
+                    "applicable."
+                )
+                findings.append(report)
+            return findings
+
+        # Hybrid tenant but the directory sync settings could not be read.
+        if entra_client.directory_sync_error:
+            for organization in organizations:
+                report = CheckReportM365(
+                    self.metadata(),
+                    resource=organization,
+                    resource_id=organization.id,
+                    resource_name=organization.name,
+                )
+                report.status = "MANUAL"
+                report.status_extended = (
+                    f"Cannot verify object takeover protection for "
+                    f"{organization.name}: {entra_client.directory_sync_error}."
+                )
+                findings.append(report)
+            return findings
+
+        for sync_settings in entra_client.directory_sync_settings:
+            report = CheckReportM365(
+                self.metadata(),
+                resource=sync_settings,
+                resource_id=sync_settings.id,
+                resource_name=f"Directory Sync {sync_settings.id}",
+            )
+
+            disabled_flags = []
+            if not sync_settings.block_soft_match_enabled:
+                disabled_flags.append("blockSoftMatchEnabled")
+            if not sync_settings.block_cloud_object_takeover_through_hard_match_enabled:
+                disabled_flags.append("blockCloudObjectTakeoverThroughHardMatchEnabled")
+
+            if not disabled_flags:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Entra directory sync {sync_settings.id} blocks both soft-match "
+                    "and hard-match object takeover."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Entra directory sync {sync_settings.id} does not block object "
+                    f"takeover: {', '.join(disabled_flags)} disabled."
+                )
+
+            findings.append(report)
+
+        # Hybrid tenant that reported on-premises sync but returned no settings.
+        if not entra_client.directory_sync_settings:
+            for organization in organizations:
+                report = CheckReportM365(
+                    self.metadata(),
+                    resource=organization,
+                    resource_id=organization.id,
+                    resource_name=organization.name,
+                )
+                report.status = "MANUAL"
+                report.status_extended = (
+                    f"Entra organization {organization.name} has on-premises sync "
+                    "enabled, but no directory sync settings were returned. Review "
+                    "the tenant configuration manually."
+                )
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/m365/services/entra/entra_service.py b/prowler/providers/m365/services/entra/entra_service.py
index a09ee32da0..bbaa80edcc 100644
--- a/prowler/providers/m365/services/entra/entra_service.py
+++ b/prowler/providers/m365/services/entra/entra_service.py
@@ -3,7 +3,7 @@ import json
 from asyncio import gather
 from datetime import datetime, timezone
 from enum import Enum
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, Optional, Set, Tuple
 from uuid import UUID
 
 from kiota_abstractions.base_request_configuration import RequestConfiguration
@@ -18,6 +18,12 @@ from prowler.lib.logger import logger
 from prowler.providers.m365.lib.service.service import M365Service
 from prowler.providers.m365.m365_provider import M365Provider
 
+# Sentinel identifiers used in Conditional Access ``conditions.users``
+# collections that do not correspond to real directory objects and must not be
+# resolved against Graph. Shared by the resolver below and the check that reads
+# its result.
+CONDITIONAL_ACCESS_SENTINEL_IDS = {"All", "None", "GuestsOrExternalUsers"}
+
 
 class Entra(M365Service):
     """
@@ -110,6 +116,23 @@ class Entra(M365Service):
         self.app_registrations: Dict[str, "AppRegistration"] = attributes[11]
         self.user_accounts_status = {}
 
+        # Resolve directory-object identifiers referenced by Conditional Access
+        # policies. This runs as a separate phase because it depends on the
+        # main gather having populated ``conditional_access_policies`` first.
+        # The result is cached on the instance so sync checks can read it
+        # without issuing Graph calls of their own. ``unresolved`` holds ids
+        # confirmed deleted (HTTP 404); ``errored`` holds ids whose lookup
+        # failed for any other reason (5xx, throttling, permission) and could
+        # therefore be neither confirmed present nor confirmed deleted.
+        self.unresolved_directory_object_references: Set[Tuple[str, str]]
+        self.errored_directory_object_references: Set[Tuple[str, str]]
+        (
+            self.unresolved_directory_object_references,
+            self.errored_directory_object_references,
+        ) = loop.run_until_complete(
+            self._resolve_directory_object_references(self.conditional_access_policies)
+        )
+
         if created_loop:
             asyncio.set_event_loop(None)
             loop.close()
@@ -791,6 +814,16 @@ class Entra(M365Service):
                             features, "seamless_sso_enabled", False
                         )
                         or False,
+                        block_soft_match_enabled=getattr(
+                            features, "block_soft_match_enabled", False
+                        )
+                        or False,
+                        block_cloud_object_takeover_through_hard_match_enabled=getattr(
+                            features,
+                            "block_cloud_object_takeover_through_hard_match_enabled",
+                            False,
+                        )
+                        or False,
                     )
                 )
         except ODataError as error:
@@ -830,6 +863,7 @@ class Entra(M365Service):
                         "userType",
                         "accountEnabled",
                         "onPremisesSyncEnabled",
+                        "employeeHireDate",
                     ],
                 )
             )
@@ -890,6 +924,7 @@ class Entra(M365Service):
                             "authentication_methods", []
                         ),
                         user_type=getattr(user, "user_type", None),
+                        employee_hire_date=getattr(user, "employee_hire_date", None),
                     )
 
                 next_link = getattr(users_response, "odata_next_link", None)
@@ -1197,6 +1232,10 @@ OAuthAppInfo
             service_principals_by_app_id = {
                 sp.app_id: sp for sp in service_principals.values() if sp.app_id
             }
+            # Remember each SP's parent application object ID so the owner
+            # lookup below can address it directly without re-walking
+            # /applications.
+            application_object_id_by_sp_id: Dict[str, str] = {}
             app_response = await self.client.applications.get()
             while app_response:
                 for app in getattr(app_response, "value", []) or []:
@@ -1207,6 +1246,10 @@ OAuthAppInfo
                     if target_sp is None:
                         continue
 
+                    app_object_id = getattr(app, "id", None)
+                    if app_object_id:
+                        application_object_id_by_sp_id[target_sp.id] = app_object_id
+
                     for cred in getattr(app, "password_credentials", []) or []:
                         target_sp.password_credentials.append(
                             PasswordCredential(
@@ -1257,6 +1300,49 @@ OAuthAppInfo
                     next_link
                 ).get()
 
+            # Resolve owners only for service principals that hold a permanent
+            # Tier 0 directory role. Owner ownership of the SP object or its
+            # parent app registration is a credential-rotation escalation path
+            # outside PIM and Conditional Access; fetching owners for every
+            # consented SP would multiply Graph traffic for no benefit.
+            for sp in service_principals.values():
+                if not sp.directory_role_template_ids:
+                    continue
+                try:
+                    sp_owners_response = (
+                        await self.client.service_principals.by_service_principal_id(
+                            sp.id
+                        ).owners.get()
+                    )
+                    sp.sp_owner_ids = [
+                        getattr(owner, "id", None)
+                        for owner in (getattr(sp_owners_response, "value", []) or [])
+                        if getattr(owner, "id", None)
+                    ]
+                except Exception as error:
+                    logger.error(
+                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+
+                app_object_id = application_object_id_by_sp_id.get(sp.id)
+                if not app_object_id:
+                    continue
+                try:
+                    app_owners_response = (
+                        await self.client.applications.by_application_id(
+                            app_object_id
+                        ).owners.get()
+                    )
+                    sp.app_owner_ids = [
+                        getattr(owner, "id", None)
+                        for owner in (getattr(app_owners_response, "value", []) or [])
+                        if getattr(owner, "id", None)
+                    ]
+                except Exception as error:
+                    logger.error(
+                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -1316,6 +1402,130 @@ OAuthAppInfo
             )
         return app_registrations
 
+    async def _resolve_directory_object_references(
+        self,
+        policies: Dict[str, "ConditionalAccessPolicy"],
+    ) -> Tuple[Set[Tuple[str, str]], Set[Tuple[str, str]]]:
+        """Resolve every user/group/role identifier referenced by CA policies.
+
+        Walks the inclusion/exclusion collections of every loaded Conditional
+        Access policy, deduplicates the resulting identifiers per type, and
+        queries Microsoft Graph for each one. Identifiers that return HTTP 404
+        are reported as deleted. Non-404 errors (5xx, throttling, permission,
+        transient network failures) are reported as unresolvable: they must not
+        be flagged as deletions, but they must also not be silently treated as
+        clean resolutions, so the downstream check surfaces them as MANUAL.
+
+        The sentinel values ``All``, ``None``, and ``GuestsOrExternalUsers``
+        are not directory identifiers and are excluded before any Graph call.
+
+        Args:
+            policies: Conditional Access policies keyed by policy ID.
+
+        Returns:
+            Tuple[Set[Tuple[str, str]], Set[Tuple[str, str]]]: A pair of
+                ``(type, identifier)`` sets. The first holds identifiers that
+                failed to resolve via Graph with HTTP 404 (deleted); the second
+                holds identifiers whose lookup failed for any other reason and
+                could be neither confirmed present nor confirmed deleted.
+        """
+        logger.info(
+            "Entra - Resolving directory-object references in Conditional "
+            "Access policies..."
+        )
+
+        ids_by_type: Dict[str, Set[str]] = {
+            "user": set(),
+            "group": set(),
+            "role": set(),
+        }
+
+        for policy in policies.values():
+            if not getattr(policy, "conditions", None):
+                continue
+            user_conditions = getattr(policy.conditions, "user_conditions", None)
+            if user_conditions is None:
+                continue
+            for ident in (user_conditions.included_users or []) + (
+                user_conditions.excluded_users or []
+            ):
+                if ident and ident not in CONDITIONAL_ACCESS_SENTINEL_IDS:
+                    ids_by_type["user"].add(ident)
+            for ident in (user_conditions.included_groups or []) + (
+                user_conditions.excluded_groups or []
+            ):
+                if ident and ident not in CONDITIONAL_ACCESS_SENTINEL_IDS:
+                    ids_by_type["group"].add(ident)
+            for ident in (user_conditions.included_roles or []) + (
+                user_conditions.excluded_roles or []
+            ):
+                if ident and ident not in CONDITIONAL_ACCESS_SENTINEL_IDS:
+                    ids_by_type["role"].add(ident)
+
+        unresolved: Set[Tuple[str, str]] = set()
+        errored: Set[Tuple[str, str]] = set()
+
+        # Resolve types in parallel; within a type, walk identifiers serially
+        # to keep concurrent Graph calls bounded and avoid throttling.
+        await gather(
+            self._resolve_identifiers_for_type(
+                "user", ids_by_type["user"], unresolved, errored
+            ),
+            self._resolve_identifiers_for_type(
+                "group", ids_by_type["group"], unresolved, errored
+            ),
+            self._resolve_identifiers_for_type(
+                "role", ids_by_type["role"], unresolved, errored
+            ),
+        )
+        return unresolved, errored
+
+    async def _resolve_identifiers_for_type(
+        self,
+        type_: str,
+        identifiers: Set[str],
+        unresolved: Set[Tuple[str, str]],
+        errored: Set[Tuple[str, str]],
+    ) -> None:
+        """Resolve a set of identifiers of a given type, mutating the result sets.
+
+        Only HTTP 404 (or ``Request_ResourceNotFound``) responses add to
+        ``unresolved``. Every other error (5xx, throttling, permission, or an
+        unexpected exception) is logged and added to ``errored`` so the check
+        can report it as unverified instead of silently treating it as clean.
+        """
+        for identifier in identifiers:
+            try:
+                if type_ == "user":
+                    await self.client.users.by_user_id(identifier).get()
+                elif type_ == "group":
+                    await self.client.groups.by_group_id(identifier).get()
+                elif type_ == "role":
+                    await self.client.role_management.directory.role_definitions.by_unified_role_definition_id(
+                        identifier
+                    ).get()
+                else:
+                    continue
+            except ODataError as error:
+                status_code = getattr(error, "response_status_code", None)
+                error_code = getattr(error.error, "code", None) if error.error else None
+                if status_code == 404 or error_code == "Request_ResourceNotFound":
+                    unresolved.add((type_, identifier))
+                else:
+                    errored.add((type_, identifier))
+                    logger.warning(
+                        f"Entra - Could not resolve {type_} '{identifier}' for "
+                        f"Conditional Access reference check: "
+                        f"{error.__class__.__name__}: {error}"
+                    )
+            except Exception as error:
+                errored.add((type_, identifier))
+                logger.warning(
+                    f"Entra - Unexpected error resolving {type_} '{identifier}' "
+                    f"for Conditional Access reference check: "
+                    f"{error.__class__.__name__}: {error}"
+                )
+
 
 class ConditionalAccessPolicyState(Enum):
     ENABLED = "enabled"
@@ -1436,7 +1646,7 @@ class PlatformConditions(BaseModel):
 
     @validator("include_platforms", "exclude_platforms", pre=True)
     @classmethod
-    def normalize_platforms(cls, values):
+    def normalize_platforms(cls, values):  # noqa: vulture
         if not values:
             return []
 
@@ -1584,6 +1794,8 @@ class DirectorySyncSettings(BaseModel):
     id: str
     password_sync_enabled: bool = False
     seamless_sso_enabled: bool = False
+    block_soft_match_enabled: bool = False
+    block_cloud_object_takeover_through_hard_match_enabled: bool = False
 
 
 class AuthenticationMethodConfiguration(BaseModel):
@@ -1674,6 +1886,7 @@ class User(BaseModel):
         user_type: The user account type as reported by Microsoft Graph
             (typically 'Member' or 'Guest'). ``None`` when Microsoft Graph does not
             return the property; checks must not assume a default in that case.
+        employee_hire_date: The user's hire date as reported by Microsoft Graph.
     """
 
     id: str
@@ -1684,6 +1897,7 @@ class User(BaseModel):
     account_enabled: bool = True
     authentication_methods: List[str] = []
     user_type: Optional[str] = None
+    employee_hire_date: Optional[datetime] = None
 
 
 class InvitationsFrom(Enum):
@@ -1832,6 +2046,12 @@ class ServicePrincipal(BaseModel):
         key_credentials: List of key credentials (certificates).
         directory_role_template_ids: List of directory role template IDs permanently
             assigned to this service principal.
+        sp_owner_ids: Principal IDs that own the service principal object.
+            Populated only for service principals that hold a permanent Tier 0
+            directory role assignment, to keep Graph traffic bounded.
+        app_owner_ids: Principal IDs that own the parent app registration.
+            Populated only for service principals that hold a permanent Tier 0
+            directory role assignment.
     """
 
     id: str
@@ -1841,6 +2061,8 @@ class ServicePrincipal(BaseModel):
     password_credentials: List[PasswordCredential] = []
     key_credentials: List[KeyCredential] = []
     directory_role_template_ids: List[str] = []
+    sp_owner_ids: List[str] = []
+    app_owner_ids: List[str] = []
 
 
 class AppRegistration(BaseModel):
diff --git a/prowler/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/__init__.py b/prowler/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/entra_service_principal_privileged_role_no_owners.metadata.json b/prowler/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/entra_service_principal_privileged_role_no_owners.metadata.json
new file mode 100644
index 0000000000..4822d8956d
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/entra_service_principal_privileged_role_no_owners.metadata.json
@@ -0,0 +1,40 @@
+{
+  "Provider": "m365",
+  "CheckID": "entra_service_principal_privileged_role_no_owners",
+  "CheckTitle": "Service principals with privileged Entra directory roles must have no owners",
+  "CheckType": [],
+  "ServiceName": "entra",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "critical",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Microsoft Entra **service principals** holding permanent **Control Plane (Tier 0)** directory roles (such as **Global Administrator** or **Privileged Role Administrator**) are evaluated for the presence of **owners** on either the service principal itself or its parent **app registration**.",
+  "Risk": "An **owner** of a service principal or its parent app registration can **rotate credentials** and sign in as the service principal, inheriting its **Tier 0** role outside **PIM** and **Conditional Access** controls. This is a documented privilege escalation path impacting **confidentiality**, **integrity**, and **availability** of the tenant's control plane.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/graph/api/serviceprincipal-list-owners?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/application-list-owners?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/rbacapplication-list-roleassignments?view=graph-rest-1.0"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com)\n2. Go to Identity > Applications > Enterprise applications > select the service principal\n3. Under Owners, remove all owners\n4. Repeat for the parent App Registration under Identity > Applications > App registrations\n5. Use PIM eligible assignments instead of permanent role assignments where possible",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Remove all owners from service principals that hold privileged Entra directory roles. Manage privileged service principals exclusively via PIM-eligible role assignments and break-glass controls. Ensure no human account can silently inherit control-plane privileges through ownership.",
+      "Url": "https://hub.prowler.com/check/entra_service_principal_privileged_role_no_owners"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "entra_service_principal_no_secrets_for_permanent_tier0_roles"
+  ],
+  "Notes": "Only service principals with permanent Tier 0 directory role assignments are evaluated. Microsoft first-party service principals and multi-tenant ISV apps consented from other publishers are excluded by the service layer."
+}
diff --git a/prowler/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/entra_service_principal_privileged_role_no_owners.py b/prowler/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/entra_service_principal_privileged_role_no_owners.py
new file mode 100644
index 0000000000..f3af26e23f
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/entra_service_principal_privileged_role_no_owners.py
@@ -0,0 +1,71 @@
+"""Check for service principals with privileged roles that have owners."""
+
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.entra.entra_client import entra_client
+
+
+class entra_service_principal_privileged_role_no_owners(Check):
+    """Service principal with a permanent Tier 0 directory role has no owners.
+
+    Owners of a service principal or its parent app registration can rotate
+    credentials and sign in as the service principal, inheriting its privileged
+    directory role outside PIM approval flows and Conditional Access policies
+    targeting user accounts.
+
+    - PASS: The service principal does not hold a permanent Tier 0 directory
+      role, or it does but has zero owners on both the service principal and
+      its parent app registration.
+    - FAIL: The service principal holds a permanent Tier 0 directory role and
+      has at least one owner on either the service principal or its parent
+      app registration.
+    """
+
+    def execute(self) -> List[CheckReportM365]:
+        """Execute the privileged service principal owner check.
+
+        Returns:
+            A list of reports, one per service principal owned by the audited
+            tenant.
+        """
+        findings = []
+        for sp in entra_client.service_principals.values():
+            report = CheckReportM365(
+                metadata=self.metadata(),
+                resource=sp,
+                resource_name=sp.name,
+                resource_id=sp.id,
+            )
+
+            if not sp.directory_role_template_ids:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Service principal '{sp.name}' has no permanent Tier 0 "
+                    f"directory role assignments."
+                )
+                findings.append(report)
+                continue
+
+            unique_owners = set(sp.sp_owner_ids) | set(sp.app_owner_ids)
+            tier0_role_count = len(sp.directory_role_template_ids)
+
+            if unique_owners:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Service principal '{sp.name}' holds {tier0_role_count} "
+                    f"permanent Tier 0 directory role(s) and has "
+                    f"{len(unique_owners)} owner(s) "
+                    f"({len(sp.sp_owner_ids)} on the service principal, "
+                    f"{len(sp.app_owner_ids)} on the parent app registration)."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Service principal '{sp.name}' holds {tier0_role_count} "
+                    f"permanent Tier 0 directory role(s) and has no owners on "
+                    f"either the service principal or its parent app registration."
+                )
+
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/m365/services/entra/entra_users_mfa_capable/entra_users_mfa_capable.py b/prowler/providers/m365/services/entra/entra_users_mfa_capable/entra_users_mfa_capable.py
index 9485676d30..d3e75cef7f 100644
--- a/prowler/providers/m365/services/entra/entra_users_mfa_capable/entra_users_mfa_capable.py
+++ b/prowler/providers/m365/services/entra/entra_users_mfa_capable/entra_users_mfa_capable.py
@@ -1,3 +1,4 @@
+from datetime import datetime, timezone
 from typing import List
 
 from prowler.lib.check.models import Check, CheckReportM365
@@ -12,7 +13,8 @@ class entra_users_mfa_capable(Check):
     Microsoft 365 Foundations Benchmark recommendation 5.2.3.4
     ("Ensure all member users are 'MFA capable'").
 
-    Guest users and disabled accounts are excluded from the evaluation.
+    Guest users, disabled accounts, and future hires are excluded from the
+    evaluation.
 
     - PASS: The member user is MFA capable.
     - FAIL: The member user is not MFA capable, or MFA capability cannot be
@@ -38,6 +40,15 @@ class entra_users_mfa_capable(Check):
         for user in entra_client.users.values():
             if user.user_type == "Guest" or not user.account_enabled:
                 continue
+            if user.employee_hire_date:
+                employee_hire_date = user.employee_hire_date
+                if (
+                    employee_hire_date.tzinfo is None
+                    or employee_hire_date.utcoffset() is None
+                ):
+                    employee_hire_date = employee_hire_date.replace(tzinfo=timezone.utc)
+                if employee_hire_date > datetime.now(timezone.utc):
+                    continue
 
             report = CheckReportM365(
                 metadata=self.metadata(),
diff --git a/prowler/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/__init__.py b/prowler/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/exchange_mailbox_primary_smtp_uses_custom_domain.metadata.json b/prowler/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/exchange_mailbox_primary_smtp_uses_custom_domain.metadata.json
new file mode 100644
index 0000000000..66ce055152
--- /dev/null
+++ b/prowler/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/exchange_mailbox_primary_smtp_uses_custom_domain.metadata.json
@@ -0,0 +1,39 @@
+{
+  "Provider": "m365",
+  "CheckID": "exchange_mailbox_primary_smtp_uses_custom_domain",
+  "CheckTitle": "Mailbox primary SMTP address must use a custom domain",
+  "CheckType": [],
+  "ServiceName": "exchange",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "collaboration",
+  "Description": "**Exchange Online mailboxes** should use a custom domain as their primary SMTP address, not the default **\\*.onmicrosoft.com** routing domain assigned by Microsoft on tenant creation. This check verifies that the **PrimarySmtpAddress** of every user-facing mailbox does not end with `.onmicrosoft.com`.",
+  "Risk": "Mailboxes still using **.onmicrosoft.com** as their primary SMTP address leak the internal **tenant identifier** in every From: header, helping attackers fingerprint the tenant for spear-phishing. They also bypass **DMARC/DKIM** hardening that organisations deploy on their custom domains and are frequently treated as low-trust by recipient anti-phishing engines.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-domain",
+    "https://learn.microsoft.com/en-us/microsoft-365/admin/setup/domains-faq",
+    "https://learn.microsoft.com/en-us/powershell/module/exchange/get-mailbox",
+    "https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/manage-user-mailboxes"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "Get-Mailbox -ResultSize Unlimited | Where-Object { $_.PrimarySmtpAddress -like '*.onmicrosoft.com' } | ForEach-Object { Set-Mailbox -Identity $_.Identity -PrimarySmtpAddress '<user>@<customdomain.com>' }",
+      "NativeIaC": "",
+      "Other": "1. Navigate to the Microsoft 365 admin center (https://admin.microsoft.com/)\n2. Go to Users > Active users and select the affected user\n3. Under the Aliases section, add the custom domain email address\n4. Set the custom domain address as the primary SMTP address\n5. Save changes and repeat for all affected mailboxes",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Update the primary SMTP address of all affected mailboxes to use a custom domain. Ensure your custom domain is verified in the Microsoft 365 admin center before making this change.",
+      "Url": "https://hub.prowler.com/check/exchange_mailbox_primary_smtp_uses_custom_domain"
+    }
+  },
+  "Categories": [
+    "email-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/exchange_mailbox_primary_smtp_uses_custom_domain.py b/prowler/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/exchange_mailbox_primary_smtp_uses_custom_domain.py
new file mode 100644
index 0000000000..d34d091145
--- /dev/null
+++ b/prowler/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/exchange_mailbox_primary_smtp_uses_custom_domain.py
@@ -0,0 +1,79 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.exchange.exchange_client import exchange_client
+
+
+class exchange_mailbox_primary_smtp_uses_custom_domain(Check):
+    """
+    Verify that every Exchange Online mailbox uses a custom domain as its
+    primary SMTP address, not the default .onmicrosoft.com routing domain.
+
+    The .onmicrosoft.com domain is assigned by Microsoft on tenant creation
+    and is not intended for ongoing mail. Mailboxes still using it leak the
+    internal tenant identifier in every From: header (aiding spear-phishing),
+    bypass DMARC/DKIM hardening on custom domains and are often treated as
+    low-trust by recipient anti-phishing engines.
+
+    - PASS: Primary SMTP address does not use the .onmicrosoft.com domain.
+    - FAIL: Primary SMTP address uses the .onmicrosoft.com domain.
+    - MANUAL: Exchange Online PowerShell unavailable; check cannot run.
+    """
+
+    def execute(self) -> List[CheckReportM365]:
+        """
+        Execute the check against all recipient-facing Exchange Online mailboxes.
+
+        Returns:
+            List[CheckReportM365]: A report for each mailbox with its SMTP
+                domain status, or a single MANUAL report if PowerShell was
+                unavailable.
+        """
+        findings = []
+
+        # mailboxes is None when Exchange Online PowerShell could not be
+        # reached or the cmdlet raised. An empty list means PowerShell ran
+        # but the tenant has no recipient-facing mailboxes (no findings).
+        if exchange_client.mailboxes is None:
+            report = CheckReportM365(
+                metadata=self.metadata(),
+                resource={},
+                resource_name="Exchange Online Mailboxes",
+                resource_id="exchange_mailboxes",
+            )
+            report.status = "MANUAL"
+            report.status_extended = (
+                "Exchange Online PowerShell is unavailable. "
+                "Enable EXO PowerShell access to run this check."
+            )
+            findings.append(report)
+            return findings
+
+        for mailbox in exchange_client.mailboxes:
+            report = CheckReportM365(
+                metadata=self.metadata(),
+                resource=mailbox,
+                resource_name=mailbox.name or mailbox.identity,
+                resource_id=mailbox.identity,
+            )
+
+            if mailbox.primary_smtp_address.endswith(".onmicrosoft.com"):
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Mailbox {mailbox.identity} "
+                    f"({mailbox.recipient_type_details}) has primary SMTP "
+                    f"address {mailbox.primary_smtp_address} using the "
+                    f".onmicrosoft.com domain instead of a custom domain."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Mailbox {mailbox.identity} "
+                    f"({mailbox.recipient_type_details}) has primary SMTP "
+                    f"address {mailbox.primary_smtp_address} using a "
+                    f"custom domain."
+                )
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/m365/services/exchange/exchange_service.py b/prowler/providers/m365/services/exchange/exchange_service.py
index 9b3ee47da9..3ce6528aa9 100644
--- a/prowler/providers/m365/services/exchange/exchange_service.py
+++ b/prowler/providers/m365/services/exchange/exchange_service.py
@@ -8,6 +8,15 @@ from prowler.lib.logger import logger
 from prowler.providers.m365.lib.service.service import M365Service
 from prowler.providers.m365.m365_provider import M365Provider
 
+SYSTEM_MAILBOX_TYPES = {
+    "DiscoveryMailbox",
+    "ArbitrationMailbox",
+    "AuditLogMailbox",
+    "MonitoringMailbox",
+    "AuxAuditLogMailbox",
+    "SystemMailbox",
+}
+
 
 class Exchange(M365Service):
     """
@@ -34,6 +43,7 @@ class Exchange(M365Service):
         self.role_assignment_policies = []
         self.mailbox_audit_properties = []
         self.shared_mailboxes = []
+        self.mailboxes = None
 
         if self.powershell:
             if self.powershell.connect_exchange_online():
@@ -46,6 +56,7 @@ class Exchange(M365Service):
                 self.role_assignment_policies = self._get_role_assignment_policies()
                 self.mailbox_audit_properties = self._get_mailbox_audit_properties()
                 self.shared_mailboxes = self._get_shared_mailboxes()
+                self.mailboxes = self._get_mailboxes()
             self.powershell.close()
 
         # Fetch license count via Graph API
@@ -355,6 +366,50 @@ class Exchange(M365Service):
             )
         return shared_mailboxes
 
+    def _get_mailboxes(self) -> Optional[list["Mailbox"]]:
+        """
+        Get all recipient-facing mailboxes from Exchange Online.
+
+        Retrieves mailboxes of types UserMailbox, SharedMailbox, RoomMailbox
+        and EquipmentMailbox. System-managed mailbox types are excluded as
+        they are controlled by Microsoft and are not subject to domain policy.
+
+        Returns:
+            list[Mailbox]: List of mailboxes with their primary SMTP address
+                and recipient type details. Returns ``None`` when the
+                underlying PowerShell cmdlet raises, so callers can
+                distinguish "PowerShell unavailable" from "empty tenant".
+        """
+        logger.info("Microsoft365 - Getting mailboxes...")
+        mailboxes = []
+        try:
+            mailboxes_data = self.powershell.get_mailboxes()
+            if not mailboxes_data:
+                return mailboxes
+            # PowerShell can return a single dict instead of a list when only
+            # one result is returned; normalize to a list for uniform handling.
+            if isinstance(mailboxes_data, dict):
+                mailboxes_data = [mailboxes_data]
+            for mailbox in mailboxes_data:
+                if mailbox:
+                    recipient_type = mailbox.get("RecipientTypeDetails", "")
+                    if recipient_type in SYSTEM_MAILBOX_TYPES:
+                        continue
+                    mailboxes.append(
+                        Mailbox(
+                            identity=mailbox.get("Identity", ""),
+                            name=mailbox.get("DisplayName", ""),
+                            primary_smtp_address=mailbox.get("PrimarySmtpAddress", ""),
+                            recipient_type_details=recipient_type,
+                        )
+                    )
+            return mailboxes
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return None
+
 
 class Organization(BaseModel):
     """
@@ -497,3 +552,22 @@ class SharedMailbox(BaseModel):
     user_principal_name: str
     external_directory_object_id: str
     identity: str
+
+
+class Mailbox(BaseModel):
+    """
+    Model for an Exchange Online recipient-facing mailbox.
+
+    Attributes:
+        identity: The unique identity of the mailbox in Exchange.
+        name: Display name of the mailbox.
+        primary_smtp_address: The primary SMTP address used for outbound mail
+            and the From: header. This is the address the check evaluates.
+        recipient_type_details: The mailbox type (e.g., UserMailbox,
+            SharedMailbox, RoomMailbox, EquipmentMailbox).
+    """
+
+    identity: str
+    name: str
+    primary_smtp_address: str
+    recipient_type_details: str
diff --git a/prowler/providers/okta/lib/arguments/arguments.py b/prowler/providers/okta/lib/arguments/arguments.py
index 287f786b0f..4ed5cfa187 100644
--- a/prowler/providers/okta/lib/arguments/arguments.py
+++ b/prowler/providers/okta/lib/arguments/arguments.py
@@ -35,7 +35,8 @@ def init_parser(self):
         nargs="+",
         help=(
             "OAuth scopes to request, space-separated "
-            "(e.g. okta.policies.read okta.brands.read okta.apps.read). "
+            "(e.g. okta.policies.read okta.brands.read okta.apps.read "
+            "okta.logStreams.read okta.idps.read). "
             "Defaults to the read scopes required by the bundled checks."
         ),
         default=None,
diff --git a/prowler/providers/okta/lib/service/pagination.py b/prowler/providers/okta/lib/service/pagination.py
new file mode 100644
index 0000000000..a30bbf9477
--- /dev/null
+++ b/prowler/providers/okta/lib/service/pagination.py
@@ -0,0 +1,69 @@
+"""Shared pagination helpers for Okta SDK list calls.
+
+The Okta SDK exposes paginated list endpoints (`list_applications`,
+`list_policies`, `list_log_streams`, `list_identity_providers`, …) that
+return a tuple `(items, response, error)`. The next page is signalled
+through an RFC 5988 `Link: <…>; rel="next"` header carrying an opaque
+`after` cursor.
+
+These helpers are used by every Okta service that needs to drain a
+paginated endpoint. They live here so we don't keep copy-pasting them
+into each service module.
+"""
+
+from typing import Optional
+from urllib.parse import parse_qs, urlparse
+
+
+def next_after_cursor(resp) -> Optional[str]:
+    """Extract the `after` cursor from a `Link: ...; rel="next"` header.
+
+    Returns None when there is no next page. Header format follows RFC
+    5988 and Okta's pagination guide.
+    """
+    if resp is None:
+        return None
+    headers = getattr(resp, "headers", None) or {}
+    link = headers.get("link") or headers.get("Link") or ""
+    if not link:
+        return None
+    for part in link.split(","):
+        if 'rel="next"' not in part:
+            continue
+        url_segment = part.split(";", 1)[0].strip().lstrip("<").rstrip(">")
+        cursor = parse_qs(urlparse(url_segment).query).get("after", [None])[0]
+        if cursor:
+            return cursor
+    return None
+
+
+async def paginate(fetch):
+    """Drain all pages of an SDK list call.
+
+    `fetch` is a callable that accepts the `after` cursor (or None for
+    the first page) and returns the SDK's standard `(items, resp, err)`
+    tuple — or the 2-tuple early-error shape `(items, err)`. Follows the
+    `Link: rel="next"` header until exhausted. The returned tuple is
+    `(all_items, error)` — error is non-None only when a page fails
+    to fetch.
+    """
+    all_items = []
+    result = await fetch(None)
+    err = result[-1]
+    if err is not None:
+        return [], err
+    items = result[0]
+    resp = result[1] if len(result) >= 3 else None
+    all_items.extend(items or [])
+    while True:
+        cursor = next_after_cursor(resp)
+        if not cursor:
+            break
+        result = await fetch(cursor)
+        err = result[-1]
+        if err is not None:
+            return all_items, err
+        items = result[0]
+        resp = result[1] if len(result) >= 3 else None
+        all_items.extend(items or [])
+    return all_items, None
diff --git a/prowler/providers/okta/lib/service/raw_fetch.py b/prowler/providers/okta/lib/service/raw_fetch.py
new file mode 100644
index 0000000000..42e8eede11
--- /dev/null
+++ b/prowler/providers/okta/lib/service/raw_fetch.py
@@ -0,0 +1,141 @@
+"""Raw-JSON HTTP fetch via the Okta SDK's request executor.
+
+Some Okta Management API endpoints are not yet exposed as typed methods
+on the SDK client (e.g. `/api/v1/automations`), or the typed path's
+pydantic deserialization rejects values the API actually returns (e.g.
+the `KnowledgeConstraint.types` lowercase issue we hit on
+`list_policy_rules`). In both cases we go around the typed layer:
+construct the request via `client._request_executor.create_request`,
+execute without a response type, and parse the body ourselves.
+
+`get_json` returns the parsed JSON payload (typically a list or dict)
+or raises with a descriptive log line on any of the failure modes —
+request build, transport, decode, parse. `get_json_paginated` drains
+list endpoints by following the `Link: rel="next"` cursor — without it,
+the raw fallback would silently truncate at the per-request `limit`.
+Callers are expected to project the JSON onto their own pydantic snapshot.
+"""
+
+import json
+from typing import Any, Optional
+from urllib.parse import parse_qsl, urlencode, urlparse, urlunparse
+
+from prowler.lib.logger import logger
+from prowler.providers.okta.lib.service.pagination import next_after_cursor
+
+
+async def get_json(
+    client,
+    path: str,
+    *,
+    accept: str = "application/json",
+    context: Optional[str] = None,
+) -> Optional[Any]:
+    """GET `path` via the SDK's request executor and return parsed JSON.
+
+    Returns the decoded JSON payload on success, or None when the
+    request, transport, or decode steps fail. Each failure path emits a
+    `logger.error` line tagged with `context` so the caller can grep
+    for it.
+    """
+    label = context or path
+    request, error = await client._request_executor.create_request(
+        method="GET",
+        url=path,
+        body=None,
+        headers={"Accept": accept},
+    )
+    if error is not None:
+        logger.error(f"Raw fetch (create_request) failed for {label}: {error}")
+        return None
+
+    _response, response_body, error = await client._request_executor.execute(request)
+    if error is not None:
+        logger.error(f"Raw fetch (execute) failed for {label}: {error}")
+        return None
+
+    if isinstance(response_body, (bytes, bytearray)):
+        try:
+            response_body = response_body.decode("utf-8")
+        except UnicodeDecodeError as decode_err:
+            logger.error(f"Could not decode response for {label}: {decode_err}")
+            return None
+    try:
+        return json.loads(response_body) if response_body else None
+    except json.JSONDecodeError as decode_err:
+        logger.error(f"Could not parse JSON for {label}: {decode_err}")
+        return None
+
+
+async def get_json_paginated(
+    client,
+    path: str,
+    *,
+    page_size: int = 200,
+    accept: str = "application/json",
+    context: Optional[str] = None,
+) -> Optional[list]:
+    """Drain all pages of a raw-JSON list endpoint.
+
+    Mirrors the typed `pagination.paginate` shape but operates on the
+    SDK's request executor directly. Follows the `Link: rel="next"`
+    header until exhausted, accumulating items across pages. Returns
+    the concatenated list, or None if any page fails to fetch or the
+    response is not a JSON array.
+
+    `page_size` is appended as `limit=N` to the first request; subsequent
+    requests use the URL Okta returns via the cursor.
+    """
+    label = context or path
+    all_items: list = []
+    current_path = _set_query(path, {"limit": str(page_size)})
+    while True:
+        request, error = await client._request_executor.create_request(
+            method="GET",
+            url=current_path,
+            body=None,
+            headers={"Accept": accept},
+        )
+        if error is not None:
+            logger.error(f"Raw fetch (create_request) failed for {label}: {error}")
+            return None
+
+        response, response_body, error = await client._request_executor.execute(request)
+        if error is not None:
+            logger.error(f"Raw fetch (execute) failed for {label}: {error}")
+            return None
+
+        if isinstance(response_body, (bytes, bytearray)):
+            try:
+                response_body = response_body.decode("utf-8")
+            except UnicodeDecodeError as decode_err:
+                logger.error(f"Could not decode response for {label}: {decode_err}")
+                return None
+        if not response_body:
+            break
+        try:
+            page = json.loads(response_body)
+        except json.JSONDecodeError as decode_err:
+            logger.error(f"Could not parse JSON for {label}: {decode_err}")
+            return None
+        if not isinstance(page, list):
+            logger.error(
+                f"Unexpected raw payload shape for {label}: "
+                f"{type(page).__name__}; expected list"
+            )
+            return None
+        all_items.extend(page)
+
+        cursor = next_after_cursor(response)
+        if not cursor:
+            break
+        current_path = _set_query(path, {"limit": str(page_size), "after": cursor})
+    return all_items
+
+
+def _set_query(path: str, params: dict) -> str:
+    """Return `path` with the given query params merged in (overriding existing)."""
+    parsed = urlparse(path)
+    qs = dict(parse_qsl(parsed.query))
+    qs.update({k: v for k, v in params.items() if v is not None})
+    return urlunparse(parsed._replace(query=urlencode(qs)))
diff --git a/prowler/providers/okta/okta_provider.py b/prowler/providers/okta/okta_provider.py
index 0a7b0b8e9d..8859507ec7 100644
--- a/prowler/providers/okta/okta_provider.py
+++ b/prowler/providers/okta/okta_provider.py
@@ -32,7 +32,18 @@ from prowler.providers.okta.exceptions.exceptions import (
 from prowler.providers.okta.lib.mutelist.mutelist import OktaMutelist
 from prowler.providers.okta.models import OktaIdentityInfo, OktaSession
 
-DEFAULT_SCOPES = ["okta.policies.read", "okta.brands.read", "okta.apps.read"]
+DEFAULT_SCOPES = [
+    "okta.policies.read",
+    "okta.brands.read",
+    "okta.apps.read",
+    "okta.authenticators.read",
+    "okta.networkZones.read",
+    "okta.apiTokens.read",
+    "okta.roles.read",
+    "okta.groups.read",
+    "okta.logStreams.read",
+    "okta.idps.read",
+]
 # Accept only Okta-managed domains. Custom (vanity) domains are rejected on
 # purpose — they're a recurring source of typos and silent misconfig and
 # Prowler's audience overwhelmingly uses Okta-managed hosts. The TLDs below
diff --git a/prowler/providers/okta/services/apitoken/__init__.py b/prowler/providers/okta/services/apitoken/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/apitoken/api_token_client.py b/prowler/providers/okta/services/apitoken/api_token_client.py
new file mode 100644
index 0000000000..fbe10d7c7f
--- /dev/null
+++ b/prowler/providers/okta/services/apitoken/api_token_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.okta.services.apitoken.api_token_service import ApiToken
+
+api_token_client = ApiToken(Provider.get_global_provider())
diff --git a/prowler/providers/okta/services/apitoken/api_token_service.py b/prowler/providers/okta/services/apitoken/api_token_service.py
new file mode 100644
index 0000000000..5fafd71c35
--- /dev/null
+++ b/prowler/providers/okta/services/apitoken/api_token_service.py
@@ -0,0 +1,327 @@
+from typing import Optional
+
+from pydantic import BaseModel, Field, ValidationError
+
+from prowler.lib.logger import logger
+from prowler.providers.okta.lib.service.pagination import paginate as _paginate_shared
+from prowler.providers.okta.lib.service.raw_fetch import (
+    get_json_paginated as _raw_get_json_paginated,
+)
+from prowler.providers.okta.lib.service.service import OktaService
+
+REQUIRED_SCOPES: dict[str, str] = {
+    "api_tokens": "okta.apiTokens.read",
+    "network_zones": "okta.networkZones.read",
+    "user_roles": "okta.roles.read",
+    # Needed to resolve admin roles inherited via group membership.
+    # `/api/v1/users/{id}/roles` returns only direct role assignments;
+    # group-inherited Super Admin is invisible without `okta.groups.read`
+    # to enumerate the user's groups.
+    "user_groups": "okta.groups.read",
+}
+
+
+def _value(value) -> str:
+    """Return plain string values from Okta SDK enums and raw strings."""
+    if value is None:
+        return ""
+    enum_value = getattr(value, "value", None)
+    if enum_value is not None:
+        return str(enum_value)
+    return str(value)
+
+
+def _role_to_string(role) -> str:
+    """Pick the most specific role identifier from an SDK Role object.
+
+    `list_assigned_roles_for_user` and `list_group_assigned_roles` return
+    `ListGroupAssignedRoles200ResponseInner` — a oneOf wrapper that holds
+    the real `StandardRole`/`CustomRole` on `.actual_instance`. Reading
+    `.type`/`.label` from the wrapper returns None and the role silently
+    disappears, so unwrap first.
+    """
+    inner = getattr(role, "actual_instance", None) or role
+    return _value(getattr(inner, "type", None)) or _value(getattr(inner, "label", None))
+
+
+def _raw_value(item, key: str) -> str:
+    """Return a string value from an SDK model or raw dictionary."""
+    if isinstance(item, dict):
+        return _value(item.get(key))
+    return _value(getattr(item, key, None))
+
+
+class ApiToken(OktaService):
+    """Fetches Okta API token metadata, token owners' roles, and zones."""
+
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        granted = set(getattr(provider.identity, "granted_scopes", None) or [])
+        self.missing_scope: dict[str, Optional[str]] = {
+            resource: (scope if granted and scope not in granted else None)
+            for resource, scope in REQUIRED_SCOPES.items()
+        }
+        # Per-resource caches keyed on the Okta resource id. API tokens
+        # commonly share owners (e.g. a service user holding multiple
+        # tokens) and admin groups frequently overlap across users, so we
+        # memoize the resolutions within a single service instance.
+        self._user_roles_cache: dict[str, list[str]] = {}
+        self._group_roles_cache: dict[str, list[str]] = {}
+        self.known_network_zone_ids: set[str] = (
+            set()
+            if self.missing_scope["api_tokens"] or self.missing_scope["network_zones"]
+            else self._list_known_network_zone_ids()
+        )
+        self.api_tokens: dict[str, OktaApiToken] = (
+            {} if self.missing_scope["api_tokens"] else self._list_api_tokens()
+        )
+
+    def _list_api_tokens(self) -> dict[str, "OktaApiToken"]:
+        """List active API token metadata and owner roles."""
+        logger.info("ApiToken - Listing Okta API tokens...")
+        try:
+            return self._run(self._fetch_api_tokens())
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return {}
+
+    async def _fetch_api_tokens(self) -> dict[str, "OktaApiToken"]:
+        # `list_api_tokens` is non-paginated in the SDK (no `after`
+        # parameter); we inline the tuple unwrap rather than going
+        # through `paginate`. Same pattern application_service uses for
+        # `get_first_party_app_settings`.
+        result: dict[str, OktaApiToken] = {}
+        sdk_result = await self.client.list_api_tokens()
+        err = sdk_result[-1]
+        if err is not None:
+            logger.error(f"Error listing API tokens: {err}")
+            return result
+        items = sdk_result[0] or []
+
+        for token in items:
+            token_id = _value(getattr(token, "id", None))
+            user_id = _value(getattr(token, "user_id", None))
+            roles = (
+                await self._fetch_effective_user_role_types(user_id) if user_id else []
+            )
+            network = getattr(token, "network", None)
+            token_obj = OktaApiToken(
+                id=token_id,
+                name=_value(getattr(token, "name", None)) or token_id,
+                client_name=_value(getattr(token, "client_name", None)),
+                user_id=user_id,
+                network_connection=_value(getattr(network, "connection", None)),
+                network_includes=list(getattr(network, "include", None) or []),
+                network_excludes=list(getattr(network, "exclude", None) or []),
+                owner_roles=roles,
+            )
+            result[token_obj.id] = token_obj
+        return result
+
+    async def _fetch_effective_user_role_types(self, user_id: str) -> list[str]:
+        """Return direct + group-inherited admin role types for `user_id`.
+
+        Okta's `/api/v1/users/{userId}/roles` (the SDK's
+        `list_assigned_roles_for_user`) only returns roles assigned
+        *directly* to the user. Roles inherited via group membership are
+        invisible to that endpoint — but they are how Okta normally
+        grants Super Admin (e.g. the org creator joins the default
+        "Okta Super Admins" group). Without resolving group-inherited
+        roles, the Super Admin check would falsely PASS for any token
+        whose owner gets admin via a group.
+
+        Results are memoized per `user_id` so multiple tokens with the
+        same owner cost a single resolution.
+        """
+        if user_id in self._user_roles_cache:
+            return self._user_roles_cache[user_id]
+        direct = await self._fetch_direct_user_role_types(user_id)
+        inherited = await self._fetch_group_inherited_role_types(user_id)
+        # Dedupe while preserving first-seen order (direct first, then
+        # inherited) so the status_extended reads from most-specific.
+        seen: set[str] = set()
+        combined: list[str] = []
+        for role in (*direct, *inherited):
+            if role and role not in seen:
+                combined.append(role)
+                seen.add(role)
+        self._user_roles_cache[user_id] = combined
+        return combined
+
+    async def _fetch_direct_user_role_types(self, user_id: str) -> list[str]:
+        """Return roles assigned directly to the user (no group inheritance)."""
+        if self.missing_scope["user_roles"]:
+            return []
+        # `list_assigned_roles_for_user` is non-paginated in the SDK
+        # (no `after` parameter); inline the tuple unwrap.
+        sdk_result = await self.client.list_assigned_roles_for_user(user_id)
+        err = sdk_result[-1]
+        if err is not None:
+            logger.error(f"Error listing roles for token owner {user_id}: {err}")
+            return []
+        items = sdk_result[0] or []
+        roles = [_role_to_string(role) for role in items if _role_to_string(role)]
+        if roles or not items:
+            return roles
+
+        # Belt-and-suspenders: when the SDK's typed parse returns items
+        # but every projection ends up empty (a discriminator surface we
+        # don't yet handle, a future schema change, …), fall back to the
+        # raw JSON. The `_role_to_string` unwrap above already covers the
+        # known `ListGroupAssignedRoles200ResponseInner` oneOf wrapper
+        # bug — this fallback exists for whatever the next SDK quirk is.
+        return await self._fetch_user_role_types_raw(user_id)
+
+    async def _fetch_user_role_types_raw(self, user_id: str) -> list[str]:
+        """Return user role types from the raw response when typed models are empty.
+
+        Uses the shared `get_json_paginated` helper so any `Link: next`
+        header the API returns is followed (role lists are typically
+        small, but the SDK doesn't paginate this endpoint at all so the
+        only correct way to drain it lives here).
+        """
+        raw_items = await _raw_get_json_paginated(
+            self.client,
+            f"/api/v1/users/{user_id}/roles",
+            context=f"user roles for {user_id}",
+        )
+        if raw_items is None:
+            return []
+        roles = [
+            _value(role.get("type")) or _value(role.get("label"))
+            for role in raw_items
+            if isinstance(role, dict)
+        ]
+        return [role for role in roles if role]
+
+    async def _fetch_group_inherited_role_types(self, user_id: str) -> list[str]:
+        """Return roles inherited via the user's group memberships.
+
+        Each group's role list is itself memoized — admin groups are
+        commonly shared across many users.
+        """
+        if self.missing_scope["user_roles"] or self.missing_scope["user_groups"]:
+            return []
+        # Defensive try/except: tenants we've seen in the wild return 403
+        # on `/api/v1/users/{id}/groups` even when `okta.groups.read` is
+        # granted (admin-role on the service app gates the response
+        # separately). Treat any failure as "no inherited roles" so the
+        # caller still surfaces direct roles cleanly.
+        try:
+            sdk_result = await self.client.list_user_groups(user_id)
+        except Exception as error:
+            logger.error(
+                f"Error listing groups for token owner {user_id}: "
+                f"{error.__class__.__name__}: {error}"
+            )
+            return []
+        err = sdk_result[-1]
+        if err is not None:
+            logger.error(f"Error listing groups for token owner {user_id}: {err}")
+            return []
+        groups = sdk_result[0] or []
+        roles: list[str] = []
+        for group in groups:
+            group_id = _value(getattr(group, "id", None))
+            if not group_id:
+                continue
+            if group_id in self._group_roles_cache:
+                roles.extend(self._group_roles_cache[group_id])
+                continue
+            # Per-group try/except: one group's parse or auth failure
+            # must not erase admin-role coverage for other groups.
+            try:
+                group_roles = await self._fetch_group_role_types(group_id)
+            except Exception as error:
+                logger.error(
+                    f"Error listing roles for group {group_id} "
+                    f"(owner={user_id}): {error.__class__.__name__}: {error}"
+                )
+                group_roles = []
+            self._group_roles_cache[group_id] = group_roles
+            roles.extend(group_roles)
+        return roles
+
+    async def _fetch_group_role_types(self, group_id: str) -> list[str]:
+        """Return role types assigned to `group_id`."""
+        sdk_result = await self.client.list_group_assigned_roles(group_id)
+        err = sdk_result[-1]
+        if err is not None:
+            logger.error(f"Error listing roles for group {group_id}: {err}")
+            return []
+        items = sdk_result[0] or []
+        return [_role_to_string(role) for role in items if _role_to_string(role)]
+
+    def _list_known_network_zone_ids(self) -> set[str]:
+        """List known Network Zone ids and names for token condition validation."""
+        logger.info("ApiToken - Listing Network Zones for token restrictions...")
+        try:
+            return self._run(self._fetch_known_network_zone_ids())
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return set()
+
+    async def _fetch_known_network_zone_ids(self) -> set[str]:
+        identifiers: set[str] = set()
+        items, err = await self._fetch_all_network_zones()
+        if err is not None:
+            logger.error(f"Error listing Network Zones for API token checks: {err}")
+            return identifiers
+        for zone in items:
+            zone_id = _raw_value(zone, "id")
+            zone_name = _raw_value(zone, "name")
+            if zone_id:
+                identifiers.add(zone_id)
+            if zone_name:
+                identifiers.add(zone_name)
+        return identifiers
+
+    async def _fetch_all_network_zones(self) -> tuple[list, object]:
+        """Drain all Network Zone pages for API token reference validation.
+
+        Catches the upstream Okta SDK ↔ Management API schema drift on
+        Enhanced Dynamic Zones (object-shaped pydantic model where the
+        API returns a JSON array) the same way `network_zone_service`
+        does. `(ValueError, ValidationError)` covers both discriminator
+        misses and model mismatches — matching the `user_service`
+        precedent.
+        """
+        try:
+            return await _paginate_shared(
+                lambda after: self.client.list_network_zones(after=after, limit=200)
+            )
+        except (ValueError, ValidationError) as ex:
+            logger.warning(
+                f"Okta SDK raised {type(ex).__name__} parsing Network Zones "
+                "for API token validation — falling back to raw-JSON parse."
+            )
+            return await self._fetch_all_network_zones_raw()
+
+    async def _fetch_all_network_zones_raw(self) -> tuple[list, object]:
+        """Drain Network Zone pages via the shared raw-JSON helper."""
+        items = await _raw_get_json_paginated(
+            self.client,
+            "/api/v1/zones",
+            page_size=200,
+            context="Network Zones for API token validation",
+        )
+        if items is None:
+            return [], Exception("raw Network Zones fetch failed; see logs")
+        return items, None
+
+
+class OktaApiToken(BaseModel):
+    """Normalized Okta API token metadata used by checks."""
+
+    id: str
+    name: str
+    client_name: str = ""
+    user_id: str = ""
+    network_connection: str = ""
+    network_includes: list[str] = Field(default_factory=list)
+    network_excludes: list[str] = Field(default_factory=list)
+    owner_roles: list[str] = Field(default_factory=list)
diff --git a/prowler/providers/okta/services/apitoken/apitoken_not_super_admin/__init__.py b/prowler/providers/okta/services/apitoken/apitoken_not_super_admin/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/apitoken/apitoken_not_super_admin/apitoken_not_super_admin.metadata.json b/prowler/providers/okta/services/apitoken/apitoken_not_super_admin/apitoken_not_super_admin.metadata.json
new file mode 100644
index 0000000000..d15c5b4680
--- /dev/null
+++ b/prowler/providers/okta/services/apitoken/apitoken_not_super_admin/apitoken_not_super_admin.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "apitoken_not_super_admin",
+  "CheckTitle": "Okta API tokens are not owned by Super Admin users",
+  "CheckType": [],
+  "ServiceName": "apitoken",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "**Okta API token ownership** should avoid Super Admin users because API tokens inherit the admin permissions of the user that created them.",
+  "Risk": "**Super Admin-owned API tokens** become high-impact secrets: if one is exposed, an attacker can perform broad organization administration with the token owner privileges.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/guides/roles",
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/apitoken"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "Create a dedicated service account, assign only required admin roles, rotate the API token, and revoke Super Admin-owned tokens.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "**Use dedicated Okta service accounts** for API tokens and assign only the least-privilege admin roles required; rotate and revoke tokens created by Super Admin users.",
+      "Url": "https://hub.prowler.com/check/apitoken_not_super_admin"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/okta/services/apitoken/apitoken_not_super_admin/apitoken_not_super_admin.py b/prowler/providers/okta/services/apitoken/apitoken_not_super_admin/apitoken_not_super_admin.py
new file mode 100644
index 0000000000..0971af4aab
--- /dev/null
+++ b/prowler/providers/okta/services/apitoken/apitoken_not_super_admin/apitoken_not_super_admin.py
@@ -0,0 +1,70 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.apitoken.api_token_client import api_token_client
+from prowler.providers.okta.services.apitoken.lib.api_token_helpers import (
+    missing_api_token_scope_finding,
+    missing_user_roles_scope_for_token_finding,
+    owner_has_super_admin,
+)
+
+
+class apitoken_not_super_admin(Check):
+    """Ensure Okta API tokens are not owned by Super Admin users."""
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate every active API token owner's assigned admin roles."""
+        org_domain = api_token_client.provider.identity.org_domain
+        missing_api_token_scope = api_token_client.missing_scope.get("api_tokens")
+        if missing_api_token_scope:
+            return [
+                missing_api_token_scope_finding(
+                    self.metadata(),
+                    org_domain,
+                    missing_api_token_scope,
+                    additional_required=["okta.roles.read", "okta.groups.read"],
+                )
+            ]
+
+        missing_user_roles_scope = api_token_client.missing_scope.get("user_roles")
+        # `okta.groups.read` is needed to resolve admin roles inherited via
+        # group membership. Without it we fall back to direct-only role
+        # assignments, which Okta returns for `/api/v1/users/{id}/roles` —
+        # commonly empty for trial accounts where Super Admin is granted
+        # through the default admin group. The finding stays evaluable but
+        # is flagged as best-effort so operators know to grant the scope.
+        missing_user_groups_scope = api_token_client.missing_scope.get("user_groups")
+        findings: list[CheckReportOkta] = []
+        for token in api_token_client.api_tokens.values():
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=token, org_domain=org_domain
+            )
+            if missing_user_roles_scope:
+                report = missing_user_roles_scope_for_token_finding(
+                    self.metadata(), org_domain, token, missing_user_roles_scope
+                )
+            elif owner_has_super_admin(token):
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"API token {token.name} is owned by user {token.user_id} "
+                    "with the Super Admin role. Use a dedicated service account "
+                    "with least-privilege admin roles instead."
+                )
+            else:
+                roles = (
+                    ", ".join(token.owner_roles)
+                    if token.owner_roles
+                    else "no admin roles returned"
+                )
+                caveat = (
+                    " Group-inherited roles were not checked because the "
+                    f"`{missing_user_groups_scope}` scope is missing — grant "
+                    "it to detect Super Admin assigned via group membership."
+                    if missing_user_groups_scope
+                    else ""
+                )
+                report.status = "PASS"
+                report.status_extended = (
+                    f"API token {token.name} owner {token.user_id} is not "
+                    f"assigned Super Admin ({roles}).{caveat}"
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/apitoken/apitoken_restricted_to_network_zone/__init__.py b/prowler/providers/okta/services/apitoken/apitoken_restricted_to_network_zone/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/apitoken/apitoken_restricted_to_network_zone/apitoken_restricted_to_network_zone.metadata.json b/prowler/providers/okta/services/apitoken/apitoken_restricted_to_network_zone/apitoken_restricted_to_network_zone.metadata.json
new file mode 100644
index 0000000000..4a088a0c1c
--- /dev/null
+++ b/prowler/providers/okta/services/apitoken/apitoken_restricted_to_network_zone/apitoken_restricted_to_network_zone.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "apitoken_restricted_to_network_zone",
+  "CheckTitle": "Okta API tokens are restricted to known Network Zones",
+  "CheckType": [],
+  "ServiceName": "apitoken",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "**Okta API token network restrictions** should prevent token use from Any IP by tying each token to known Okta Network Zones.",
+  "Risk": "**API tokens allowed from Any IP** can be replayed from attacker-controlled infrastructure if the secret is exposed, removing an important network boundary.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/apitoken",
+    "https://help.okta.com/oie/en-us/content/topics/security/api.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "Security > API > Tokens: edit each token Security section and select specific Network Zones instead of Any IP.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "**Restrict every Okta API token to trusted IP-based Network Zones** and review token network conditions whenever service locations change.",
+      "Url": "https://hub.prowler.com/check/apitoken_restricted_to_network_zone"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/okta/services/apitoken/apitoken_restricted_to_network_zone/apitoken_restricted_to_network_zone.py b/prowler/providers/okta/services/apitoken/apitoken_restricted_to_network_zone/apitoken_restricted_to_network_zone.py
new file mode 100644
index 0000000000..04cfcf2df7
--- /dev/null
+++ b/prowler/providers/okta/services/apitoken/apitoken_restricted_to_network_zone/apitoken_restricted_to_network_zone.py
@@ -0,0 +1,55 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.apitoken.api_token_client import api_token_client
+from prowler.providers.okta.services.apitoken.lib.api_token_helpers import (
+    definite_network_zone_restriction_failure,
+    missing_api_token_scope_finding,
+    missing_network_zone_scope_for_token_finding,
+    network_zone_restriction_status,
+)
+
+
+class apitoken_restricted_to_network_zone(Check):
+    """Ensure Okta API tokens are restricted to known Network Zones."""
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate every active API token's network condition."""
+        org_domain = api_token_client.provider.identity.org_domain
+        missing_api_token_scope = api_token_client.missing_scope.get("api_tokens")
+        if missing_api_token_scope:
+            return [
+                missing_api_token_scope_finding(
+                    self.metadata(),
+                    org_domain,
+                    missing_api_token_scope,
+                    additional_required=["okta.networkZones.read"],
+                )
+            ]
+
+        missing_network_zone_scope = api_token_client.missing_scope.get("network_zones")
+        findings: list[CheckReportOkta] = []
+        for token in api_token_client.api_tokens.values():
+            if missing_network_zone_scope:
+                definite_failure = definite_network_zone_restriction_failure(token)
+                if definite_failure:
+                    report = CheckReportOkta(
+                        metadata=self.metadata(),
+                        resource=token,
+                        org_domain=org_domain,
+                    )
+                    report.status, report.status_extended = definite_failure
+                else:
+                    report = missing_network_zone_scope_for_token_finding(
+                        self.metadata(), org_domain, token, missing_network_zone_scope
+                    )
+            else:
+                report = CheckReportOkta(
+                    metadata=self.metadata(), resource=token, org_domain=org_domain
+                )
+                (
+                    report.status,
+                    report.status_extended,
+                ) = network_zone_restriction_status(
+                    token, api_token_client.known_network_zone_ids
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/apitoken/lib/__init__.py b/prowler/providers/okta/services/apitoken/lib/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/apitoken/lib/api_token_helpers.py b/prowler/providers/okta/services/apitoken/lib/api_token_helpers.py
new file mode 100644
index 0000000000..3a871714ae
--- /dev/null
+++ b/prowler/providers/okta/services/apitoken/lib/api_token_helpers.py
@@ -0,0 +1,140 @@
+from prowler.lib.check.models import CheckReportOkta
+from prowler.providers.okta.services.apitoken.api_token_service import OktaApiToken
+
+ANYWHERE_CONNECTIONS = {"", "ANYWHERE", "ANY_IP"}
+_SCOPE_ADVICE = (
+    "Grant it on the Okta API Scopes tab of the service app in the Okta Admin "
+    "Console, then re-run the check."
+)
+
+
+def network_zone_restriction_status(
+    token: OktaApiToken, known_network_zone_ids: set[str]
+) -> tuple[str, str]:
+    """Evaluate whether an API token is restricted to known Network Zones."""
+    connection = token.network_connection.upper()
+    if connection in ANYWHERE_CONNECTIONS:
+        return (
+            "FAIL",
+            f"API token {token.name} can be used from any IP address. "
+            "Restrict the token to one or more known Okta Network Zones.",
+        )
+
+    if not token.network_includes:
+        return (
+            "FAIL",
+            f"API token {token.name} does not allowlist a specific Okta "
+            "Network Zone. Excluded zones do not restrict the token to trusted "
+            "source networks.",
+        )
+
+    unknown_zones = [
+        zone for zone in token.network_includes if zone not in known_network_zone_ids
+    ]
+    if unknown_zones:
+        return (
+            "FAIL",
+            f"API token {token.name} references unknown Network Zone(s): "
+            f"{', '.join(unknown_zones)}.",
+        )
+
+    return (
+        "PASS",
+        f"API token {token.name} is restricted to known Okta Network Zone(s): "
+        f"{', '.join(token.network_includes)}.",
+    )
+
+
+def definite_network_zone_restriction_failure(
+    token: OktaApiToken,
+) -> tuple[str, str] | None:
+    """Return a definite network restriction failure that does not need zone lookup."""
+    connection = token.network_connection.upper()
+    if connection in ANYWHERE_CONNECTIONS or not token.network_includes:
+        return network_zone_restriction_status(token, set())
+    return None
+
+
+def owner_has_super_admin(token: OktaApiToken) -> bool:
+    """Return True when any token owner role is Super Admin."""
+    for role in token.owner_roles:
+        normalized = role.strip().replace(" ", "_").upper()
+        if normalized in {"SUPER_ADMIN", "SUPER_ADMINISTRATOR"}:
+            return True
+    return False
+
+
+def missing_api_token_scope_finding(
+    metadata,
+    org_domain: str,
+    scope: str,
+    additional_required: list[str] | None = None,
+) -> CheckReportOkta:
+    """Build the MANUAL finding emitted when API tokens cannot be listed.
+
+    `additional_required` lets the calling check name the secondary
+    scopes it also needs (e.g. `okta.roles.read` for the Super Admin
+    check, `okta.networkZones.read` for the zone-restriction check) so
+    the operator can grant everything in one go instead of re-running
+    once per missing scope.
+    """
+    resource = OktaApiToken(
+        id="api-tokens-scope-missing",
+        name="(scope not granted)",
+    )
+    report = CheckReportOkta(
+        metadata=metadata, resource=resource, org_domain=org_domain
+    )
+    report.status = "MANUAL"
+    if additional_required:
+        extras = f" This check also requires {_format_scope_list(additional_required)}."
+        advice = (
+            "Grant them on the service app's Okta API Scopes tab in the Okta "
+            "Admin Console, then re-run the check."
+        )
+    else:
+        extras = ""
+        advice = _SCOPE_ADVICE
+    report.status_extended = (
+        f"Could not retrieve Okta API token metadata: the Okta service app "
+        f"is missing the required `{scope}` API scope.{extras} {advice}"
+    )
+    return report
+
+
+def _format_scope_list(scopes: list[str]) -> str:
+    """Format a list of scope names as backticked, comma-joined text."""
+    formatted = [f"`{scope}`" for scope in scopes]
+    if len(formatted) == 1:
+        return formatted[0]
+    if len(formatted) == 2:
+        return " and ".join(formatted)
+    return ", ".join(formatted[:-1]) + f", and {formatted[-1]}"
+
+
+def missing_network_zone_scope_for_token_finding(
+    metadata, org_domain: str, token: OktaApiToken, scope: str
+) -> CheckReportOkta:
+    """Build the MANUAL finding emitted when token zones cannot be validated."""
+    report = CheckReportOkta(metadata=metadata, resource=token, org_domain=org_domain)
+    report.status = "MANUAL"
+    report.status_extended = (
+        f"Could not validate Network Zone restrictions for API token "
+        f"{token.name}: the Okta service app is missing the required "
+        f"`{scope}` API scope. {_SCOPE_ADVICE}"
+    )
+    return report
+
+
+def missing_user_roles_scope_for_token_finding(
+    metadata, org_domain: str, token: OktaApiToken, scope: str
+) -> CheckReportOkta:
+    """Build the MANUAL finding emitted when token owner roles cannot be listed."""
+    report = CheckReportOkta(metadata=metadata, resource=token, org_domain=org_domain)
+    report.status = "MANUAL"
+    report.status_extended = (
+        f"Could not retrieve admin roles for API token {token.name} owner "
+        f"{token.user_id}: the Okta service app is missing the required "
+        f"`{scope}` API scope. {_SCOPE_ADVICE}"
+    )
+    return report
diff --git a/prowler/providers/okta/services/application/application_service.py b/prowler/providers/okta/services/application/application_service.py
index de2fe0a658..fa6f483021 100644
--- a/prowler/providers/okta/services/application/application_service.py
+++ b/prowler/providers/okta/services/application/application_service.py
@@ -1,10 +1,13 @@
-import json
 from typing import Optional
-from urllib.parse import parse_qs, urlparse
+from urllib.parse import urlparse
 
 from pydantic import BaseModel, ValidationError
 
 from prowler.lib.logger import logger
+from prowler.providers.okta.lib.service.pagination import paginate as _paginate_shared
+from prowler.providers.okta.lib.service.raw_fetch import (
+    get_json_paginated as _raw_get_json_paginated,
+)
 from prowler.providers.okta.lib.service.service import OktaService
 
 # These three keys are Okta-platform constants, not tenant-configurable:
@@ -28,29 +31,6 @@ DASHBOARD_APP_NAME = "okta_enduser"
 ADMIN_CONSOLE_FIRST_PARTY_APP_KEY = "admin-console"
 
 
-def _next_after_cursor(resp) -> Optional[str]:
-    """Extract the `after` cursor from a `Link: ...; rel="next"` header.
-
-    Returns None when there is no next page. Header format follows RFC 5988
-    and Okta's pagination guide. Mirrors the helper in `signon_service` —
-    duplicated rather than shared until a third Okta service appears.
-    """
-    if resp is None:
-        return None
-    headers = getattr(resp, "headers", None) or {}
-    link = headers.get("link") or headers.get("Link") or ""
-    if not link:
-        return None
-    for part in link.split(","):
-        if 'rel="next"' not in part:
-            continue
-        url_segment = part.split(";", 1)[0].strip().lstrip("<").rstrip(">")
-        cursor = parse_qs(urlparse(url_segment).query).get("after", [None])[0]
-        if cursor:
-            return cursor
-    return None
-
-
 REQUIRED_SCOPES: dict[str, str] = {
     "admin_console_app_settings": "okta.apps.read",
     "built_in_apps": "okta.apps.read",
@@ -321,69 +301,24 @@ class Application(OktaService):
         """Raw-JSON fallback for `list_policy_rules`.
 
         Bypasses the Okta SDK's typed deserialization by calling the
-        request executor directly without a response type. The response
-        body is then `json.loads`-ed and projected onto our own pydantic
-        snapshot, which only validates the fields the STIG checks
-        actually read. This keeps the checks evaluable on tenants where
-        the Management API returns values the SDK validators reject.
+        request executor directly via the shared `get_json_paginated`
+        helper, which follows `Link: rel=next` so policies with more
+        rules than `rule_fetch_limit` are not silently truncated.
+        Projects the response onto our own pydantic snapshot which only
+        validates the fields the STIG checks actually read. This keeps
+        the checks evaluable on tenants where the Management API returns
+        values the SDK validators reject.
         """
-        request, error = await self.client._request_executor.create_request(
-            method="GET",
-            url=f"/api/v1/policies/{policy_id}/rules?limit={rule_fetch_limit}",
-            body=None,
-            headers={"Accept": "application/json"},
+        rules_data = await _raw_get_json_paginated(
+            self.client,
+            f"/api/v1/policies/{policy_id}/rules",
+            page_size=rule_fetch_limit,
+            context=f"access policy {policy_id} rules",
         )
-        if error is not None:
-            logger.error(
-                f"Raw rules fetch (create_request) failed for {policy_id}: {error}"
-            )
+        if rules_data is None:
             return AuthenticationPolicy(
                 id=policy_id, name="", status="", is_default=False, rules=[]
             )
-
-        _response, response_body, error = await self.client._request_executor.execute(
-            request
-        )
-        if error is not None:
-            logger.error(f"Raw rules fetch (execute) failed for {policy_id}: {error}")
-            return AuthenticationPolicy(
-                id=policy_id, name="", status="", is_default=False, rules=[]
-            )
-
-        if isinstance(response_body, (bytes, bytearray)):
-            try:
-                response_body = response_body.decode("utf-8")
-            except UnicodeDecodeError as decode_err:
-                logger.error(
-                    f"Could not decode rules response for {policy_id}: {decode_err}"
-                )
-                return AuthenticationPolicy(
-                    id=policy_id, name="", status="", is_default=False, rules=[]
-                )
-        try:
-            rules_data = json.loads(response_body) if response_body else []
-        except json.JSONDecodeError as decode_err:
-            logger.error(f"Could not parse rules JSON for {policy_id}: {decode_err}")
-            return AuthenticationPolicy(
-                id=policy_id, name="", status="", is_default=False, rules=[]
-            )
-
-        if not isinstance(rules_data, list):
-            logger.error(
-                f"Unexpected raw rules payload shape for {policy_id}: "
-                f"got {type(rules_data).__name__}, expected list"
-            )
-            return AuthenticationPolicy(
-                id=policy_id, name="", status="", is_default=False, rules=[]
-            )
-
-        if len(rules_data) >= rule_fetch_limit:
-            logger.warning(
-                f"Access policy {policy_id} returned {len(rules_data)} rules "
-                f"via raw-JSON fallback — the per-policy fetch limit "
-                f"({rule_fetch_limit}) was hit; any rules beyond this limit "
-                "are not evaluated by Prowler."
-            )
         rules_out = [_raw_rule_to_model(rule) for rule in rules_data]
         return AuthenticationPolicy(
             id=policy_id, name="", status="", is_default=False, rules=rules_out
@@ -391,33 +326,7 @@ class Application(OktaService):
 
     @staticmethod
     async def _paginate(fetch):
-        """Drain all pages of an SDK list call.
-
-        `fetch` is a callable taking the `after` cursor (or None) and
-        returning the SDK's `(items, resp, err)` tuple. Follows the
-        `Link: rel="next"` header until exhausted. Mirrors the helper in
-        `signon_service`.
-        """
-        all_items = []
-        result = await fetch(None)
-        err = result[-1]
-        if err is not None:
-            return [], err
-        items = result[0]
-        resp = result[1] if len(result) >= 3 else None
-        all_items.extend(items or [])
-        while True:
-            cursor = _next_after_cursor(resp)
-            if not cursor:
-                break
-            result = await fetch(cursor)
-            err = result[-1]
-            if err is not None:
-                return all_items, err
-            items = result[0]
-            resp = result[1] if len(result) >= 3 else None
-            all_items.extend(items or [])
-        return all_items, None
+        return await _paginate_shared(fetch)
 
 
 def _policy_id_from_href(href: Optional[str]) -> Optional[str]:
diff --git a/prowler/providers/okta/services/authenticator/__init__.py b/prowler/providers/okta/services/authenticator/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_client.py b/prowler/providers/okta/services/authenticator/authenticator_client.py
new file mode 100644
index 0000000000..3657a2821e
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.okta.services.authenticator.authenticator_service import (
+    Authenticator,
+)
+
+authenticator_client = Authenticator(Provider.get_global_provider())
diff --git a/prowler/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/authenticator_okta_verify_fips_compliant.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/authenticator_okta_verify_fips_compliant.metadata.json
new file mode 100644
index 0000000000..363b95f84a
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/authenticator_okta_verify_fips_compliant.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_okta_verify_fips_compliant",
+  "CheckTitle": "Okta Verify authenticator is active and restricts enrollment to FIPS-compliant devices",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "The **Okta Verify authenticator** (`okta_verify`) must be present, in the `ACTIVE` status, and configured to require FIPS-compliant devices for enrollment (`settings.compliance.fips == REQUIRED`).\n\nMissing, inactive, and active-but-non-FIPS authenticators surface as distinct FAIL findings so the operator can act on the specific gap.",
+  "Risk": "Without FIPS-required enrollment, users can authenticate with devices whose cryptographic modules are not FIPS-validated.\n\n- **Regulatory exposure** under frameworks that mandate FIPS-validated cryptography\n- **Inconsistent assurance** across the user population\n- **Weak baseline** if the authenticator is active but the FIPS flag is `OPTIONAL` or unset",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/authenticator",
+    "https://help.okta.com/en-us/content/topics/mobile/ov-admin-config.htm",
+    "https://help.okta.com/oie/en-us/content/topics/identity-engine/authenticators/configure-okta-verify-options.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authenticators**.\n3. Activate the **Okta Verify** authenticator if it is not already `ACTIVE`.\n4. Open the authenticator's settings and set *FIPS Compliance* to **Users enrolling in Okta Verify can use FIPS compliant devices only**.\n5. Save the authenticator.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure the **Okta Verify** authenticator is:\n- Present in the org (`key = okta_verify`)\n- In the `ACTIVE` status\n- Configured so *FIPS Compliance* is **Required** (`settings.compliance.fips == REQUIRED`)\n\nIf the organization does not require FIPS-validated authenticators, mute the check rather than disabling the FIPS toggle on a partial population.",
+      "Url": "https://hub.prowler.com/check/authenticator_okta_verify_fips_compliant"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273205 / OKTA-APP-001700."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/authenticator_okta_verify_fips_compliant.py b/prowler/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/authenticator_okta_verify_fips_compliant.py
new file mode 100644
index 0000000000..bf3c64b4b8
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/authenticator_okta_verify_fips_compliant.py
@@ -0,0 +1,65 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.authenticator_helpers import (
+    find_authenticator_by_key,
+    missing_authenticator_resource,
+    missing_authenticators_scope_finding,
+)
+
+
+class authenticator_okta_verify_fips_compliant(Check):
+    """STIG V-273205 / OKTA-APP-001700.
+
+    The check requires Okta to restrict Okta Verify enrollment to FIPS-compliant devices.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate Okta Verify FIPS compliance settings."""
+        org_domain = authenticator_client.provider.identity.org_domain
+        missing_scope = authenticator_client.missing_scope.get("authenticators")
+        if missing_scope:
+            return [
+                missing_authenticators_scope_finding(
+                    self.metadata(),
+                    org_domain,
+                    "okta_verify",
+                    "Okta Verify authenticator",
+                    missing_scope,
+                )
+            ]
+
+        authenticator = find_authenticator_by_key(
+            authenticator_client.authenticators, "okta_verify"
+        )
+        resource = authenticator or missing_authenticator_resource(
+            "okta_verify", "Okta Verify authenticator"
+        )
+        report = CheckReportOkta(
+            metadata=self.metadata(), resource=resource, org_domain=org_domain
+        )
+        if not authenticator:
+            report.status = "FAIL"
+            report.status_extended = "Okta Verify authenticator is missing."
+        elif authenticator.status.upper() != "ACTIVE":
+            report.status = "FAIL"
+            report.status_extended = (
+                f"Okta Verify authenticator is not active; current status is "
+                f"{authenticator.status}."
+            )
+        elif authenticator.fips.upper() == "REQUIRED":
+            report.status = "PASS"
+            report.status_extended = (
+                "Okta Verify authenticator requires FIPS-compliant devices "
+                "for enrollment."
+            )
+        else:
+            current_fips = authenticator.fips or "unset"
+            report.status = "FAIL"
+            report.status_extended = (
+                "Okta Verify authenticator is active but does not require "
+                "FIPS-compliant devices for enrollment (current value: "
+                f"{current_fips})."
+            )
+        return [report]
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_common_password_check/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_common_password_check/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_common_password_check/authenticator_password_common_password_check.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_common_password_check/authenticator_password_common_password_check.metadata.json
new file mode 100644
index 0000000000..f61ccef8a1
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_common_password_check/authenticator_password_common_password_check.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_common_password_check",
+  "CheckTitle": "Every active Okta Password Policy rejects common passwords",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must reject passwords found in Okta's common-password dictionary (the *Restrict use of common passwords* setting).\n\nOkta evaluates Password Policies by group assignment; a custom policy with the check disabled can govern users. The check emits one finding per active policy.",
+  "Risk": "Without dictionary checking, users can pick passwords known to attackers from public breaches.\n\n- **Credential stuffing** succeeds with the same passwords compromised elsewhere\n- **Trivial guessing** stays viable for top-N lists (`123456`, `password`, …)\n- **Inconsistent baselines** leave users on legacy policies that allow common passwords",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and enable **Restrict use of common passwords**.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name                          = \"<example_resource_name>\"\n  status                        = \"ACTIVE\"\n  password_dictionary_lookup    = true  # Critical: enables the common-password dictionary check\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Restrict use of common passwords* is **enabled**\n- Group assignments do not route users to legacy policies that leave the check disabled\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_common_password_check"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273208 / OKTA-APP-002980."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_common_password_check/authenticator_password_common_password_check.py b/prowler/providers/okta/services/authenticator/authenticator_password_common_password_check/authenticator_password_common_password_check.py
new file mode 100644
index 0000000000..d90d88afeb
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_common_password_check/authenticator_password_common_password_check.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_common_password_check(Check):
+    """STIG V-273208 / OKTA-APP-002980.
+
+    Every active Okta Password Policy must reject passwords found in the common-password dictionary.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "common-password dictionary checks"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.common_password_check is True:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(common password check enabled: {policy.common_password_check})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(common password check enabled: {policy.common_password_check})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/authenticator_password_complexity_lowercase.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/authenticator_password_complexity_lowercase.metadata.json
new file mode 100644
index 0000000000..42a74b6e71
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/authenticator_password_complexity_lowercase.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_complexity_lowercase",
+  "CheckTitle": "Every active Okta Password Policy requires at least one lowercase character",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must require at least one **lowercase** character in the user's password.\n\nOkta evaluates Password Policies by group assignment, so a permissive custom policy that drops lowercase complexity can govern users even when the default policy is compliant. The check emits one finding per active policy so weaker custom policies do not hide behind a compliant default.",
+  "Risk": "Without lowercase complexity, the effective alphabet shrinks and passwords become easier to enumerate.\n\n- **Brute force** succeeds against a smaller character space\n- **Wordlist attacks** match more candidates without case mixing\n- **Inconsistent baselines** leave users on legacy policies with weaker complexity than the default",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and enable **Lower case letter** under *Complexity*.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name                   = \"<example_resource_name>\"\n  status                 = \"ACTIVE\"\n  password_min_lowercase = 1  # Critical: STIG-aligned complexity\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Minimum number of lowercase characters* is `1` or more\n- Group assignments do not route users to legacy policies that disable lowercase complexity\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_complexity_lowercase"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273197 / OKTA-APP-000680."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/authenticator_password_complexity_lowercase.py b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/authenticator_password_complexity_lowercase.py
new file mode 100644
index 0000000000..e058e27b7b
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/authenticator_password_complexity_lowercase.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_complexity_lowercase(Check):
+    """STIG V-273197 / OKTA-APP-000680.
+
+    Every active Okta Password Policy must require at least one lowercase character.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "at least one lowercase character"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.min_lower_case is not None and policy.min_lower_case >= 1:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(minimum lowercase characters: {policy.min_lower_case})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(minimum lowercase characters: {policy.min_lower_case})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_number/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_number/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_number/authenticator_password_complexity_number.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_number/authenticator_password_complexity_number.metadata.json
new file mode 100644
index 0000000000..fb3d4a920b
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_number/authenticator_password_complexity_number.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_complexity_number",
+  "CheckTitle": "Every active Okta Password Policy requires at least one numeric character",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must require at least one **numeric** character in the user's password.\n\nOkta evaluates Password Policies by group assignment, so a permissive custom policy that drops numeric complexity can govern users even when the default policy is compliant. The check emits one finding per active policy so weaker custom policies do not hide behind a compliant default.",
+  "Risk": "Without numeric complexity, the effective alphabet shrinks and dictionary words remain viable as passwords.\n\n- **Brute force** succeeds against a smaller character space\n- **Wordlist attacks** match plain dictionary words without numeric padding\n- **Inconsistent baselines** leave users on legacy policies with weaker complexity than the default",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and enable **Number** under *Complexity*.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  status              = \"ACTIVE\"\n  password_min_number = 1  # Critical: STIG-aligned complexity\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Minimum number of numeric characters* is `1` or more\n- Group assignments do not route users to legacy policies that disable numeric complexity\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_complexity_number"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273198 / OKTA-APP-000690."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_number/authenticator_password_complexity_number.py b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_number/authenticator_password_complexity_number.py
new file mode 100644
index 0000000000..78ffe6878e
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_number/authenticator_password_complexity_number.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_complexity_number(Check):
+    """STIG V-273198 / OKTA-APP-000690.
+
+    Every active Okta Password Policy must require at least one numeric character.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "at least one numeric character"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.min_number is not None and policy.min_number >= 1:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(minimum numeric characters: {policy.min_number})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(minimum numeric characters: {policy.min_number})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_symbol/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_symbol/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_symbol/authenticator_password_complexity_symbol.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_symbol/authenticator_password_complexity_symbol.metadata.json
new file mode 100644
index 0000000000..1268780551
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_symbol/authenticator_password_complexity_symbol.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_complexity_symbol",
+  "CheckTitle": "Every active Okta Password Policy requires at least one symbol character",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must require at least one **symbol** character in the user's password.\n\nOkta evaluates Password Policies by group assignment, so a permissive custom policy that drops symbol complexity can govern users even when the default policy is compliant. The check emits one finding per active policy so weaker custom policies do not hide behind a compliant default.",
+  "Risk": "Without symbol complexity, the effective alphabet shrinks and passwords stay closer to natural-language phrases.\n\n- **Brute force** succeeds against a smaller character space\n- **Wordlist attacks** match dictionary words without symbol padding\n- **Inconsistent baselines** leave users on legacy policies with weaker complexity than the default",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and enable **Symbol** under *Complexity*.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  status              = \"ACTIVE\"\n  password_min_symbol = 1  # Critical: STIG-aligned complexity\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Minimum number of symbol characters* is `1` or more\n- Group assignments do not route users to legacy policies that disable symbol complexity\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_complexity_symbol"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273199 / OKTA-APP-000700."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_symbol/authenticator_password_complexity_symbol.py b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_symbol/authenticator_password_complexity_symbol.py
new file mode 100644
index 0000000000..208a0f51d3
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_symbol/authenticator_password_complexity_symbol.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_complexity_symbol(Check):
+    """STIG V-273199 / OKTA-APP-000700.
+
+    Every active Okta Password Policy must require at least one symbol character.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "at least one symbol character"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.min_symbol is not None and policy.min_symbol >= 1:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(minimum symbol characters: {policy.min_symbol})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(minimum symbol characters: {policy.min_symbol})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/authenticator_password_complexity_uppercase.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/authenticator_password_complexity_uppercase.metadata.json
new file mode 100644
index 0000000000..7e885364ae
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/authenticator_password_complexity_uppercase.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_complexity_uppercase",
+  "CheckTitle": "Every active Okta Password Policy requires at least one uppercase character",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must require at least one **uppercase** character in the user's password.\n\nOkta evaluates Password Policies by group assignment, so a permissive custom policy that drops uppercase complexity can govern users even when the default policy is compliant. The check emits one finding per active policy so weaker custom policies do not hide behind a compliant default.",
+  "Risk": "Without uppercase complexity, the effective alphabet shrinks and passwords become easier to enumerate.\n\n- **Brute force** succeeds against a smaller character space\n- **Wordlist attacks** match more candidates without case mixing\n- **Inconsistent baselines** leave users on legacy policies with weaker complexity than the default",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and enable **Upper case letter** under *Complexity*.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name                   = \"<example_resource_name>\"\n  status                 = \"ACTIVE\"\n  password_min_uppercase = 1  # Critical: STIG-aligned complexity\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Minimum number of uppercase characters* is `1` or more\n- Group assignments do not route users to legacy policies that disable uppercase complexity\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_complexity_uppercase"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273196 / OKTA-APP-000670."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/authenticator_password_complexity_uppercase.py b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/authenticator_password_complexity_uppercase.py
new file mode 100644
index 0000000000..1419027980
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/authenticator_password_complexity_uppercase.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_complexity_uppercase(Check):
+    """STIG V-273196 / OKTA-APP-000670.
+
+    Every active Okta Password Policy must require at least one uppercase character.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "at least one uppercase character"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.min_upper_case is not None and policy.min_upper_case >= 1:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(minimum uppercase characters: {policy.min_upper_case})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(minimum uppercase characters: {policy.min_upper_case})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_history_5/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_history_5/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_history_5/authenticator_password_history_5.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_history_5/authenticator_password_history_5.metadata.json
new file mode 100644
index 0000000000..a7191b0364
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_history_5/authenticator_password_history_5.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_history_5",
+  "CheckTitle": "Every active Okta Password Policy remembers at least 5 previous passwords",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must keep at least the last `5` passwords in history so users cannot immediately recycle a recently-used password.\n\nOkta evaluates Password Policies by group assignment, so a permissive custom policy that lowers the history depth can govern users even when the default policy is compliant. The check emits one finding per active policy.",
+  "Risk": "A short password history lets users cycle back to compromised or trivially-guessable values shortly after a forced rotation.\n\n- **Reuse of breached passwords** within the same account\n- **Defeats forced rotation** by letting users return to a previous password\n- **Inconsistent baselines** leave users on legacy policies with shorter history than the default",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and set *Enforce password history for last* to `5` passwords or more.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name                  = \"<example_resource_name>\"\n  status                = \"ACTIVE\"\n  password_history_count = 5  # Critical: STIG-aligned history depth\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Enforce password history for last* is `5` passwords or more\n- Group assignments do not route users to legacy policies with shorter history\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_history_5"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273209 / OKTA-APP-003010."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_history_5/authenticator_password_history_5.py b/prowler/providers/okta/services/authenticator/authenticator_password_history_5/authenticator_password_history_5.py
new file mode 100644
index 0000000000..b2eb6d16ba
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_history_5/authenticator_password_history_5.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_history_5(Check):
+    """STIG V-273209 / OKTA-APP-003010.
+
+    Every active Okta Password Policy must remember at least the last 5 previous passwords.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "password history of at least 5 previous passwords"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.history_count is not None and policy.history_count >= 5:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(password history count: {policy.history_count})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(password history count: {policy.history_count})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/authenticator_password_lockout_threshold_3.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/authenticator_password_lockout_threshold_3.metadata.json
new file mode 100644
index 0000000000..e287ed38f3
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/authenticator_password_lockout_threshold_3.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_lockout_threshold_3",
+  "CheckTitle": "Every active Okta Password Policy locks accounts after 3 or fewer failed attempts",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must lock the account after at most `3` consecutive failed sign-in attempts.\n\nOkta evaluates Password Policies by group assignment, so a permissive custom policy with a higher threshold (or no lockout) can govern users even when the default is compliant. The check emits one finding per active policy.",
+  "Risk": "A high lockout threshold (or no threshold) leaves accounts exposed to online password guessing.\n\n- **Online brute force** retains enough attempts to enumerate common passwords\n- **Credential stuffing** can iterate through breached credentials at scale\n- **Inconsistent baselines** leave users on legacy policies with weaker thresholds than the default",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and set *Lock out user after X unsuccessful attempts* to `3` or fewer.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name                  = \"<example_resource_name>\"\n  status                = \"ACTIVE\"\n  password_max_lockout_attempts = 3  # Critical: STIG-aligned lockout threshold\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Lock out user after X unsuccessful attempts* is `3` or fewer\n- Group assignments do not route users to legacy policies with higher thresholds or no lockout\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_lockout_threshold_3"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273189 / OKTA-APP-000170. Not applicable when Okta delegates password sourcing to an external directory (AD/LDAP) — mute the check in that case; the directory enforces lockout instead."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/authenticator_password_lockout_threshold_3.py b/prowler/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/authenticator_password_lockout_threshold_3.py
new file mode 100644
index 0000000000..8026725c8a
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/authenticator_password_lockout_threshold_3.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_lockout_threshold_3(Check):
+    """STIG V-273189 / OKTA-APP-000170.
+
+    Every active Okta Password Policy must lock accounts after no more than 3 consecutive failed login attempts.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "password lockout after 3 or fewer failed attempts"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.max_attempts is not None and policy.max_attempts <= 3:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(maximum failed attempts: {policy.max_attempts})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(maximum failed attempts: {policy.max_attempts})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/authenticator_password_maximum_age_60d.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/authenticator_password_maximum_age_60d.metadata.json
new file mode 100644
index 0000000000..449904303e
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/authenticator_password_maximum_age_60d.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_maximum_age_60d",
+  "CheckTitle": "Every active Okta Password Policy enforces a maximum password age of 60 days or less",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must require users to change their password at least every `60` days. The check rejects both unlimited expiration (`0`, which Okta treats as *never expires*) and any value greater than `60`.\n\nOkta evaluates Password Policies by group assignment; a permissive custom policy with a longer window can govern users. The check emits one finding per active policy.",
+  "Risk": "Long-lived passwords give a compromised credential indefinite usefulness.\n\n- **Stolen passwords** stay valid until the user happens to change them\n- **Breach detection lag** means a leaked password can be in use for months unnoticed\n- **No expiration** is the same risk as an infinite expiration window",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and set *Enforce password expiration* to `60` days or less. Do **not** leave it disabled or set to `0` — that disables expiration entirely.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  status              = \"ACTIVE\"\n  password_max_age_days = 60  # Critical: STIG-aligned maximum age; do not use 0 (disables expiration)\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Enforce password expiration* is `60` days or less\n- Never set the value to `0`, which disables expiration\n- Group assignments do not route users to legacy policies with longer windows or disabled expiration\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_maximum_age_60d"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273201 / OKTA-APP-000745."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/authenticator_password_maximum_age_60d.py b/prowler/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/authenticator_password_maximum_age_60d.py
new file mode 100644
index 0000000000..2dbc5d9c07
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/authenticator_password_maximum_age_60d.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_maximum_age_60d(Check):
+    """STIG V-273201 / OKTA-APP-000745.
+
+    Every active Okta Password Policy must enforce a 60-day maximum password age.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "maximum password age of 60 days or less"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.max_age_days is not None and 0 < policy.max_age_days <= 60:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(maximum age days: {policy.max_age_days})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(maximum age days: {policy.max_age_days})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/authenticator_password_minimum_age_24h.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/authenticator_password_minimum_age_24h.metadata.json
new file mode 100644
index 0000000000..8adbf3b5a0
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/authenticator_password_minimum_age_24h.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_minimum_age_24h",
+  "CheckTitle": "Every active Okta Password Policy enforces a minimum password age of 24 hours",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must prevent users from changing their password again for at least `24` hours (`1440` minutes) after the previous change.\n\nA minimum age stops users from cycling through their entire history in one session to land back on a previously-known password. The check emits one finding per active policy.",
+  "Risk": "Without a minimum password age, users can sidestep history and rotation requirements in minutes.\n\n- **Defeats password history** by walking through new passwords back to a previous one\n- **Defeats forced rotation** by returning to the prior password after the mandatory change\n- **Inconsistent baselines** leave users on legacy policies with shorter minimums than the default",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and set *Minimum password age* to `24` hours (`1440` minutes) or more.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name                  = \"<example_resource_name>\"\n  status                = \"ACTIVE\"\n  password_min_age_minutes = 1440  # Critical: STIG-aligned 24h minimum age\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Minimum password age* is `1440` minutes (`24` hours) or more\n- Group assignments do not route users to legacy policies with shorter minimums or no minimum age\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_minimum_age_24h"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273200 / OKTA-APP-000740."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/authenticator_password_minimum_age_24h.py b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/authenticator_password_minimum_age_24h.py
new file mode 100644
index 0000000000..93ce511458
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/authenticator_password_minimum_age_24h.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_minimum_age_24h(Check):
+    """STIG V-273200 / OKTA-APP-000740.
+
+    Every active Okta Password Policy must enforce a 24-hour minimum password age.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "minimum password age of at least 24 hours"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.min_age_minutes is not None and policy.min_age_minutes >= 1440:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(minimum age minutes: {policy.min_age_minutes})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(minimum age minutes: {policy.min_age_minutes})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_minimum_length_15/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_length_15/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_minimum_length_15/authenticator_password_minimum_length_15.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_length_15/authenticator_password_minimum_length_15.metadata.json
new file mode 100644
index 0000000000..d7409c6bb1
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_length_15/authenticator_password_minimum_length_15.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_password_minimum_length_15",
+  "CheckTitle": "Every active Okta Password Policy enforces a minimum length of 15 characters",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every **active Okta Password Policy** must require at least `15` characters in the user's password.\n\nOkta evaluates Password Policies by group assignment, so a permissive custom policy with a shorter minimum length can govern users even when the default policy is compliant. The check emits one finding per active policy so weaker custom policies do not hide behind a compliant default.",
+  "Risk": "Short password minimums weaken brute-force and credential-stuffing resistance for every user assigned to the affected policy.\n\n- **Brute force** completes in feasible time against short passwords\n- **Credential stuffing** succeeds with reused passwords from public breaches\n- **Inconsistent baselines** leave users on legacy policies with weaker assurance than the default",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy",
+    "https://help.okta.com/en-us/content/topics/security/policies/configure-password-policies.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authentication** > **Password**.\n3. For every active policy, click **Edit** and set *Minimum password length* to `15` or more.\n4. Save the policy.\n5. Repeat for every active Password Policy returned by the check.",
+      "Terraform": "```hcl\nresource \"okta_policy_password\" \"<example_resource_name>\" {\n  name              = \"<example_resource_name>\"\n  status            = \"ACTIVE\"\n  password_min_length = 15  # Critical: STIG-aligned minimum\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure every active **Okta Password Policy** so:\n- *Minimum password length* is `15` characters or more\n- Group assignments do not route users to legacy policies with shorter minimums\n\nReview each active Password Policy individually — the check evaluates them one at a time.",
+      "Url": "https://hub.prowler.com/check/authenticator_password_minimum_length_15"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273195 / OKTA-APP-000650."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_password_minimum_length_15/authenticator_password_minimum_length_15.py b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_length_15/authenticator_password_minimum_length_15.py
new file mode 100644
index 0000000000..35e0a02b8b
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_password_minimum_length_15/authenticator_password_minimum_length_15.py
@@ -0,0 +1,60 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.password_policy_helpers import (
+    active_password_policies,
+    missing_password_policies_scope_finding,
+    no_active_password_policies_finding,
+    password_policy_label,
+)
+
+
+class authenticator_password_minimum_length_15(Check):
+    """STIG V-273195 / OKTA-APP-000650.
+
+    Every active Okta Password Policy must enforce a minimum password length of 15 characters.
+    The check emits one finding per active policy so a weaker
+    custom policy cannot hide behind a compliant default.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate all active Okta Password Policies."""
+        findings = []
+        org_domain = authenticator_client.provider.identity.org_domain
+        requirement = "minimum password length of at least 15 characters"
+        missing_scope = authenticator_client.missing_scope.get("password_policies")
+
+        if missing_scope:
+            return [
+                missing_password_policies_scope_finding(
+                    self.metadata(), org_domain, missing_scope, requirement
+                )
+            ]
+
+        policies = active_password_policies(authenticator_client.password_policies)
+        if not policies:
+            return [
+                no_active_password_policies_finding(
+                    self.metadata(), org_domain, requirement
+                )
+            ]
+
+        for policy in policies:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=policy, org_domain=org_domain
+            )
+            if policy.min_length is not None and policy.min_length >= 15:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} enforces {requirement} "
+                    f"(minimum length: {policy.min_length})."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{password_policy_label(policy)} does not enforce {requirement} "
+                    f"(minimum length: {policy.min_length})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/authenticator/authenticator_service.py b/prowler/providers/okta/services/authenticator/authenticator_service.py
new file mode 100644
index 0000000000..86b4084dfb
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_service.py
@@ -0,0 +1,236 @@
+from typing import Optional
+
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.okta.lib.service.pagination import paginate as _paginate_shared
+from prowler.providers.okta.lib.service.service import OktaService
+
+REQUIRED_SCOPES: dict[str, str] = {
+    "password_policies": "okta.policies.read",
+    "authenticators": "okta.authenticators.read",
+}
+
+
+def _value(value) -> str:
+    """Return plain string values from Okta SDK enums and raw strings."""
+    if value is None:
+        return ""
+    enum_value = getattr(value, "value", None)
+    if enum_value is not None:
+        return str(enum_value)
+    return str(value)
+
+
+def _int_or_none(value) -> Optional[int]:
+    if value is None:
+        return None
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return None
+
+
+def _bool_or_none(value) -> Optional[bool]:
+    """Coerce common Okta boolean shapes into a real `Optional[bool]`.
+
+    The Okta SDK typed `bool` fields are already real booleans, but the
+    raw-JSON fallback paths in sibling services have surfaced both
+    JSON-style booleans (`true`/`false` as Python `bool` after `json.loads`)
+    and string-flavored ones (`"true"`/`"false"`). `bool("false")` is
+    `True` — so naive coercion silently flips the meaning. Reject that
+    explicitly.
+    """
+    if value is None:
+        return None
+    if isinstance(value, bool):
+        return value
+    if isinstance(value, str):
+        normalized = value.strip().lower()
+        if normalized in {"true", "1", "yes"}:
+            return True
+        if normalized in {"false", "0", "no", ""}:
+            return False
+        return None
+    return bool(value)
+
+
+class Authenticator(OktaService):
+    """Fetches Okta Password Policies and Authenticators for STIG checks.
+
+    Populates:
+    - `self.password_policies` — keyed by policy id. Each `PasswordPolicy`
+      carries the projected fields the 10 password-policy checks read
+      (length, complexity, age, history, lockout, common-password
+      dictionary). The complete typed SDK response is collapsed into a
+      flat dataclass so the checks never reach back into the SDK shape.
+    - `self.authenticators` — keyed by authenticator id. Used by the
+      two non-password checks (Smart Card IdP, Okta Verify FIPS).
+
+    Before each fetch the service compares its required OAuth scope
+    (see `REQUIRED_SCOPES`) against the access token's granted scopes
+    (`provider.identity.granted_scopes`). When a scope is known to be
+    missing, the fetch is skipped and recorded in `self.missing_scope`
+    so each check can emit an explicit MANUAL finding instead of a
+    misleading "no resources returned". Empty granted_scopes means
+    "unknown" — the service attempts the fetch and lets the SDK fail
+    loudly.
+    """
+
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        granted = set(getattr(provider.identity, "granted_scopes", None) or [])
+        self.missing_scope: dict[str, Optional[str]] = {
+            resource: (scope if granted and scope not in granted else None)
+            for resource, scope in REQUIRED_SCOPES.items()
+        }
+        self.password_policies: dict[str, PasswordPolicy] = (
+            {}
+            if self.missing_scope["password_policies"]
+            else self._list_password_policies()
+        )
+        self.authenticators: dict[str, OktaAuthenticator] = (
+            {} if self.missing_scope["authenticators"] else self._list_authenticators()
+        )
+
+    def _list_password_policies(self) -> dict[str, "PasswordPolicy"]:
+        """List PASSWORD policies with normalized password settings."""
+        logger.info("Authenticator - Listing Okta PASSWORD policies...")
+        try:
+            return self._run(self._fetch_password_policies())
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return {}
+
+    async def _fetch_password_policies(self) -> dict[str, "PasswordPolicy"]:
+        result: dict[str, PasswordPolicy] = {}
+        items, err = await _paginate_shared(
+            lambda after: self.client.list_policies(
+                type="PASSWORD", after=after, limit="200"
+            )
+        )
+        if err is not None:
+            logger.error(f"Error listing PASSWORD policies: {err}")
+            return result
+
+        for policy in items:
+            policy_obj = self._build_password_policy(policy)
+            result[policy_obj.id] = policy_obj
+        return result
+
+    def _list_authenticators(self) -> dict[str, "OktaAuthenticator"]:
+        """List org authenticators with normalized settings."""
+        logger.info("Authenticator - Listing Okta authenticators...")
+        try:
+            return self._run(self._fetch_authenticators())
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return {}
+
+    async def _fetch_authenticators(self) -> dict[str, "OktaAuthenticator"]:
+        # `list_authenticators` is non-paginated in the SDK (no `after`
+        # parameter); inline the tuple unwrap rather than going through
+        # `paginate`. Same shape `application_service` uses for
+        # `get_first_party_app_settings`.
+        result: dict[str, OktaAuthenticator] = {}
+        sdk_result = await self.client.list_authenticators()
+        err = sdk_result[-1]
+        if err is not None:
+            logger.error(f"Error listing authenticators: {err}")
+            return result
+        items = sdk_result[0] or []
+
+        for authenticator in items:
+            auth_obj = self._build_authenticator(authenticator)
+            result[auth_obj.id] = auth_obj
+        return result
+
+    @staticmethod
+    def _build_password_policy(policy) -> "PasswordPolicy":
+        settings = getattr(policy, "settings", None)
+        password_settings = getattr(settings, "password", None) if settings else None
+        lockout = (
+            getattr(password_settings, "lockout", None) if password_settings else None
+        )
+        complexity = (
+            getattr(password_settings, "complexity", None)
+            if password_settings
+            else None
+        )
+        dictionary = getattr(complexity, "dictionary", None) if complexity else None
+        common = getattr(dictionary, "common", None) if dictionary else None
+        age = getattr(password_settings, "age", None) if password_settings else None
+        policy_id = _value(getattr(policy, "id", None))
+        return PasswordPolicy(
+            id=policy_id,
+            name=_value(getattr(policy, "name", None)) or policy_id,
+            status=_value(getattr(policy, "status", None)),
+            priority=_int_or_none(getattr(policy, "priority", None)),
+            is_default=bool(getattr(policy, "system", False)),
+            max_attempts=_int_or_none(getattr(lockout, "max_attempts", None)),
+            min_length=_int_or_none(getattr(complexity, "min_length", None)),
+            min_upper_case=_int_or_none(getattr(complexity, "min_upper_case", None)),
+            min_lower_case=_int_or_none(getattr(complexity, "min_lower_case", None)),
+            min_number=_int_or_none(getattr(complexity, "min_number", None)),
+            min_symbol=_int_or_none(getattr(complexity, "min_symbol", None)),
+            min_age_minutes=_int_or_none(getattr(age, "min_age_minutes", None)),
+            max_age_days=_int_or_none(getattr(age, "max_age_days", None)),
+            history_count=_int_or_none(getattr(age, "history_count", None)),
+            common_password_check=_bool_or_none(getattr(common, "exclude", None)),
+        )
+
+    @staticmethod
+    def _build_authenticator(authenticator) -> "OktaAuthenticator":
+        settings = getattr(authenticator, "settings", None)
+        compliance = getattr(settings, "compliance", None) if settings else None
+        auth_id = _value(getattr(authenticator, "id", None))
+        return OktaAuthenticator(
+            id=auth_id,
+            key=_value(getattr(authenticator, "key", None)),
+            name=_value(getattr(authenticator, "name", None)) or auth_id,
+            status=_value(getattr(authenticator, "status", None)),
+            type=_value(getattr(authenticator, "type", None)),
+            fips=_value(getattr(compliance, "fips", None)),
+        )
+
+
+class PasswordPolicy(BaseModel):
+    """Normalized Okta Password Policy settings used by checks."""
+
+    id: str
+    name: str
+    status: str = ""
+    priority: Optional[int] = None
+    is_default: bool = False
+    max_attempts: Optional[int] = None
+    min_length: Optional[int] = None
+    min_upper_case: Optional[int] = None
+    min_lower_case: Optional[int] = None
+    min_number: Optional[int] = None
+    min_symbol: Optional[int] = None
+    min_age_minutes: Optional[int] = None
+    max_age_days: Optional[int] = None
+    history_count: Optional[int] = None
+    common_password_check: Optional[bool] = None
+
+
+class OktaAuthenticator(BaseModel):
+    """Normalized Okta Authenticator settings used by checks."""
+
+    id: str
+    key: str
+    name: str
+    status: str = ""
+    type: str = ""
+    fips: str = ""
+
+
+class AuthenticatorSummary(BaseModel):
+    """Synthetic resource for org-level authenticator findings."""
+
+    id: str
+    name: str
diff --git a/prowler/providers/okta/services/authenticator/authenticator_smart_card_active/__init__.py b/prowler/providers/okta/services/authenticator/authenticator_smart_card_active/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/authenticator_smart_card_active/authenticator_smart_card_active.metadata.json b/prowler/providers/okta/services/authenticator/authenticator_smart_card_active/authenticator_smart_card_active.metadata.json
new file mode 100644
index 0000000000..b8e93ae548
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_smart_card_active/authenticator_smart_card_active.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "authenticator_smart_card_active",
+  "CheckTitle": "Okta Smart Card IdP authenticator is configured and active",
+  "CheckType": [],
+  "ServiceName": "authenticator",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "The **Smart Card IdP authenticator** (`smart_card_idp`) must exist in the org and be in the `ACTIVE` status so certificate-based authentication is available to users and apps that require it.\n\nThe check resolves the authenticator by its built-in `key`. Missing and inactive authenticators surface as distinct FAIL findings.",
+  "Risk": "Without an active Smart Card authenticator, users cannot satisfy mandated certificate-based authentication and may be forced onto weaker fallback paths.\n\n- **Mandated CAC/PIV use** cannot be enforced\n- **Compliance gaps** for environments that require X.509 certificate authentication\n- **Fallback to password-only** sign-in for affected groups",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/authenticator",
+    "https://help.okta.com/oie/en-us/Content/Topics/identity-engine/authenticators/smart-card-authenticator.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Authenticators**.\n3. If the **Smart Card IdP** authenticator is not listed, click **Add Authenticator** and add it.\n4. Open the authenticator and switch its status to **ACTIVE**.\n5. Bind it to the Authentication Policies that require certificate-based auth.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure the **Smart Card IdP** authenticator is:\n- Present in the org (`key = smart_card_idp`)\n- In the `ACTIVE` status\n- Referenced by every Authentication Policy that requires certificate-based authentication\n\nIf certificate-based authentication is not in scope for the organization, mute the check rather than disabling the authenticator.",
+      "Url": "https://hub.prowler.com/check/authenticator_smart_card_active"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273204 / OKTA-APP-001670."
+}
diff --git a/prowler/providers/okta/services/authenticator/authenticator_smart_card_active/authenticator_smart_card_active.py b/prowler/providers/okta/services/authenticator/authenticator_smart_card_active/authenticator_smart_card_active.py
new file mode 100644
index 0000000000..4341db8612
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/authenticator_smart_card_active/authenticator_smart_card_active.py
@@ -0,0 +1,56 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_client import (
+    authenticator_client,
+)
+from prowler.providers.okta.services.authenticator.lib.authenticator_helpers import (
+    find_authenticator_by_key,
+    missing_authenticator_resource,
+    missing_authenticators_scope_finding,
+)
+
+
+class authenticator_smart_card_active(Check):
+    """STIG V-273204 / OKTA-APP-001670.
+
+    The check requires Okta to configure and activate the Smart Card (PIV) authenticator.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate the Smart Card IdP authenticator status."""
+        org_domain = authenticator_client.provider.identity.org_domain
+        missing_scope = authenticator_client.missing_scope.get("authenticators")
+        if missing_scope:
+            return [
+                missing_authenticators_scope_finding(
+                    self.metadata(),
+                    org_domain,
+                    "smart_card_idp",
+                    "Smart Card IdP authenticator",
+                    missing_scope,
+                )
+            ]
+
+        authenticator = find_authenticator_by_key(
+            authenticator_client.authenticators, "smart_card_idp"
+        )
+        resource = authenticator or missing_authenticator_resource(
+            "smart_card_idp", "Smart Card IdP authenticator"
+        )
+        report = CheckReportOkta(
+            metadata=self.metadata(), resource=resource, org_domain=org_domain
+        )
+        if authenticator and authenticator.status.upper() == "ACTIVE":
+            report.status = "PASS"
+            report.status_extended = "Smart Card IdP authenticator is ACTIVE."
+        elif authenticator:
+            report.status = "FAIL"
+            report.status_extended = (
+                f"Smart Card IdP authenticator is not active; current status is "
+                f"{authenticator.status}."
+            )
+        else:
+            report.status = "FAIL"
+            report.status_extended = (
+                "Smart Card IdP authenticator is not active or missing."
+            )
+        return [report]
diff --git a/prowler/providers/okta/services/authenticator/lib/__init__.py b/prowler/providers/okta/services/authenticator/lib/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/authenticator/lib/authenticator_helpers.py b/prowler/providers/okta/services/authenticator/lib/authenticator_helpers.py
new file mode 100644
index 0000000000..851daec5a8
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/lib/authenticator_helpers.py
@@ -0,0 +1,49 @@
+from prowler.lib.check.models import CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_service import (
+    AuthenticatorSummary,
+    OktaAuthenticator,
+)
+
+_SCOPE_ADVICE = (
+    "Grant it on the Okta API Scopes tab of the service app in the Okta Admin "
+    "Console, then re-run the check."
+)
+
+
+def find_authenticator_by_key(
+    authenticators: dict[str, OktaAuthenticator], key: str
+) -> OktaAuthenticator | None:
+    """Return the first authenticator with the requested key.
+
+    Okta enforces unique authenticator `key` values per org for built-in
+    types (`okta_verify`, `smart_card_idp`, etc.), so the "first match"
+    is the only match in practice. If a future Okta release relaxes
+    that and returns duplicates, only the first is evaluated — STIG
+    semantics need refining at that point.
+    """
+    for authenticator in authenticators.values():
+        if authenticator.key == key:
+            return authenticator
+    return None
+
+
+def missing_authenticator_resource(key: str, name: str) -> AuthenticatorSummary:
+    """Build a synthetic resource for a missing authenticator."""
+    return AuthenticatorSummary(id=f"{key}-missing", name=name)
+
+
+def missing_authenticators_scope_finding(
+    metadata, org_domain: str, key: str, name: str, scope: str
+) -> CheckReportOkta:
+    """Build the MANUAL finding emitted when authenticators cannot be listed."""
+    resource = AuthenticatorSummary(id=f"{key}-scope-missing", name=name)
+    report = CheckReportOkta(
+        metadata=metadata, resource=resource, org_domain=org_domain
+    )
+    report.status = "MANUAL"
+    report.status_extended = (
+        f"Could not retrieve Okta authenticators to evaluate {name}: the Okta "
+        f"service app is missing the required `{scope}` API scope. "
+        f"{_SCOPE_ADVICE}"
+    )
+    return report
diff --git a/prowler/providers/okta/services/authenticator/lib/password_policy_helpers.py b/prowler/providers/okta/services/authenticator/lib/password_policy_helpers.py
new file mode 100644
index 0000000000..08aa64a3a6
--- /dev/null
+++ b/prowler/providers/okta/services/authenticator/lib/password_policy_helpers.py
@@ -0,0 +1,80 @@
+from prowler.lib.check.models import CheckReportOkta
+from prowler.providers.okta.services.authenticator.authenticator_service import (
+    PasswordPolicy,
+)
+
+_SCOPE_ADVICE = (
+    "Grant it on the Okta API Scopes tab of the service app in the Okta Admin "
+    "Console, then re-run the check."
+)
+
+
+def active_password_policies(
+    password_policies: dict[str, PasswordPolicy],
+) -> list[PasswordPolicy]:
+    """Return active password policies sorted by priority.
+
+    Treats `policy.status == ""` as ACTIVE: the typed Okta SDK
+    occasionally returns policies without a `status` field populated
+    (the SDK enum doesn't cover every server-side value Okta has
+    shipped). Dropping those would silently hide real policies — we
+    'd rather evaluate them and let the per-field comparator decide.
+    """
+    return sorted(
+        [
+            policy
+            for policy in password_policies.values()
+            if not policy.status or policy.status.upper() == "ACTIVE"
+        ],
+        key=lambda policy: (
+            policy.priority if policy.priority is not None else float("inf"),
+            policy.name,
+        ),
+    )
+
+
+def password_policy_label(policy: PasswordPolicy) -> str:
+    kind = "default" if policy.is_default else "custom"
+    priority = policy.priority if policy.priority is not None else "unset"
+    return f"Password Policy {policy.name} (priority {priority}, {kind})"
+
+
+def no_active_password_policies_finding(
+    metadata, org_domain: str, requirement: str
+) -> CheckReportOkta:
+    """Build the FAIL finding emitted when no active password policies exist."""
+    placeholder = PasswordPolicy(
+        id="password-policies-missing",
+        name="(no active password policies)",
+        status="MISSING",
+    )
+    report = CheckReportOkta(
+        metadata=metadata, resource=placeholder, org_domain=org_domain
+    )
+    report.status = "FAIL"
+    report.status_extended = (
+        "No active Okta Password Policies were returned by the API. "
+        f"The organization must enforce: {requirement}."
+    )
+    return report
+
+
+def missing_password_policies_scope_finding(
+    metadata, org_domain: str, scope: str, requirement: str
+) -> CheckReportOkta:
+    """Build the MANUAL finding emitted when Password Policies cannot be listed."""
+    placeholder = PasswordPolicy(
+        id="password-policies-scope-missing",
+        name="(scope not granted)",
+        status="UNKNOWN",
+    )
+    report = CheckReportOkta(
+        metadata=metadata, resource=placeholder, org_domain=org_domain
+    )
+    report.status = "MANUAL"
+    report.status_extended = (
+        f"Could not retrieve Okta Password Policies to evaluate {requirement}: "
+        f"the Okta service app is missing the required `{scope}` API scope. "
+        f"{_SCOPE_ADVICE}"
+    )
+    return report
diff --git a/prowler/providers/okta/services/idp/__init__.py b/prowler/providers/okta/services/idp/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/idp/idp_client.py b/prowler/providers/okta/services/idp/idp_client.py
new file mode 100644
index 0000000000..5bbf98c17a
--- /dev/null
+++ b/prowler/providers/okta/services/idp/idp_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.okta.services.idp.idp_service import Idp
+
+idp_client = Idp(Provider.get_global_provider())
diff --git a/prowler/providers/okta/services/idp/idp_service.py b/prowler/providers/okta/services/idp/idp_service.py
new file mode 100644
index 0000000000..2ff106cb47
--- /dev/null
+++ b/prowler/providers/okta/services/idp/idp_service.py
@@ -0,0 +1,118 @@
+from typing import Optional
+
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.okta.lib.service.pagination import paginate
+from prowler.providers.okta.lib.service.service import OktaService
+
+# Okta's API value for the "Smart Card" IdP shown in the Admin Console.
+# The UI label is "Smart Card IdP" but the `type` field on the API response
+# is `X509` (Mutual TLS) — that is the value we filter on.
+SMART_CARD_IDP_TYPE = "X509"
+
+REQUIRED_SCOPES: dict[str, str] = {
+    "identity_providers": "okta.idps.read",
+}
+
+
+class Idp(OktaService):
+    """Fetches Okta Identity Providers.
+
+    Populates `self.identity_providers` keyed by IdP id. Each entry
+    captures the minimum fields the bundled checks read: identity
+    (`id`, `name`), `type`, `status`, and — for `X509` Smart Card IdPs
+    — the certificate-chain `issuer` and `kid` exposed by Okta's
+    `protocol.credentials.trust` structure. Reading the issuer DN lets
+    the check surface it for out-of-band verification against the
+    DOD-approved CA list.
+
+    Required OAuth scopes (`REQUIRED_SCOPES`) are compared against the
+    access token's granted scopes (`provider.identity.granted_scopes`).
+    Missing scopes are recorded in `self.missing_scope` so the check
+    can emit an explicit MANUAL finding.
+    """
+
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        granted = set(getattr(provider.identity, "granted_scopes", None) or [])
+        self.missing_scope: dict[str, Optional[str]] = {
+            resource: (scope if granted and scope not in granted else None)
+            for resource, scope in REQUIRED_SCOPES.items()
+        }
+
+        self.identity_providers: dict[str, OktaIdentityProvider] = (
+            {}
+            if self.missing_scope["identity_providers"]
+            else self._list_identity_providers()
+        )
+
+    def _list_identity_providers(self) -> dict:
+        logger.info("Idp - Listing Okta Identity Providers...")
+        try:
+            return self._run(self._fetch_identity_providers())
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return {}
+
+    async def _fetch_identity_providers(self) -> dict:
+        result: dict[str, OktaIdentityProvider] = {}
+        all_idps, err = await paginate(
+            lambda after: self.client.list_identity_providers(after=after)
+        )
+        if err is not None:
+            logger.error(f"Error listing identity providers: {err}")
+            return result
+
+        for idp in all_idps:
+            idp_id = getattr(idp, "id", "") or ""
+            if not idp_id:
+                continue
+            issuer, kid = _trust_fields(idp)
+            result[idp_id] = OktaIdentityProvider(
+                id=idp_id,
+                name=getattr(idp, "name", "") or "",
+                type=_stringify_enum(getattr(idp, "type", None)) or "",
+                status=_stringify_enum(getattr(idp, "status", None)) or "",
+                trust_issuer=issuer,
+                trust_kid=kid,
+            )
+        return result
+
+
+def _trust_fields(idp) -> tuple[Optional[str], Optional[str]]:
+    """Extract `issuer` and `kid` from an `X509` IdP's protocol.credentials.trust.
+
+    The SDK exposes `IdentityProvider.protocol` as `IdentityProviderProtocol`,
+    a Pydantic v2 oneOf wrapper that holds the concrete protocol (ProtocolMtls
+    for X509 IdPs) on `actual_instance`. `credentials` is not proxied on the
+    wrapper, so reading it directly returns None — we have to unwrap first.
+    """
+    protocol = getattr(idp, "protocol", None)
+    if protocol is None:
+        return None, None
+    actual_protocol = getattr(protocol, "actual_instance", None) or protocol
+    credentials = getattr(actual_protocol, "credentials", None)
+    if credentials is None:
+        return None, None
+    trust = getattr(credentials, "trust", None)
+    if trust is None:
+        return None, None
+    return getattr(trust, "issuer", None), getattr(trust, "kid", None)
+
+
+def _stringify_enum(value) -> Optional[str]:
+    if value is None:
+        return None
+    return getattr(value, "value", None) or str(value)
+
+
+class OktaIdentityProvider(BaseModel):
+    id: str
+    name: str = ""
+    type: str = ""
+    status: str = ""
+    trust_issuer: Optional[str] = None
+    trust_kid: Optional[str] = None
diff --git a/prowler/providers/okta/services/idp/idp_smart_card_dod_approved_ca/__init__.py b/prowler/providers/okta/services/idp/idp_smart_card_dod_approved_ca/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/idp/idp_smart_card_dod_approved_ca/idp_smart_card_dod_approved_ca.metadata.json b/prowler/providers/okta/services/idp/idp_smart_card_dod_approved_ca/idp_smart_card_dod_approved_ca.metadata.json
new file mode 100644
index 0000000000..e7e85294be
--- /dev/null
+++ b/prowler/providers/okta/services/idp/idp_smart_card_dod_approved_ca/idp_smart_card_dod_approved_ca.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "idp_smart_card_dod_approved_ca",
+  "CheckTitle": "Okta Smart Card (X509) Identity Provider uses a DOD-approved certificate authority",
+  "CheckType": [],
+  "ServiceName": "idp",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every Okta Smart Card (X509) Identity Provider must be `ACTIVE` and its certificate chain must be issued by a DOD-approved CA. The check ships default issuer-DN patterns covering DOD PKI and ECA, and matches them against the chain's `issuer`. Override or extend via `okta_dod_approved_ca_issuer_patterns` in the audit config to recognise tenant-specific DOD CAs.",
+  "Risk": "An Okta Smart Card IdP whose certificate chain is not issued by a DOD-approved CA can be used to authenticate non-vetted identities.\n\n- **Trust on an unverified CA** allows impersonation of CAC/PIV holders\n- **Bypass of the federal PKI** required for DOD-grade identity assurance\n- **Acceptance of certificates** from a private or unaccredited issuer",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://help.okta.com/en-us/content/topics/security/idp-enable-smart-card.htm",
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Security** > **Identity Providers**.\n3. For each IdP whose **Type** is **Smart Card**, click **Actions** > **Configure**.\n4. Under **Certificate chain**, verify the certificate is from a DOD-approved Certificate Authority (DOD PKI, ECA, JITC, or equivalent).\n5. If the IdP is not **Active**, activate it once the chain is validated.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Verify each Okta Smart Card (X509) Identity Provider is ACTIVE and its certificate chain is issued by a DOD-approved Certificate Authority. Document the issuer for audit evidence.",
+      "Url": "https://hub.prowler.com/check/idp_smart_card_dod_approved_ca"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273207 / OKTA-APP-001920."
+}
diff --git a/prowler/providers/okta/services/idp/idp_smart_card_dod_approved_ca/idp_smart_card_dod_approved_ca.py b/prowler/providers/okta/services/idp/idp_smart_card_dod_approved_ca/idp_smart_card_dod_approved_ca.py
new file mode 100644
index 0000000000..5d19cca0dd
--- /dev/null
+++ b/prowler/providers/okta/services/idp/idp_smart_card_dod_approved_ca/idp_smart_card_dod_approved_ca.py
@@ -0,0 +1,148 @@
+import re
+
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.idp.idp_client import idp_client
+from prowler.providers.okta.services.idp.idp_service import (
+    SMART_CARD_IDP_TYPE,
+    OktaIdentityProvider,
+)
+from prowler.providers.okta.services.idp.lib.idp_helpers import (
+    missing_idps_scope_finding,
+)
+
+# Default issuer-DN substring patterns recognised as DOD-approved Certificate
+# Authorities. The DOD PKI publishes canonical DN forms that include
+# `O=U.S. Government, OU=DoD` (for DoD Root, DoD ID, DoD EMAIL, DoD SW, DoD
+# JITC CAs) and `O=U.S. Government, OU=ECA` for the External Certificate
+# Authorities. Customers running an internal CA outside these patterns can
+# extend the list via the `okta_dod_approved_ca_issuer_patterns` audit-config
+# entry — see the per-check Notes in metadata.json.
+DEFAULT_DOD_CA_ISSUER_PATTERNS = (
+    # `OU=DoD` is the distinctive DISA DN component for every CA in the DoD
+    # PKI (Root, ID, EMAIL, SW, JITC). `OU=ECA` is the equivalent for the
+    # External Certificate Authorities. The trailing `\b` prevents accidental
+    # matches against superstrings like `OU=DoDExtra`.
+    r"\bOU=DoD\b",
+    r"\bOU=ECA\b",
+)
+
+
+class idp_smart_card_dod_approved_ca(Check):
+    """Verifies that Okta Smart Card (X509) IdPs are configured and use a DOD-approved CA.
+
+    PASS when the IdP is `ACTIVE` and its certificate chain's `issuer`
+    DN matches one of the configured DOD-approved CA patterns. MANUAL
+    when active but the issuer doesn't match (operator can verify
+    out-of-band or extend the pattern list). FAIL when no Smart Card
+    IdP is configured or when the configured IdP is inactive.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        findings: list[CheckReportOkta] = []
+        org_domain = idp_client.provider.identity.org_domain
+        audit_config = idp_client.audit_config or {}
+        configured_patterns = audit_config.get("okta_dod_approved_ca_issuer_patterns")
+        patterns = (
+            tuple(configured_patterns)
+            if configured_patterns
+            else DEFAULT_DOD_CA_ISSUER_PATTERNS
+        )
+
+        missing_scope = idp_client.missing_scope.get("identity_providers")
+        if missing_scope:
+            findings.append(
+                missing_idps_scope_finding(self.metadata(), org_domain, missing_scope)
+            )
+            return findings
+
+        smart_card_idps = [
+            idp
+            for idp in idp_client.identity_providers.values()
+            if (idp.type or "").upper() == SMART_CARD_IDP_TYPE
+        ]
+
+        if not smart_card_idps:
+            placeholder = OktaIdentityProvider(
+                id="okta-smart-card-idp-missing",
+                name="(no Smart Card IdP configured)",
+                type=SMART_CARD_IDP_TYPE,
+                status="MISSING",
+            )
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=placeholder, org_domain=org_domain
+            )
+            report.status = "FAIL"
+            report.status_extended = (
+                "No Smart Card (X509) Identity Providers are configured. "
+                "Configure a Smart Card IdP in the Admin Console "
+                "(Security > Identity Providers) with a certificate chain "
+                "issued by a DOD-approved CA. If CAC/PIV authentication is "
+                "not required for this tenant, mutelist this check with "
+                "that documented exception."
+            )
+            findings.append(report)
+            return findings
+
+        for idp in smart_card_idps:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=idp, org_domain=org_domain
+            )
+            label = f"Okta Smart Card IdP '{idp.name}' (id={idp.id}, type={idp.type})"
+            chain_detail = _format_chain_detail(idp)
+
+            if (idp.status or "").upper() != "ACTIVE":
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"{label} is not ACTIVE (status={idp.status or 'unset'}). "
+                    "Activate the IdP from Security > Identity Providers, then "
+                    f"verify the certificate chain. {chain_detail}"
+                )
+                findings.append(report)
+                continue
+
+            matched_pattern = _matched_issuer_pattern(idp.trust_issuer, patterns)
+            if matched_pattern is not None:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"{label} is ACTIVE and its chain issuer matches a "
+                    f"DOD-approved CA pattern (`{matched_pattern}`). "
+                    f"{chain_detail}"
+                )
+            else:
+                report.status = "MANUAL"
+                report.status_extended = (
+                    f"{label} is ACTIVE but its chain issuer does not match any "
+                    "configured DOD-approved CA pattern. Verify out-of-band "
+                    "that the certificate chain belongs to a DOD-approved "
+                    "Certificate Authority, or extend "
+                    "`okta_dod_approved_ca_issuer_patterns` in the audit "
+                    f"config. {chain_detail}"
+                )
+            findings.append(report)
+        return findings
+
+
+def _matched_issuer_pattern(issuer, patterns):
+    if not issuer:
+        return None
+    for pattern in patterns:
+        try:
+            if re.search(pattern, issuer):
+                return pattern
+        except re.error:
+            # Skip malformed operator-supplied patterns rather than crashing
+            # the whole check.
+            continue
+    return None
+
+
+def _format_chain_detail(idp: OktaIdentityProvider) -> str:
+    if idp.trust_issuer or idp.trust_kid:
+        return (
+            f"Chain issuer: {idp.trust_issuer or 'unset'}; "
+            f"kid: {idp.trust_kid or 'unset'}."
+        )
+    return (
+        "Chain issuer and kid were not exposed by the API; inspect the IdP in "
+        "the Admin Console under Security > Identity Providers > Configure."
+    )
diff --git a/prowler/providers/okta/services/idp/lib/__init__.py b/prowler/providers/okta/services/idp/lib/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/idp/lib/idp_helpers.py b/prowler/providers/okta/services/idp/lib/idp_helpers.py
new file mode 100644
index 0000000000..f1689f34a1
--- /dev/null
+++ b/prowler/providers/okta/services/idp/lib/idp_helpers.py
@@ -0,0 +1,26 @@
+"""Shared helpers for the OKTA idp STIG checks."""
+
+from prowler.lib.check.models import CheckReportOkta
+from prowler.providers.okta.services.idp.idp_service import OktaIdentityProvider
+
+
+def missing_idps_scope_finding(
+    metadata, org_domain: str, scope: str
+) -> CheckReportOkta:
+    """Build the MANUAL finding when the IdPs scope is not granted."""
+    placeholder = OktaIdentityProvider(
+        id="okta-idps-scope-missing",
+        name="(scope not granted)",
+        status="MISSING",
+    )
+    report = CheckReportOkta(
+        metadata=metadata, resource=placeholder, org_domain=org_domain
+    )
+    report.status = "MANUAL"
+    report.status_extended = (
+        "Could not retrieve Okta Identity Providers: the Okta service app is "
+        f"missing the required `{scope}` API scope. Grant it on the service "
+        "app's Okta API Scopes tab in the Okta Admin Console, then re-run the "
+        "check."
+    )
+    return report
diff --git a/prowler/providers/okta/services/network/__init__.py b/prowler/providers/okta/services/network/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/network/lib/__init__.py b/prowler/providers/okta/services/network/lib/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/network/lib/network_zone_helpers.py b/prowler/providers/okta/services/network/lib/network_zone_helpers.py
new file mode 100644
index 0000000000..bcd906b01a
--- /dev/null
+++ b/prowler/providers/okta/services/network/lib/network_zone_helpers.py
@@ -0,0 +1,88 @@
+from prowler.lib.check.models import CheckReportOkta
+from prowler.providers.okta.services.network.network_zone_service import (
+    NetworkZoneSummary,
+    OktaNetworkZone,
+)
+
+ANONYMIZER_CATEGORY_MARKERS = (
+    "ANONYM",
+    "PROXY",
+    "TOR",
+    "VPN",
+)
+
+
+def active_blocklist_zones(
+    network_zones: dict[str, OktaNetworkZone],
+) -> list[OktaNetworkZone]:
+    """Return active Network Zones configured for blocklist usage."""
+    return sorted(
+        [
+            zone
+            for zone in network_zones.values()
+            if zone.status.upper() == "ACTIVE" and zone.usage.upper() == "BLOCKLIST"
+        ],
+        key=lambda zone: (zone.name, zone.id),
+    )
+
+
+def is_ip_blocklist_with_entries(zone: OktaNetworkZone) -> bool:
+    """Return True when an IP blocklist zone contains gateway/proxy entries."""
+    return zone.type.upper() == "IP" and bool(zone.gateways or zone.proxies)
+
+
+def is_enhanced_dynamic_anonymizer_blocklist(zone: OktaNetworkZone) -> bool:
+    """Return True for active Enhanced Dynamic blocklists covering anonymizers."""
+    if zone.type.upper() != "DYNAMIC_V2":
+        return False
+    categories = [category.upper() for category in zone.ip_service_categories]
+    return any(
+        marker in category
+        for category in categories
+        for marker in ANONYMIZER_CATEGORY_MARKERS
+    )
+
+
+def compliant_anonymized_proxy_blocklist(
+    network_zones: dict[str, OktaNetworkZone],
+) -> tuple[OktaNetworkZone | None, str]:
+    """Find the Network Zone that satisfies anonymized-proxy blocklisting."""
+    for zone in active_blocklist_zones(network_zones):
+        if is_enhanced_dynamic_anonymizer_blocklist(zone):
+            return zone, "active Enhanced Dynamic Zone blocklist for anonymizers"
+    return None, ""
+
+
+def static_ip_blocklist_evidence(
+    network_zones: dict[str, OktaNetworkZone],
+) -> OktaNetworkZone | None:
+    """Return static IP blocklist evidence that requires human validation."""
+    for zone in active_blocklist_zones(network_zones):
+        if is_ip_blocklist_with_entries(zone):
+            return zone
+    return None
+
+
+_SCOPE_ADVICE = (
+    "Grant it on the Okta API Scopes tab of the service app in the Okta Admin "
+    "Console, then re-run the check."
+)
+
+
+def missing_network_zone_scope_finding(
+    metadata, org_domain: str, scope: str
+) -> CheckReportOkta:
+    """Build the MANUAL finding emitted when Network Zones cannot be listed."""
+    resource = NetworkZoneSummary(
+        id="network-zones-scope-missing",
+        name="(scope not granted)",
+    )
+    report = CheckReportOkta(
+        metadata=metadata, resource=resource, org_domain=org_domain
+    )
+    report.status = "MANUAL"
+    report.status_extended = (
+        f"Could not retrieve Okta Network Zones: the Okta service app "
+        f"is missing the required `{scope}` API scope. {_SCOPE_ADVICE}"
+    )
+    return report
diff --git a/prowler/providers/okta/services/network/network_zone_block_anonymized_proxies/__init__.py b/prowler/providers/okta/services/network/network_zone_block_anonymized_proxies/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/network/network_zone_block_anonymized_proxies/network_zone_block_anonymized_proxies.metadata.json b/prowler/providers/okta/services/network/network_zone_block_anonymized_proxies/network_zone_block_anonymized_proxies.metadata.json
new file mode 100644
index 0000000000..d2a4791c17
--- /dev/null
+++ b/prowler/providers/okta/services/network/network_zone_block_anonymized_proxies/network_zone_block_anonymized_proxies.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "network_zone_block_anonymized_proxies",
+  "CheckTitle": "Okta uses active Network Zone blocklists for anonymized proxy sources",
+  "CheckType": [],
+  "ServiceName": "network",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "network",
+  "Description": "**Okta Network Zone blocklists** should block anonymized proxy access before authentication. Enhanced Dynamic Zone anonymizer categories provide direct coverage; static IP blocklists show gateway/proxy blocking but cannot prove full anonymizer-provider coverage.",
+  "Risk": "**Anonymized proxy access** lets attackers hide source networks while attempting credential attacks, session establishment, or policy bypass from untrusted infrastructure.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tags/networkzone",
+    "https://help.okta.com/en-us/content/topics/security/network/about-enhanced-dynamic-zones.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "Security > Networks: configure BlockedIpZone gateway/proxy IP entries or activate DefaultEnhancedDynamicZone / Enhanced Dynamic Zone blocklisting for anonymizers.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "**Prefer an active Enhanced Dynamic Zone blocklist** for anonymizers. If you use a static IP Network Zone blocklist, keep gateway/proxy entries actively maintained because Prowler cannot prove full anonymizer-provider coverage from static entries alone.",
+      "Url": "https://hub.prowler.com/check/network_zone_block_anonymized_proxies"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/okta/services/network/network_zone_block_anonymized_proxies/network_zone_block_anonymized_proxies.py b/prowler/providers/okta/services/network/network_zone_block_anonymized_proxies/network_zone_block_anonymized_proxies.py
new file mode 100644
index 0000000000..3da973b415
--- /dev/null
+++ b/prowler/providers/okta/services/network/network_zone_block_anonymized_proxies/network_zone_block_anonymized_proxies.py
@@ -0,0 +1,77 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.network.lib.network_zone_helpers import (
+    compliant_anonymized_proxy_blocklist,
+    missing_network_zone_scope_finding,
+    static_ip_blocklist_evidence,
+)
+from prowler.providers.okta.services.network.network_zone_client import (
+    network_zone_client,
+)
+from prowler.providers.okta.services.network.network_zone_service import (
+    NetworkZoneSummary,
+)
+
+
+class network_zone_block_anonymized_proxies(Check):
+    """Ensure Okta actively blocks anonymized proxy sources before auth."""
+
+    def execute(self) -> list[CheckReportOkta]:
+        """Evaluate whether an active blocklist covers anonymized proxies."""
+        org_domain = network_zone_client.provider.identity.org_domain
+        missing_scope = network_zone_client.missing_scope.get("network_zones")
+        if missing_scope:
+            return [
+                missing_network_zone_scope_finding(
+                    self.metadata(), org_domain, missing_scope
+                )
+            ]
+
+        retrieval_error = getattr(network_zone_client, "retrieval_error", None)
+        if retrieval_error:
+            resource = NetworkZoneSummary(
+                id="network-zones-retrieval-error",
+                name="(retrieval failed)",
+            )
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=resource, org_domain=org_domain
+            )
+            report.status = "MANUAL"
+            report.status_extended = (
+                "Okta Network Zones could not be retrieved or validated. "
+                f"Reason: {retrieval_error}"
+            )
+            return [report]
+
+        matching_zone, reason = compliant_anonymized_proxy_blocklist(
+            network_zone_client.network_zones
+        )
+        manual_zone = (
+            None
+            if matching_zone
+            else static_ip_blocklist_evidence(network_zone_client.network_zones)
+        )
+
+        resource = matching_zone or manual_zone or NetworkZoneSummary()
+        report = CheckReportOkta(
+            metadata=self.metadata(), resource=resource, org_domain=org_domain
+        )
+        if matching_zone:
+            report.status = "PASS"
+            report.status_extended = (
+                f"Okta Network Zone {matching_zone.name} is an {reason}."
+            )
+        elif manual_zone:
+            report.status = "MANUAL"
+            report.status_extended = (
+                f"Okta Network Zone {manual_zone.name} is an active manual IP "
+                "blocklist with gateway or proxy IP entries; Prowler cannot "
+                "verify full anonymizer coverage for static entries."
+            )
+        else:
+            report.status = "FAIL"
+            report.status_extended = (
+                "No active Okta Network Zone blocklist was found that blocks "
+                "anonymized proxies. Existing zones do not actively block gateway "
+                "or proxy IPs, nor an Enhanced Dynamic Zone anonymizer category."
+            )
+        return [report]
diff --git a/prowler/providers/okta/services/network/network_zone_client.py b/prowler/providers/okta/services/network/network_zone_client.py
new file mode 100644
index 0000000000..6d4f603f80
--- /dev/null
+++ b/prowler/providers/okta/services/network/network_zone_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.okta.services.network.network_zone_service import NetworkZone
+
+network_zone_client = NetworkZone(Provider.get_global_provider())
diff --git a/prowler/providers/okta/services/network/network_zone_service.py b/prowler/providers/okta/services/network/network_zone_service.py
new file mode 100644
index 0000000000..550c9b0d49
--- /dev/null
+++ b/prowler/providers/okta/services/network/network_zone_service.py
@@ -0,0 +1,234 @@
+from typing import Optional
+
+from pydantic import BaseModel, Field, ValidationError
+
+from prowler.lib.logger import logger
+from prowler.providers.okta.lib.service.pagination import paginate as _paginate_shared
+from prowler.providers.okta.lib.service.raw_fetch import (
+    get_json_paginated as _raw_get_json_paginated,
+)
+from prowler.providers.okta.lib.service.service import OktaService
+
+REQUIRED_SCOPES: dict[str, str] = {
+    "network_zones": "okta.networkZones.read",
+}
+
+
+def _value(value) -> str:
+    """Return plain string values from Okta SDK enums and raw strings."""
+    if value is None:
+        return ""
+    enum_value = getattr(value, "value", None)
+    if enum_value is not None:
+        return str(enum_value)
+    return str(value)
+
+
+class NetworkZone(OktaService):
+    """Fetches Okta Network Zones for STIG network-zone checks."""
+
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        granted = set(getattr(provider.identity, "granted_scopes", None) or [])
+        self.missing_scope: dict[str, Optional[str]] = {
+            resource: (scope if granted and scope not in granted else None)
+            for resource, scope in REQUIRED_SCOPES.items()
+        }
+        self.retrieval_error: str | None = None
+        self.network_zones: dict[str, OktaNetworkZone] = (
+            {} if self.missing_scope["network_zones"] else self._list_network_zones()
+        )
+
+    def _set_retrieval_error(self, message: str) -> None:
+        self.retrieval_error = message
+        logger.error(message)
+
+    def _list_network_zones(self) -> dict[str, "OktaNetworkZone"]:
+        """List all Network Zones visible to the configured Okta service app."""
+        logger.info("NetworkZone - Listing Okta Network Zones...")
+        try:
+            return self._run(self._fetch_all())
+        except Exception as error:
+            line_number = getattr(error.__traceback__, "tb_lineno", "unknown")
+            self._set_retrieval_error(
+                f"{error.__class__.__name__}[{line_number}]: {error}"
+            )
+            return {}
+
+    async def _fetch_all(self) -> dict[str, "OktaNetworkZone"]:
+        result: dict[str, OktaNetworkZone] = {}
+        try:
+            all_zones, err = await _paginate_shared(
+                lambda after: self.client.list_network_zones(after=after, limit=200)
+            )
+        except (ValueError, ValidationError) as ex:
+            # Upstream Okta SDK ↔ Management API schema drift: the SDK
+            # generates `EnhancedDynamicNetworkZoneAllOfAsnsInclude` as an
+            # object-shaped pydantic model, but the API returns
+            # `asns.include` as a JSON array (typically `[]`), so pydantic
+            # rejects the whole zone with `model_type` errors. Fall back
+            # to a raw-JSON fetch so STIG evaluation isn't blocked by an
+            # upstream SDK bug. Same workaround shape as
+            # `application_service._fetch_access_policy_raw`. The wider
+            # `(ValueError, ValidationError)` catch matches the
+            # `user_service` precedent — the SDK raises either depending
+            # on whether the failure is a discriminator miss or a model
+            # mismatch.
+            logger.warning(
+                f"Okta SDK raised {type(ex).__name__} parsing Network Zones — "
+                "falling back to raw-JSON parse. This is an okta-sdk-python "
+                "deserialization bug; the workaround should be removed once "
+                "upstream fixes it."
+            )
+            return await self._fetch_all_raw()
+        if err is not None:
+            self._set_retrieval_error(f"Error listing Network Zones: {err}")
+            return result
+
+        for zone in all_zones:
+            zone_obj = self._build_zone(zone)
+            result[zone_obj.id] = zone_obj
+        return result
+
+    async def _fetch_all_raw(self) -> dict[str, "OktaNetworkZone"]:
+        """Raw-JSON fallback for `list_network_zones`.
+
+        Bypasses the SDK's typed deserialization via the shared
+        `get_json_paginated` helper, then projects each zone onto our
+        own pydantic snapshot — which only validates the fields the
+        STIG checks actually read.
+        """
+        result: dict[str, OktaNetworkZone] = {}
+        zones_data = await _raw_get_json_paginated(
+            self.client,
+            "/api/v1/zones",
+            page_size=200,
+            context="Network Zones",
+        )
+        if zones_data is None:
+            self._set_retrieval_error(
+                "Raw Network Zones fetch failed; see logs for details."
+            )
+            return result
+        for zone_dict in zones_data:
+            if not isinstance(zone_dict, dict):
+                continue
+            zone_obj = _raw_zone_to_model(zone_dict)
+            result[zone_obj.id] = zone_obj
+        return result
+
+    @staticmethod
+    def _build_zone(zone) -> "OktaNetworkZone":
+        zone_id = _value(getattr(zone, "id", None))
+        return OktaNetworkZone(
+            id=zone_id,
+            name=_value(getattr(zone, "name", None)) or zone_id,
+            status=_value(getattr(zone, "status", None)),
+            type=_value(getattr(zone, "type", None)),
+            usage=_value(getattr(zone, "usage", None)),
+            system=bool(getattr(zone, "system", False)),
+            gateways=_address_values(getattr(zone, "gateways", None)),
+            proxies=_address_values(getattr(zone, "proxies", None)),
+            asns=_condition_values(getattr(zone, "asns", None)),
+            locations=_condition_values(getattr(zone, "locations", None)),
+            ip_service_categories=_condition_values(
+                getattr(zone, "ip_service_categories", None)
+            ),
+        )
+
+
+def _raw_zone_to_model(zone_dict: dict) -> "OktaNetworkZone":
+    """Project a raw `/api/v1/zones` JSON zone onto our model.
+
+    Mirrors `NetworkZone._build_zone` but reads camelCase JSON keys
+    (`ipServiceCategories`) instead of the SDK's snake_case attributes.
+    Used by the raw-JSON fallback that activates when the Okta SDK's
+    strict pydantic validators reject zone payloads the Management API
+    returns (e.g. Enhanced Dynamic Zones with `asns.include: []`).
+    """
+    zone_id = str(zone_dict.get("id") or "")
+    categories = _condition_values(zone_dict.get("ipServiceCategories"))
+    # IP-typed zones return `gateways`/`proxies` as `[{type, value}]`
+    # arrays; Enhanced Dynamic Zones return `asns`/`locations` and
+    # `ipServiceCategories` as `{include, exclude}` objects. Keep the
+    # `list[str]` shape by extracting address values and included
+    # condition values from both SDK models and raw JSON.
+    return OktaNetworkZone(
+        id=zone_id,
+        name=str(zone_dict.get("name") or zone_id),
+        status=str(zone_dict.get("status") or ""),
+        type=str(zone_dict.get("type") or ""),
+        usage=str(zone_dict.get("usage") or ""),
+        system=bool(zone_dict.get("system", False)),
+        gateways=_address_values(zone_dict.get("gateways")),
+        proxies=_address_values(zone_dict.get("proxies")),
+        asns=_condition_values(zone_dict.get("asns")),
+        locations=_condition_values(zone_dict.get("locations")),
+        ip_service_categories=categories,
+    )
+
+
+def _address_values(raw) -> list[str]:
+    """Return string values from an Okta address-style JSON array.
+
+    Each entry in `gateways`/`proxies` is `{"type": ..., "value": ...}`;
+    `asns`/`locations` may be a `{include, exclude}` object on Enhanced
+    Dynamic Zones. Non-list inputs collapse to `[]` so the resulting
+    list satisfies the pydantic `list[str]` field.
+    """
+    if not isinstance(raw, list):
+        return []
+    out: list[str] = []
+    for entry in raw:
+        if isinstance(entry, dict):
+            value = entry.get("value")
+        elif entry is not None:
+            value = getattr(entry, "value", entry)
+        else:
+            value = None
+        if value is not None:
+            out.append(_value(value))
+    return out
+
+
+def _condition_values(raw) -> list[str]:
+    """Return string values from Okta include/exclude-style conditions."""
+    if raw is None:
+        return []
+    values = (
+        raw.get("include") if isinstance(raw, dict) else getattr(raw, "include", raw)
+    )
+    if values is None:
+        return []
+    if not isinstance(values, list):
+        values = [values]
+    normalized = []
+    for value in values:
+        if isinstance(value, dict):
+            value = value.get("value")
+        if value is not None:
+            normalized.append(_value(value))
+    return normalized
+
+
+class OktaNetworkZone(BaseModel):
+    """Normalized Okta Network Zone attributes used by checks."""
+
+    id: str
+    name: str
+    status: str = ""
+    type: str = ""
+    usage: str = ""
+    system: bool = False
+    gateways: list[str] = Field(default_factory=list)
+    proxies: list[str] = Field(default_factory=list)
+    asns: list[str] = Field(default_factory=list)
+    locations: list[str] = Field(default_factory=list)
+    ip_service_categories: list[str] = Field(default_factory=list)
+
+
+class NetworkZoneSummary(BaseModel):
+    """Synthetic resource for org-level Network Zone findings."""
+
+    id: str = "okta-network-zones"
+    name: str = "Okta Network Zones"
diff --git a/prowler/providers/okta/services/signon/signon_service.py b/prowler/providers/okta/services/signon/signon_service.py
index 7c32363501..663e9cf187 100644
--- a/prowler/providers/okta/services/signon/signon_service.py
+++ b/prowler/providers/okta/services/signon/signon_service.py
@@ -1,34 +1,11 @@
 from typing import Optional
-from urllib.parse import parse_qs, urlparse
 
 from pydantic import BaseModel
 
 from prowler.lib.logger import logger
+from prowler.providers.okta.lib.service.pagination import paginate as _paginate_shared
 from prowler.providers.okta.lib.service.service import OktaService
 
-
-def _next_after_cursor(resp) -> Optional[str]:
-    """Extract the `after` cursor from a `Link: ...; rel="next"` header.
-
-    Returns None when there is no next page. Header format follows RFC 5988
-    and Okta's pagination guide.
-    """
-    if resp is None:
-        return None
-    headers = getattr(resp, "headers", None) or {}
-    link = headers.get("link") or headers.get("Link") or ""
-    if not link:
-        return None
-    for part in link.split(","):
-        if 'rel="next"' not in part:
-            continue
-        url_segment = part.split(";", 1)[0].strip().lstrip("<").rstrip(">")
-        cursor = parse_qs(urlparse(url_segment).query).get("after", [None])[0]
-        if cursor:
-            return cursor
-    return None
-
-
 REQUIRED_SCOPES: dict[str, str] = {
     "global_session_policies": "okta.policies.read",
     "sign_in_pages": "okta.brands.read",
@@ -228,33 +205,7 @@ class Signon(OktaService):
 
     @staticmethod
     async def _paginate(fetch):
-        """Drain all pages of an SDK list call.
-
-        `fetch` is a callable that takes the `after` cursor (or None for
-        the first page) and returns the SDK's standard `(items, resp, err)`
-        tuple. We follow `Link: rel="next"` headers until exhausted.
-        """
-        all_items = []
-        result = await fetch(None)
-        # Defensive against the SDK's 2-tuple early-error path: error is last.
-        err = result[-1]
-        if err is not None:
-            return [], err
-        items = result[0]
-        resp = result[1] if len(result) >= 3 else None
-        all_items.extend(items or [])
-        while True:
-            cursor = _next_after_cursor(resp)
-            if not cursor:
-                break
-            result = await fetch(cursor)
-            err = result[-1]
-            if err is not None:
-                return all_items, err
-            items = result[0]
-            resp = result[1] if len(result) >= 3 else None
-            all_items.extend(items or [])
-        return all_items, None
+        return await _paginate_shared(fetch)
 
 
 class GlobalSessionPolicyRule(BaseModel):
diff --git a/prowler/providers/okta/services/systemlog/__init__.py b/prowler/providers/okta/services/systemlog/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/systemlog/lib/__init__.py b/prowler/providers/okta/services/systemlog/lib/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/systemlog/lib/systemlog_helpers.py b/prowler/providers/okta/services/systemlog/lib/systemlog_helpers.py
new file mode 100644
index 0000000000..e82cedff5f
--- /dev/null
+++ b/prowler/providers/okta/services/systemlog/lib/systemlog_helpers.py
@@ -0,0 +1,26 @@
+"""Shared helpers for the OKTA systemlog STIG checks."""
+
+from prowler.lib.check.models import CheckReportOkta
+from prowler.providers.okta.services.systemlog.systemlog_service import LogStream
+
+
+def missing_log_streams_scope_finding(
+    metadata, org_domain: str, scope: str
+) -> CheckReportOkta:
+    """Build the MANUAL finding when the log-streams scope is not granted."""
+    placeholder = LogStream(
+        id="okta-log-streams-scope-missing",
+        name="(scope not granted)",
+        status="MISSING",
+        type="",
+    )
+    report = CheckReportOkta(
+        metadata=metadata, resource=placeholder, org_domain=org_domain
+    )
+    report.status = "MANUAL"
+    report.status_extended = (
+        "Could not retrieve Okta Log Streams: the Okta service app is missing "
+        f"the required `{scope}` API scope. Grant it on the service app's "
+        "Okta API Scopes tab in the Okta Admin Console, then re-run the check."
+    )
+    return report
diff --git a/prowler/providers/okta/services/systemlog/systemlog_client.py b/prowler/providers/okta/services/systemlog/systemlog_client.py
new file mode 100644
index 0000000000..3dc0a1a0af
--- /dev/null
+++ b/prowler/providers/okta/services/systemlog/systemlog_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.okta.services.systemlog.systemlog_service import SystemLog
+
+systemlog_client = SystemLog(Provider.get_global_provider())
diff --git a/prowler/providers/okta/services/systemlog/systemlog_service.py b/prowler/providers/okta/services/systemlog/systemlog_service.py
new file mode 100644
index 0000000000..96c8b6d7ae
--- /dev/null
+++ b/prowler/providers/okta/services/systemlog/systemlog_service.py
@@ -0,0 +1,136 @@
+from typing import Optional
+
+from pydantic import BaseModel, ValidationError
+
+from prowler.lib.logger import logger
+from prowler.providers.okta.lib.service.pagination import paginate
+from prowler.providers.okta.lib.service.raw_fetch import (
+    get_json_paginated as raw_get_json_paginated,
+)
+from prowler.providers.okta.lib.service.service import OktaService
+
+REQUIRED_SCOPES: dict[str, str] = {
+    "log_streams": "okta.logStreams.read",
+}
+
+
+class SystemLog(OktaService):
+    """Fetches Okta Log Stream configurations.
+
+    Populates `self.log_streams` keyed by Log Stream id. Each entry
+    carries `name`, `status`, `type` — enough for the streaming-enabled
+    check to evaluate whether the tenant has off-loaded audit records
+    to an external SIEM/event bus.
+
+    Required OAuth scopes (`REQUIRED_SCOPES`) are compared against the
+    access token's granted scopes (`provider.identity.granted_scopes`).
+    Missing scopes are recorded in `self.missing_scope` so the check
+    can emit an explicit MANUAL finding instead of a misleading
+    "no resources returned".
+    """
+
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        granted = set(getattr(provider.identity, "granted_scopes", None) or [])
+        self.missing_scope: dict[str, Optional[str]] = {
+            resource: (scope if granted and scope not in granted else None)
+            for resource, scope in REQUIRED_SCOPES.items()
+        }
+
+        self.log_streams: dict[str, LogStream] = (
+            {} if self.missing_scope["log_streams"] else self._list_log_streams()
+        )
+
+    def _list_log_streams(self) -> dict:
+        logger.info("SystemLog - Listing Okta Log Streams...")
+        try:
+            return self._run(self._fetch_log_streams())
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return {}
+
+    async def _fetch_log_streams(self) -> dict:
+        result: dict[str, LogStream] = {}
+        try:
+            all_streams, err = await paginate(
+                lambda after: self.client.list_log_streams(after=after)
+            )
+        except ValidationError as ve:
+            # Upstream okta-sdk-python bug: e.g. `LogStreamSettingsAws`'s
+            # `eventSourceName` validator regex is `^[a-zA-Z0-9.\-_]$` —
+            # missing the `+` quantifier, so it rejects every
+            # multi-character name. Fall back to raw JSON so the check
+            # can still evaluate the tenant's actual log-stream state.
+            # Remove this workaround once okta-sdk-python fixes the
+            # validator (issue to be filed upstream).
+            logger.warning(
+                f"Okta SDK raised ValidationError parsing log streams "
+                f"({ve.error_count()} error(s)) — falling back to raw-JSON "
+                "parse. This is an okta-sdk-python deserialization bug."
+            )
+            return await self._fetch_log_streams_raw()
+
+        if err is not None:
+            logger.error(f"Error listing log streams: {err}")
+            return result
+
+        for stream in all_streams:
+            stream_id = getattr(stream, "id", "") or ""
+            if not stream_id:
+                continue
+            result[stream_id] = LogStream(
+                id=stream_id,
+                name=getattr(stream, "name", "") or "",
+                status=getattr(stream, "status", "") or "",
+                type=_stringify_enum(getattr(stream, "type", None)) or "",
+            )
+        return result
+
+    async def _fetch_log_streams_raw(self) -> dict:
+        """Raw-JSON fallback for `list_log_streams`.
+
+        Bypasses the SDK's typed deserialization via the shared
+        `get_json_paginated` helper (which follows the `Link: rel=next`
+        cursor so tenants with >200 streams are not silently truncated),
+        and projects the response onto our own pydantic snapshot which
+        only validates the four fields the check reads. Keeps the check
+        evaluable on tenants whose Log Stream settings happen to trip
+        an SDK enum/regex validator.
+        """
+        result: dict[str, LogStream] = {}
+        data = await raw_get_json_paginated(
+            self.client,
+            "/api/v1/logStreams",
+            page_size=200,
+            context="log streams",
+        )
+        if data is None:
+            return result
+        for item in data:
+            if not isinstance(item, dict):
+                continue
+            stream_id = item.get("id")
+            if not stream_id:
+                continue
+            result[stream_id] = LogStream(
+                id=stream_id,
+                name=item.get("name") or "",
+                status=(item.get("status") or "").upper(),
+                type=item.get("type") or "",
+            )
+        return result
+
+
+def _stringify_enum(value) -> Optional[str]:
+    if value is None:
+        return None
+    return getattr(value, "value", None) or str(value)
+
+
+class LogStream(BaseModel):
+    id: str
+    name: str = ""
+    status: str = ""
+    type: str = ""
diff --git a/prowler/providers/okta/services/systemlog/systemlog_streaming_enabled/__init__.py b/prowler/providers/okta/services/systemlog/systemlog_streaming_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/systemlog/systemlog_streaming_enabled/systemlog_streaming_enabled.metadata.json b/prowler/providers/okta/services/systemlog/systemlog_streaming_enabled/systemlog_streaming_enabled.metadata.json
new file mode 100644
index 0000000000..27541ee2fe
--- /dev/null
+++ b/prowler/providers/okta/services/systemlog/systemlog_streaming_enabled/systemlog_streaming_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "okta",
+  "CheckID": "systemlog_streaming_enabled",
+  "CheckTitle": "Okta off-loads audit records to a central log server via Log Streaming",
+  "CheckType": [],
+  "ServiceName": "systemlog",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "monitoring",
+  "Description": "Okta must off-load audit records to a central log server. At least one **Log Stream** (AWS EventBridge, Splunk Cloud, etc.) must be configured and `ACTIVE` in the tenant. Alternatively, an external SIEM pulling the System Log API can satisfy the requirement, but that pull-based path is verified manually.",
+  "Risk": "Audit records stored only inside the Okta tenant are exposed to accidental or incidental deletion or alteration.\n\n- **No central retention** of authentication events for incident investigations\n- **Single point of failure** for the audit trail\n- **No correlation** with other identity, network, and endpoint telemetry in the SIEM",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://help.okta.com/en-us/content/topics/reports/log-streaming/about-log-streams.htm",
+    "https://developer.okta.com/docs/api/openapi/okta-management/management/tag/LogStream/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Reports** > **Log Streaming**.\n3. Click **Add Log Stream** and select **AWS EventBridge**, **Splunk Cloud**, or another supported destination.\n4. Complete the connection fields and save.\n5. Activate the stream and verify the destination receives events.\n6. If the destination SIEM is not natively supported, document the pull-based ingestion that uses the System Log API.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure at least one ACTIVE Okta Log Stream that off-loads audit records to a central SIEM (AWS EventBridge, Splunk Cloud, or another supported destination). Document any alternative pull-based ingestion via the System Log API.",
+      "Url": "https://hub.prowler.com/check/systemlog_streaming_enabled"
+    }
+  },
+  "Categories": [
+    "logging"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273202 / OKTA-APP-001430."
+}
diff --git a/prowler/providers/okta/services/systemlog/systemlog_streaming_enabled/systemlog_streaming_enabled.py b/prowler/providers/okta/services/systemlog/systemlog_streaming_enabled/systemlog_streaming_enabled.py
new file mode 100644
index 0000000000..61448aeaf5
--- /dev/null
+++ b/prowler/providers/okta/services/systemlog/systemlog_streaming_enabled/systemlog_streaming_enabled.py
@@ -0,0 +1,88 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.systemlog.lib.systemlog_helpers import (
+    missing_log_streams_scope_finding,
+)
+from prowler.providers.okta.services.systemlog.systemlog_client import systemlog_client
+from prowler.providers.okta.services.systemlog.systemlog_service import LogStream
+
+
+class systemlog_streaming_enabled(Check):
+    """Verifies that at least one Okta Log Stream is configured and active.
+
+    Off-loading audit records to a central SIEM (AWS EventBridge, Splunk
+    Cloud, etc.) is the standard mechanism for centralised retention.
+    An alternative path — pulling the System Log API into an external
+    SIEM — is allowed by the requirement, but cannot be verified
+    automatically; this check emits a MANUAL note in that case.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        findings: list[CheckReportOkta] = []
+        org_domain = systemlog_client.provider.identity.org_domain
+
+        missing_scope = systemlog_client.missing_scope.get("log_streams")
+        if missing_scope:
+            findings.append(
+                missing_log_streams_scope_finding(
+                    self.metadata(), org_domain, missing_scope
+                )
+            )
+            return findings
+
+        active_streams = [
+            stream
+            for stream in systemlog_client.log_streams.values()
+            if not stream.status or stream.status.upper() == "ACTIVE"
+        ]
+
+        if not systemlog_client.log_streams:
+            placeholder = LogStream(
+                id="okta-log-streams-missing",
+                name="(no Log Streams configured)",
+                status="MISSING",
+                type="",
+            )
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=placeholder, org_domain=org_domain
+            )
+            report.status = "FAIL"
+            report.status_extended = (
+                "No Okta Log Streams are configured. Configure a Log Stream "
+                "(Reports > Log Streaming) to off-load audit records to a "
+                "central SIEM. If an external SIEM is already pulling logs "
+                "via the System Log API, mutelist this check with that "
+                "evidence."
+            )
+            findings.append(report)
+            return findings
+
+        if not active_streams:
+            placeholder = LogStream(
+                id="okta-log-streams-inactive",
+                name="(no active Log Streams)",
+                status="INACTIVE",
+                type="",
+            )
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=placeholder, org_domain=org_domain
+            )
+            report.status = "FAIL"
+            report.status_extended = (
+                f"{len(systemlog_client.log_streams)} Okta Log Stream(s) are "
+                "configured but none are ACTIVE. Activate a Log Stream to "
+                "off-load audit records to a central SIEM."
+            )
+            findings.append(report)
+            return findings
+
+        for stream in active_streams:
+            report = CheckReportOkta(
+                metadata=self.metadata(), resource=stream, org_domain=org_domain
+            )
+            report.status = "PASS"
+            report.status_extended = (
+                f"Okta Log Stream '{stream.name}' (type={stream.type or 'unset'}) "
+                "is ACTIVE and off-loads audit records to a central SIEM."
+            )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/okta/services/user/__init__.py b/prowler/providers/okta/services/user/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/user/lib/__init__.py b/prowler/providers/okta/services/user/lib/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/user/lib/user_helpers.py b/prowler/providers/okta/services/user/lib/user_helpers.py
new file mode 100644
index 0000000000..423801f2d8
--- /dev/null
+++ b/prowler/providers/okta/services/user/lib/user_helpers.py
@@ -0,0 +1,26 @@
+"""Shared helpers for the OKTA user STIG checks."""
+
+from prowler.lib.check.models import CheckReportOkta
+from prowler.providers.okta.services.user.user_service import UserAutomation
+
+
+def missing_user_scope_finding(
+    metadata, org_domain: str, scope: str
+) -> CheckReportOkta:
+    """Build the MANUAL finding when an OAuth scope is not granted."""
+    placeholder = UserAutomation(
+        id="okta-user-scope-missing",
+        name="(scope not granted)",
+        status="MISSING",
+    )
+    report = CheckReportOkta(
+        metadata=metadata, resource=placeholder, org_domain=org_domain
+    )
+    report.status = "MANUAL"
+    report.status_extended = (
+        f"Could not retrieve Okta user lifecycle automations: the Okta service "
+        f"app is missing the required `{scope}` API scope. Grant it on the "
+        "service app's Okta API Scopes tab in the Okta Admin Console, then "
+        "re-run the check."
+    )
+    return report
diff --git a/prowler/providers/okta/services/user/user_client.py b/prowler/providers/okta/services/user/user_client.py
new file mode 100644
index 0000000000..9a49fbdbac
--- /dev/null
+++ b/prowler/providers/okta/services/user/user_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.okta.services.user.user_service import User
+
+user_client = User(Provider.get_global_provider())
diff --git a/prowler/providers/okta/services/user/user_inactivity_automation_35d_enabled/__init__.py b/prowler/providers/okta/services/user/user_inactivity_automation_35d_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/okta/services/user/user_inactivity_automation_35d_enabled/user_inactivity_automation_35d_enabled.metadata.json b/prowler/providers/okta/services/user/user_inactivity_automation_35d_enabled/user_inactivity_automation_35d_enabled.metadata.json
new file mode 100644
index 0000000000..64f24d95ae
--- /dev/null
+++ b/prowler/providers/okta/services/user/user_inactivity_automation_35d_enabled/user_inactivity_automation_35d_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+  "Provider": "okta",
+  "CheckID": "user_inactivity_automation_35d_enabled",
+  "CheckTitle": "Okta automation suspends or deactivates users after 35 days of inactivity",
+  "CheckType": [],
+  "ServiceName": "user",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "An Okta **Workflows Automation** must disable inactive user accounts. The automation must be `ACTIVE`, on an `ACTIVE` schedule, evaluate `User Inactivity = 35 days` (or less), apply to a group covering every user, and trigger `Suspended` / `Deactivated` / `Deprovisioned`. Threshold override: `okta_user_inactivity_max_days`. N/A when user sourcing is delegated to Active Directory or LDAP.",
+  "Risk": "Inactive Okta accounts retained indefinitely give an attacker who exploits one undetected access to downstream applications.\n\n- **Account takeover via dormant identities** that no one is monitoring\n- **Lateral movement** through SSO sessions of forgotten users\n- **Stale entitlements** that survive role and policy reorganisations",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://help.okta.com/en-us/content/topics/automation-hooks/automations-main.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the **Okta Admin Console** as a *Super Admin*.\n2. Navigate to **Workflow** > **Automations** and click **Add Automation**.\n3. Name the automation (e.g., `User Inactivity`).\n4. Add a condition: select **User Inactivity in Okta** and enter `35` days.\n5. Configure the schedule to run daily and activate it.\n6. Apply the automation to a group that covers every user — typically `Everyone`.\n7. Add an action: **Change User lifecycle state in Okta** and choose `Suspended` (or `Deactivated`/`Deprovisioned`).\n8. Activate the automation.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Create an active Okta Workflows automation that runs daily, evaluates `User Inactivity in Okta = 35 days`, applies to a group covering every user, and changes the user lifecycle state to Suspended/Deactivated. If user sourcing is delegated to Active Directory or LDAP, document that the connected directory enforces this requirement instead.",
+      "Url": "https://hub.prowler.com/check/user_inactivity_automation_35d_enabled"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Aligns with DISA STIG V-273188 / OKTA-APP-000090."
+}
diff --git a/prowler/providers/okta/services/user/user_inactivity_automation_35d_enabled/user_inactivity_automation_35d_enabled.py b/prowler/providers/okta/services/user/user_inactivity_automation_35d_enabled/user_inactivity_automation_35d_enabled.py
new file mode 100644
index 0000000000..79e77c3f73
--- /dev/null
+++ b/prowler/providers/okta/services/user/user_inactivity_automation_35d_enabled/user_inactivity_automation_35d_enabled.py
@@ -0,0 +1,204 @@
+from prowler.lib.check.models import Check, CheckReportOkta
+from prowler.providers.okta.services.user.lib.user_helpers import (
+    missing_user_scope_finding,
+)
+from prowler.providers.okta.services.user.user_client import user_client
+from prowler.providers.okta.services.user.user_service import UserAutomation
+
+DEFAULT_INACTIVITY_DAYS = 35
+SUSPENSION_LIFECYCLE_ACTIONS = {"SUSPENDED", "DEACTIVATED", "DEPROVISIONED"}
+
+
+class user_inactivity_automation_35d_enabled(Check):
+    """Verifies that Okta suspends/deactivates users after 35 days of inactivity.
+
+    A Workflows Automation must exist with:
+    - status ACTIVE,
+    - schedule active,
+    - condition `User Inactivity in Okta = 35 days`,
+    - action that changes the user state to Suspended / Deactivated,
+    - applied to a group covering every user (typically `Everyone`).
+
+    When user sourcing is delegated to an external directory (Active
+    Directory or LDAP), the requirement is N/A on the Okta side — the
+    connected directory is expected to enforce inactivity-based
+    deactivation instead. Threshold override:
+    `okta_user_inactivity_max_days` in the audit config.
+    """
+
+    def execute(self) -> list[CheckReportOkta]:
+        findings: list[CheckReportOkta] = []
+        audit_config = user_client.audit_config or {}
+        threshold_days = audit_config.get(
+            "okta_user_inactivity_max_days", DEFAULT_INACTIVITY_DAYS
+        )
+        org_domain = user_client.provider.identity.org_domain
+
+        for scope_key in ("automations", "identity_providers"):
+            missing_scope = user_client.missing_scope.get(scope_key)
+            if missing_scope:
+                findings.append(
+                    missing_user_scope_finding(
+                        self.metadata(), org_domain, missing_scope
+                    )
+                )
+                return findings
+
+        # External-directory N/A path.
+        if user_client.external_directory_idps:
+            idp_names = ", ".join(
+                f"'{idp.name}' (type={idp.type})"
+                for idp in user_client.external_directory_idps.values()
+            )
+            placeholder = UserAutomation(
+                id="okta-user-inactivity-na-external-directory",
+                name="(external directory enforces inactivity)",
+                status="N/A",
+            )
+            report = CheckReportOkta(
+                metadata=self.metadata(),
+                resource=placeholder,
+                org_domain=org_domain,
+            )
+            report.status = "MANUAL"
+            report.status_extended = (
+                "User sourcing is delegated to an external directory "
+                f"({idp_names}). The 35-day inactivity disable requirement is "
+                "expected to be enforced by the connected directory rather "
+                "than by an Okta automation. Confirm out-of-band that the "
+                "external directory disables accounts after "
+                f"{threshold_days} days of inactivity."
+            )
+            findings.append(report)
+            return findings
+
+        compliant_automations = [
+            automation
+            for automation in user_client.automations.values()
+            if _is_compliant(automation, threshold_days)
+        ]
+
+        if not user_client.automations:
+            placeholder = UserAutomation(
+                id="okta-user-inactivity-no-automations",
+                name="(no automations configured)",
+                status="MISSING",
+            )
+            report = CheckReportOkta(
+                metadata=self.metadata(),
+                resource=placeholder,
+                org_domain=org_domain,
+            )
+            report.status = "FAIL"
+            report.status_extended = (
+                "No Okta Workflows automations are configured. Create an "
+                "automation that suspends or deactivates users after "
+                f"{threshold_days} days of inactivity, scoped to a group "
+                "covering every user (typically 'Everyone'), with an active "
+                "schedule."
+            )
+            findings.append(report)
+            return findings
+
+        if compliant_automations:
+            for automation in compliant_automations:
+                report = CheckReportOkta(
+                    metadata=self.metadata(),
+                    resource=automation,
+                    org_domain=org_domain,
+                )
+                report.status = "PASS"
+                groups_label = ", ".join(automation.applies_to_groups)
+                report.status_extended = (
+                    f"Okta automation '{automation.name}' is ACTIVE with an "
+                    f"active schedule, triggers after "
+                    f"{automation.inactivity_days} days of inactivity, and "
+                    f"changes the user state to "
+                    f"{automation.lifecycle_action or 'unset'}. "
+                    f"Applied to group(s): {groups_label}. Verify that these "
+                    "group(s) cover every user. Okta has no built-in "
+                    "'Everyone' group ID, so tenant-wide coverage cannot be "
+                    "asserted automatically."
+                )
+                findings.append(report)
+            return findings
+
+        # Automations exist but none satisfy the predicate — surface the
+        # closest candidate for the auditor.
+        candidate = _closest_candidate(user_client.automations.values())
+        report = CheckReportOkta(
+            metadata=self.metadata(),
+            resource=candidate
+            or UserAutomation(
+                id="okta-user-inactivity-noncompliant",
+                name="(no compliant automation)",
+                status="MISSING",
+            ),
+            org_domain=org_domain,
+        )
+        report.status = "FAIL"
+        report.status_extended = _failure_message(candidate, threshold_days)
+        findings.append(report)
+        return findings
+
+
+def _is_compliant(automation: UserAutomation, threshold_days: int) -> bool:
+    # `applies_to_groups` must be non-empty — Okta USER_LIFECYCLE policies
+    # do not implicitly cover every user; the scope is whatever group IDs
+    # the operator put in `people.groups.include`. An empty scope means
+    # the automation runs against nobody. Operator must still verify those
+    # group(s) cover the intended user population (surfaced in the PASS
+    # status_extended).
+    return bool(
+        automation.status.upper() == "ACTIVE"
+        and automation.schedule_status.upper() == "ACTIVE"
+        and automation.inactivity_days is not None
+        and automation.inactivity_days <= threshold_days
+        and (automation.lifecycle_action or "").upper() in SUSPENSION_LIFECYCLE_ACTIONS
+        and bool(automation.applies_to_groups)
+    )
+
+
+def _closest_candidate(automations):
+    automations = list(automations)
+    if not automations:
+        return None
+    automations.sort(
+        key=lambda a: (
+            0 if a.status.upper() == "ACTIVE" else 1,
+            0 if a.schedule_status.upper() == "ACTIVE" else 1,
+            (
+                abs(a.inactivity_days - DEFAULT_INACTIVITY_DAYS)
+                if a.inactivity_days is not None
+                else 10_000
+            ),
+            a.name,
+        )
+    )
+    return automations[0]
+
+
+def _failure_message(automation, threshold_days):
+    if automation is None:
+        return f"No Okta automation enforces {threshold_days}-day inactivity disable."
+    issues = []
+    if automation.status.upper() != "ACTIVE":
+        issues.append(f"status {automation.status or 'unset'}")
+    if automation.schedule_status.upper() != "ACTIVE":
+        issues.append(f"schedule {automation.schedule_status or 'unset'}")
+    if automation.inactivity_days is None:
+        issues.append("no inactivity condition")
+    elif automation.inactivity_days > threshold_days:
+        issues.append(
+            f"inactivity {automation.inactivity_days}d (max {threshold_days}d)"
+        )
+    action = (automation.lifecycle_action or "").upper()
+    if action not in SUSPENSION_LIFECYCLE_ACTIONS:
+        issues.append(f"action {automation.lifecycle_action or 'unset'}")
+    if not automation.applies_to_groups:
+        issues.append("no group scope")
+    detail = ", ".join(issues) if issues else "incomplete"
+    return (
+        f"Okta automation '{automation.name}' fails {threshold_days}d "
+        f"inactivity: {detail}."
+    )
diff --git a/prowler/providers/okta/services/user/user_service.py b/prowler/providers/okta/services/user/user_service.py
new file mode 100644
index 0000000000..c816bd38ee
--- /dev/null
+++ b/prowler/providers/okta/services/user/user_service.py
@@ -0,0 +1,455 @@
+from typing import Optional
+
+from pydantic import BaseModel, ValidationError
+
+from prowler.lib.logger import logger
+from prowler.providers.okta.lib.service.pagination import paginate
+from prowler.providers.okta.lib.service.raw_fetch import (
+    get_json_paginated as raw_get_json_paginated,
+)
+from prowler.providers.okta.lib.service.service import OktaService
+
+# External-directory IdP `type` values that delegate user sourcing to a
+# separate identity store. When any of these is present and ACTIVE, the
+# STIG's 35-day inactivity disable requirement is N/A on the Okta side —
+# the connected directory is expected to enforce it instead.
+EXTERNAL_DIRECTORY_IDP_TYPES = {"ACTIVE_DIRECTORY", "LDAP"}
+
+# Okta exposes "Workflow > Automations" as USER_LIFECYCLE policies with
+# inactivity rule conditions, not as a standalone `/api/v1/automations`
+# resource. The SDK's `UserPolicyRuleCondition.inactivity` and
+# `ScheduledUserLifecycleAction` models confirm this; the API rejects
+# every other `type` candidate.
+USER_LIFECYCLE_POLICY_TYPE = "USER_LIFECYCLE"
+
+REQUIRED_SCOPES: dict[str, str] = {
+    "automations": "okta.policies.read",
+    "identity_providers": "okta.idps.read",
+}
+
+
+class User(OktaService):
+    """Fetches Okta User Lifecycle Automations and external-directory IdPs.
+
+    Populates:
+    - `self.automations` — keyed by USER_LIFECYCLE policy rule id. Each
+      entry projects the fields the 35-day inactivity check evaluates:
+      identity (`id`, `name` — taken from the rule), `status`,
+      `schedule_status` (inherited from the parent policy), the
+      `inactivity_days` condition and `applies_to_groups` scope from the
+      parent policy, and the `lifecycle_action` from the rule.
+    - `self.external_directory_idps` — keyed by IdP id. Used to short
+      circuit the STIG to N/A when user sourcing is delegated to an
+      external directory (Active Directory, LDAP).
+
+    The Okta Admin Console's "Workflow > Automations" page is rendered
+    on top of `USER_LIFECYCLE` policies in the Management API
+    (`list_policies(type='USER_LIFECYCLE')` + `list_policy_rules(...)`).
+    There is no standalone `/api/v1/automations` GET endpoint; the SDK's
+    `InactivityPolicyRuleCondition`, `UserPolicyRuleCondition`, and
+    `ScheduledUserLifecycleAction` models all hang off the policy API.
+
+    Required OAuth scopes (`REQUIRED_SCOPES`) are compared against the
+    access token's granted scopes (`provider.identity.granted_scopes`).
+    Missing scopes are recorded in `self.missing_scope` so the check
+    can emit an explicit MANUAL finding.
+    """
+
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        granted = set(getattr(provider.identity, "granted_scopes", None) or [])
+        self.missing_scope: dict[str, Optional[str]] = {
+            resource: (scope if granted and scope not in granted else None)
+            for resource, scope in REQUIRED_SCOPES.items()
+        }
+
+        self.automations: dict[str, UserAutomation] = (
+            {} if self.missing_scope["automations"] else self._list_automations()
+        )
+        self.external_directory_idps: dict[str, ExternalDirectoryIdp] = (
+            {}
+            if self.missing_scope["identity_providers"]
+            else self._list_external_directory_idps()
+        )
+
+    def _list_automations(self) -> dict:
+        logger.info("User - Listing USER_LIFECYCLE policies and rules...")
+        try:
+            return self._run(self._fetch_automations())
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return {}
+
+    async def _fetch_automations(self) -> dict:
+        result: dict[str, UserAutomation] = {}
+        try:
+            all_policies, err = await paginate(
+                lambda after: self.client.list_policies(
+                    type=USER_LIFECYCLE_POLICY_TYPE, after=after
+                )
+            )
+        except (ValueError, ValidationError) as ex:
+            # Upstream okta-sdk-python bug: `Policy.from_dict` uses a
+            # discriminator dispatch that maps `type` → concrete Policy
+            # subclass, and `USER_LIFECYCLE` is not in the map. The SDK
+            # raises ValueError ("failed to lookup discriminator value")
+            # even though the API returns a valid policy. Fall back to
+            # raw JSON. Remove once okta-sdk-python adds
+            # USER_LIFECYCLE → UserLifecyclePolicy to the mapping.
+            logger.warning(
+                f"Okta SDK raised {type(ex).__name__} parsing USER_LIFECYCLE "
+                "policies — falling back to raw-JSON parse. This is an "
+                "okta-sdk-python deserialization bug "
+                "(missing discriminator mapping)."
+            )
+            return await self._fetch_automations_raw()
+
+        if err is not None:
+            logger.error(f"Error listing USER_LIFECYCLE policies: {err}")
+            return result
+
+        for policy in all_policies:
+            policy_id = getattr(policy, "id", "") or ""
+            if not policy_id:
+                continue
+            policy_status = _stringify_enum(getattr(policy, "status", None)) or ""
+            policy_name = getattr(policy, "name", "") or ""
+            rules = await self._fetch_rules(policy_id)
+            if rules is None:
+                # Rule typed parsing tripped an SDK validator. Re-run the
+                # whole automation discovery via raw JSON so we don't lose
+                # the rule data for this — or any other — policy. Cheaper
+                # than mixing typed and raw projections.
+                logger.warning(
+                    f"Rule typed parsing failed for USER_LIFECYCLE policy "
+                    f"{policy_id} — re-running all automations via raw-JSON."
+                )
+                return await self._fetch_automations_raw()
+            if not rules:
+                # A policy with no rules exists in the Admin Console UI as
+                # an "Automation" the operator hasn't finished configuring
+                # (no conditions, no actions). Emit a placeholder so the
+                # check FAILs with a specific message naming every missing
+                # piece, instead of pretending the policy doesn't exist.
+                result[policy_id] = _shell_automation(
+                    policy_id, policy_name, policy_status
+                )
+                continue
+            for rule in rules:
+                automation = _rule_to_automation(rule, policy)
+                if automation is None:
+                    continue
+                result[automation.id] = automation
+        return result
+
+    async def _fetch_rules(self, policy_id: str) -> Optional[list]:
+        """Return the policy's typed rules, or None to signal raw fallback.
+
+        The Okta SDK's `list_policy_rules` shares the same brittle typed
+        deserialization as `list_policies` (strict pydantic validators
+        rejecting values the API actually returns). When that happens the
+        caller can't reuse any of the typed projection for this policy —
+        we return None as a sentinel and the caller re-runs the whole
+        discovery via `_fetch_automations_raw`. Returning `[]` would
+        otherwise misclassify the policy as an "unfinished automation"
+        and FAIL it.
+        """
+        rule_fetch_limit = 100
+        try:
+            result = await self.client.list_policy_rules(
+                policy_id, limit=str(rule_fetch_limit)
+            )
+        except (ValueError, ValidationError) as ex:
+            logger.warning(
+                f"Okta SDK raised {type(ex).__name__} parsing rules for "
+                f"USER_LIFECYCLE policy {policy_id} — signaling raw fallback."
+            )
+            return None
+        err = result[-1]
+        if err is not None:
+            logger.error(
+                f"Error listing rules for USER_LIFECYCLE policy {policy_id}: {err}"
+            )
+            return []
+        rules = list(result[0] or [])
+        if len(rules) >= rule_fetch_limit:
+            logger.warning(
+                f"USER_LIFECYCLE policy {policy_id} returned {len(rules)} rules — "
+                f"the per-policy fetch limit ({rule_fetch_limit}) was hit; any "
+                "rules beyond this limit are not evaluated."
+            )
+        return rules
+
+    async def _fetch_automations_raw(self) -> dict:
+        """Raw-JSON fallback for `list_policies(type='USER_LIFECYCLE')`.
+
+        Bypasses the SDK's typed deserialization via the shared
+        `get_json_paginated` helper, then drains each policy's rules
+        via the same path. Projects everything onto our `UserAutomation`
+        snapshot which only validates the fields the check reads.
+        """
+        result: dict[str, UserAutomation] = {}
+        policies_data = await raw_get_json_paginated(
+            self.client,
+            f"/api/v1/policies?type={USER_LIFECYCLE_POLICY_TYPE}",
+            page_size=200,
+            context="USER_LIFECYCLE policies",
+        )
+        if policies_data is None:
+            return result
+
+        for policy_dict in policies_data:
+            if not isinstance(policy_dict, dict):
+                continue
+            policy_id = policy_dict.get("id")
+            if not policy_id:
+                continue
+            policy_status = (policy_dict.get("status") or "").upper()
+            policy_name = policy_dict.get("name") or ""
+
+            rules_data = await raw_get_json_paginated(
+                self.client,
+                f"/api/v1/policies/{policy_id}/rules",
+                page_size=100,
+                context=f"USER_LIFECYCLE policy {policy_id} rules",
+            )
+            if not rules_data:
+                # No rules under the policy → emit placeholder. Same
+                # rationale as the typed path: surface the unfinished
+                # automation so the check can name what's missing.
+                result[policy_id] = _shell_automation(
+                    policy_id, policy_name, policy_status
+                )
+                continue
+            for rule_dict in rules_data:
+                automation = _raw_rule_to_automation(
+                    rule_dict, policy_dict, policy_id, policy_name, policy_status
+                )
+                if automation is None:
+                    continue
+                result[automation.id] = automation
+        return result
+
+    def _list_external_directory_idps(self) -> dict:
+        logger.info("User - Listing Okta IdPs for external-directory detection...")
+        try:
+            return self._run(self._fetch_external_directory_idps())
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return {}
+
+    async def _fetch_external_directory_idps(self) -> dict:
+        result: dict[str, ExternalDirectoryIdp] = {}
+        all_idps, err = await paginate(
+            lambda after: self.client.list_identity_providers(after=after)
+        )
+        if err is not None:
+            logger.error(f"Error listing identity providers: {err}")
+            return result
+
+        for idp in all_idps:
+            idp_type = _stringify_enum(getattr(idp, "type", None)) or ""
+            if idp_type.upper() not in EXTERNAL_DIRECTORY_IDP_TYPES:
+                continue
+            idp_status = _stringify_enum(getattr(idp, "status", None)) or ""
+            if idp_status.upper() != "ACTIVE":
+                continue
+            idp_id = getattr(idp, "id", "") or ""
+            if not idp_id:
+                continue
+            result[idp_id] = ExternalDirectoryIdp(
+                id=idp_id,
+                name=getattr(idp, "name", "") or "",
+                type=idp_type,
+                status=idp_status,
+            )
+        return result
+
+
+def _rule_to_automation(rule, policy) -> Optional["UserAutomation"]:
+    """Project a typed USER_LIFECYCLE policy + rule pair onto our snapshot.
+
+    Important: in the actual API response, an Okta "Automation" is split
+    across two resources — the **inactivity condition + group scope**
+    live on the *policy* (`policy.conditions.people.users.inactivity`,
+    `policy.conditions.people.groups.include`), and the **lifecycle
+    action** lives on the *rule* (`rule.actions.user_lifecycle.action`
+    on the typed model; `updateUserLifecycle.targetStatus` on raw JSON).
+    The rule's own `conditions` is typically empty. Projecting requires
+    both — kept aligned with `_raw_rule_to_automation` so the two paths
+    yield identical snapshots.
+    """
+    rule_id = getattr(rule, "id", "") or ""
+    if not rule_id:
+        return None
+
+    policy_id = getattr(policy, "id", "") or ""
+    policy_name = getattr(policy, "name", "") or ""
+    policy_status = (_stringify_enum(getattr(policy, "status", None)) or "").upper()
+
+    # Inactivity + groups live on the POLICY in the API response.
+    inactivity_days: Optional[int] = None
+    applies_to_groups: list[str] = []
+    conditions = getattr(policy, "conditions", None)
+    people = getattr(conditions, "people", None) if conditions else None
+    users = getattr(people, "users", None) if people else None
+    inactivity = getattr(users, "inactivity", None) if users else None
+    if inactivity is not None:
+        number = getattr(inactivity, "number", None)
+        unit = (_stringify_enum(getattr(inactivity, "unit", None)) or "").upper()
+        if isinstance(number, int) and unit in {"DAYS", "DAY"}:
+            inactivity_days = number
+    groups = getattr(people, "groups", None) if people else None
+    include_groups = getattr(groups, "include", None) if groups else None
+    if include_groups:
+        applies_to_groups = [str(g) for g in include_groups if g]
+
+    # Lifecycle action lives on the RULE.
+    actions = getattr(rule, "actions", None)
+    user_lifecycle = (
+        getattr(actions, "user_lifecycle", None) if actions else None
+    ) or (getattr(actions, "userLifecycle", None) if actions else None)
+    lifecycle_action: Optional[str] = None
+    if user_lifecycle is not None:
+        for attr in ("action", "status"):
+            value = _stringify_enum(getattr(user_lifecycle, attr, None))
+            if value:
+                lifecycle_action = value.upper()
+                break
+
+    rule_name = getattr(rule, "name", "") or policy_name or "(unnamed)"
+    rule_status = _stringify_enum(getattr(rule, "status", None)) or ""
+
+    return UserAutomation(
+        id=rule_id,
+        name=rule_name,
+        status=rule_status.upper(),
+        schedule_status=policy_status,
+        inactivity_days=inactivity_days,
+        lifecycle_action=lifecycle_action,
+        applies_to_groups=applies_to_groups,
+        policy_id=policy_id,
+        policy_name=policy_name,
+    )
+
+
+def _raw_rule_to_automation(
+    rule_dict,
+    policy_dict,
+    policy_id: str,
+    policy_name: str,
+    policy_status: str,
+) -> Optional["UserAutomation"]:
+    """Project a raw USER_LIFECYCLE policy+rule pair onto our snapshot.
+
+    Important: in the actual API response, an Okta "Automation" is split
+    across two resources — the **inactivity condition + group scope**
+    live on the *policy* (`policy.conditions.people.users.inactivity`,
+    `policy.conditions.people.groups.include`), and the **lifecycle
+    action** lives on the *rule*
+    (`rule.actions.updateUserLifecycle.targetStatus`). The rule's own
+    `conditions` is typically empty `{}`. Projecting requires both.
+
+    Schedule isn't exposed by the API on either resource. Okta runs an
+    automation on its UI-configured schedule iff the policy is ACTIVE,
+    so we treat `policy.status` as the schedule proxy.
+    """
+    if not isinstance(rule_dict, dict):
+        return None
+    rule_id = rule_dict.get("id")
+    if not rule_id:
+        return None
+
+    # Inactivity + groups live on the POLICY in the API response.
+    inactivity_days: Optional[int] = None
+    applies_to_groups: list[str] = []
+    if isinstance(policy_dict, dict):
+        policy_conditions = policy_dict.get("conditions") or {}
+        people = policy_conditions.get("people") or {}
+        users = people.get("users") or {}
+        inactivity = users.get("inactivity")
+        if isinstance(inactivity, dict):
+            number = inactivity.get("number")
+            unit = (inactivity.get("unit") or "").upper()
+            if isinstance(number, int) and unit in {"DAYS", "DAY"}:
+                inactivity_days = number
+        groups = people.get("groups") or {}
+        include_groups = groups.get("include")
+        if isinstance(include_groups, list):
+            applies_to_groups = [str(g) for g in include_groups if g]
+
+    # Lifecycle action lives on the RULE under
+    # `actions.updateUserLifecycle.targetStatus` (the API uses
+    # "updateUserLifecycle" rather than the SDK's `user_lifecycle`).
+    rule_actions = rule_dict.get("actions") or {}
+    update_user_lifecycle = rule_actions.get("updateUserLifecycle") or {}
+    lifecycle_action: Optional[str] = None
+    if isinstance(update_user_lifecycle, dict):
+        target = update_user_lifecycle.get("targetStatus")
+        if isinstance(target, str) and target:
+            lifecycle_action = target.upper()
+
+    return UserAutomation(
+        id=rule_id,
+        name=(rule_dict.get("name") or policy_name or "(unnamed)"),
+        status=(rule_dict.get("status") or "").upper(),
+        schedule_status=policy_status,
+        inactivity_days=inactivity_days,
+        lifecycle_action=lifecycle_action,
+        applies_to_groups=applies_to_groups,
+        policy_id=policy_id,
+        policy_name=policy_name,
+    )
+
+
+def _shell_automation(
+    policy_id: str, policy_name: str, policy_status: str
+) -> "UserAutomation":
+    """Placeholder UserAutomation for a USER_LIFECYCLE policy with no rules.
+
+    Surfaces the unfinished automation in `self.automations` so the check
+    can list every missing piece in its FAIL message (no inactivity
+    condition, no lifecycle action, status inactive, etc.) instead of
+    silently dropping the policy.
+    """
+    upper_status = (policy_status or "").upper()
+    return UserAutomation(
+        id=policy_id,
+        name=policy_name or "(unnamed automation)",
+        status=upper_status,
+        schedule_status=upper_status,
+        inactivity_days=None,
+        lifecycle_action=None,
+        applies_to_groups=[],
+        policy_id=policy_id,
+        policy_name=policy_name,
+    )
+
+
+def _stringify_enum(value) -> Optional[str]:
+    if value is None:
+        return None
+    return getattr(value, "value", None) or str(value)
+
+
+class UserAutomation(BaseModel):
+    id: str
+    name: str = ""
+    status: str = ""
+    schedule_status: str = ""
+    inactivity_days: Optional[int] = None
+    lifecycle_action: Optional[str] = None
+    applies_to_groups: list[str] = []
+    policy_id: str = ""
+    policy_name: str = ""
+
+
+class ExternalDirectoryIdp(BaseModel):
+    id: str
+    name: str = ""
+    type: str = ""
+    status: str = ""
diff --git a/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/__init__.py b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.metadata.json b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.metadata.json
new file mode 100644
index 0000000000..4e8f905658
--- /dev/null
+++ b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.metadata.json
@@ -0,0 +1,39 @@
+{
+  "Provider": "oraclecloud",
+  "CheckID": "identity_storage_service_level_admins_scoped",
+  "CheckTitle": "OCI IAM storage service-level admin policies exclude delete permissions",
+  "CheckType": [],
+  "ServiceName": "identity",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Policy",
+  "ResourceGroup": "IAM",
+  "Description": "**OCI IAM policies** are reviewed to ensure storage service-level administrator statements that grant `manage` permissions exclude the relevant storage delete permissions with `request.permission`. This supports CIS OCI 3.1 control 1.15 separation of duties for Block Volume, File Storage, and Object Storage administrators.",
+  "Risk": "Storage service-level administrators with unrestricted `manage` permissions can delete the resources they administer, including volumes, backups, file systems, mount targets, export sets, objects, or buckets. This weakens separation of duties and can lead to data loss, service disruption, or destructive insider activity.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.oracle.com/en-us/iaas/Content/Identity/policyreference/policyreference.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Block/home.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/File/home.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Object/home.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "oci iam policy update --policy-id <policy-ocid> --statements \"[\\\"Allow group VolumeUsers to manage volumes in tenancy where request.permission!='VOLUME_DELETE'\\\"]\"",
+      "NativeIaC": "",
+      "Other": "1. In OCI Console, go to Identity & Security > Policies\n2. Open each active policy that grants storage service-level administrators `manage` permissions\n3. Edit storage manage statements to exclude the relevant delete permission with `request.permission`\n4. Example: Allow group BucketUsers to manage buckets in tenancy where request.permission!='BUCKET_DELETE'\n5. Save changes",
+      "Terraform": "```hcl\nresource \"oci_identity_policy\" \"storage_admins\" {\n  compartment_id = var.compartment_id\n  name           = \"storage-admins\"\n  description    = \"Storage administrators without delete permissions\"\n\n  statements = [\n    \"Allow group VolumeUsers to manage volumes in tenancy where request.permission!='VOLUME_DELETE'\",\n    \"Allow group VolumeUsers to manage volume-backups in tenancy where request.permission!='VOLUME_BACKUP_DELETE'\",\n    \"Allow group FileUsers to manage file-systems in tenancy where request.permission!='FILE_SYSTEM_DELETE'\",\n    \"Allow group FileUsers to manage mount-targets in tenancy where request.permission!='MOUNT_TARGET_DELETE'\",\n    \"Allow group FileUsers to manage export-sets in tenancy where request.permission!='EXPORT_SET_DELETE'\",\n    \"Allow group BucketUsers to manage objects in tenancy where request.permission!='OBJECT_DELETE'\",\n    \"Allow group BucketUsers to manage buckets in tenancy where request.permission!='BUCKET_DELETE'\"\n  ]\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Exclude delete permissions from storage service-level administrator policies. Use `request.permission!='VOLUME_DELETE'`, `request.permission!='VOLUME_BACKUP_DELETE'`, `request.permission!='FILE_SYSTEM_DELETE'`, `request.permission!='MOUNT_TARGET_DELETE'`, `request.permission!='EXPORT_SET_DELETE'`, `request.permission!='OBJECT_DELETE'`, and `request.permission!='BUCKET_DELETE'` as appropriate for each storage manage statement.",
+      "Url": "https://hub.prowler.com/check/identity_storage_service_level_admins_scoped"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.py b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.py
new file mode 100644
index 0000000000..49ef16748a
--- /dev/null
+++ b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.py
@@ -0,0 +1,176 @@
+"""Check storage service-level administrators cannot delete managed resources."""
+
+import re
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.identity.identity_client import (
+    identity_client,
+)
+
+STORAGE_DELETE_PERMISSIONS_BY_RESOURCE = {
+    "volumes": {"VOLUME_DELETE"},
+    "volume-backups": {"VOLUME_BACKUP_DELETE"},
+    "file-systems": {"FILE_SYSTEM_DELETE"},
+    "mount-targets": {"MOUNT_TARGET_DELETE"},
+    "export-sets": {"EXPORT_SET_DELETE"},
+    "objects": {"OBJECT_DELETE"},
+    "buckets": {"BUCKET_DELETE"},
+    "volume-family": {"VOLUME_DELETE", "VOLUME_BACKUP_DELETE"},
+    "file-family": {"FILE_SYSTEM_DELETE", "MOUNT_TARGET_DELETE", "EXPORT_SET_DELETE"},
+    "object-family": {"OBJECT_DELETE", "BUCKET_DELETE"},
+}
+ALL_STORAGE_DELETE_PERMISSIONS = set().union(
+    *STORAGE_DELETE_PERMISSIONS_BY_RESOURCE.values()
+)
+STORAGE_DELETE_PERMISSIONS_BY_RESOURCE["all-resources"] = ALL_STORAGE_DELETE_PERMISSIONS
+
+MANAGE_STATEMENT_PATTERN = re.compile(
+    r"\ballow\s+group\b.+?\bto\s+manage\s+(?P<resource>[a-z-]+)\b",
+    re.IGNORECASE,
+)
+QUOTED_LITERAL_PATTERN = re.compile(r"'(?:\\.|[^'\\])*'|\"(?:\\.|[^\"\\])*\"")
+
+
+def _normalize_statement(statement: str) -> str:
+    """Collapse whitespace in an OCI policy statement."""
+    return " ".join(statement.strip().split())
+
+
+def _has_disjunctive_condition(statement: str) -> bool:
+    """Return True when the WHERE condition can allow alternate branches."""
+    condition = re.split(r"\bwhere\b", statement, flags=re.IGNORECASE, maxsplit=1)
+    if len(condition) != 2:
+        return False
+
+    condition_without_literals = QUOTED_LITERAL_PATTERN.sub("", condition[1])
+    return bool(
+        re.search(r"\b(any|or)\b|\|\|", condition_without_literals, re.IGNORECASE)
+    )
+
+
+def _storage_manage_resource(statement: str) -> str | None:
+    """Return the managed storage resource in a policy statement, if any."""
+    normalized_statement = _normalize_statement(statement)
+    match = MANAGE_STATEMENT_PATTERN.search(normalized_statement)
+    if not match:
+        return None
+
+    resource = match.group("resource").lower()
+    if resource not in STORAGE_DELETE_PERMISSIONS_BY_RESOURCE:
+        return None
+
+    return resource
+
+
+def _excluded_permissions(statement: str) -> set[str]:
+    """Return delete permissions explicitly excluded with request.permission != value."""
+    if _has_disjunctive_condition(statement):
+        return set()
+
+    exclusions = set()
+    for permission in ALL_STORAGE_DELETE_PERMISSIONS:
+        pattern = re.compile(
+            rf"\brequest\.permission\s*!=\s*['\"]?{re.escape(permission)}['\"]?\b",
+            re.IGNORECASE,
+        )
+        if pattern.search(statement):
+            exclusions.add(permission)
+    return exclusions
+
+
+def _missing_delete_exclusions(statement: str) -> tuple[str, set[str]] | None:
+    """Return the storage resource and missing delete exclusions for a statement."""
+    normalized_statement = _normalize_statement(statement)
+    resource = _storage_manage_resource(normalized_statement)
+    if not resource:
+        return None
+
+    required_permissions = STORAGE_DELETE_PERMISSIONS_BY_RESOURCE[resource]
+
+    excluded_permissions = _excluded_permissions(normalized_statement)
+    missing_permissions = required_permissions - excluded_permissions
+    if not missing_permissions:
+        return None
+
+    return resource, missing_permissions
+
+
+class identity_storage_service_level_admins_scoped(Check):
+    """Ensure storage service-level admins cannot delete resources they manage."""
+
+    def execute(self) -> list[Check_Report_OCI]:
+        """Execute the storage service-level administrators scoped check.
+
+        Returns:
+            A list of OCI check reports for active non-tenant-admin policies.
+        """
+        findings = []
+
+        for policy in identity_client.policies:
+            if policy.lifecycle_state != "ACTIVE":
+                continue
+
+            if policy.name.upper() == "TENANT ADMIN POLICY":
+                continue
+
+            region = policy.region if hasattr(policy, "region") else "global"
+            violations = []
+            has_storage_manage_statement = False
+
+            for statement in policy.statements:
+                if _storage_manage_resource(statement):
+                    has_storage_manage_statement = True
+
+                missing_result = _missing_delete_exclusions(statement)
+                if not missing_result:
+                    continue
+
+                resource, missing_permissions = missing_result
+                violations.append(
+                    f"statement `{_normalize_statement(statement)}` manages {resource} without excluding: {', '.join(sorted(missing_permissions))}"
+                )
+
+            if not has_storage_manage_statement:
+                continue
+
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=policy,
+                region=region,
+                resource_id=policy.id,
+                resource_name=policy.name,
+                compartment_id=policy.compartment_id,
+            )
+
+            if violations:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Policy '{policy.name}' allows storage service-level administrators to manage storage resources without explicitly excluding required delete permissions: "
+                    + "; ".join(violations)
+                    + "."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Policy '{policy.name}' excludes required storage delete permissions from storage manage statements."
+
+            findings.append(report)
+
+        if not findings:
+            region = (
+                identity_client.audited_regions[0].key
+                if identity_client.audited_regions
+                else "global"
+            )
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource={},
+                region=region,
+                resource_id=identity_client.audited_tenancy,
+                resource_name="Tenancy",
+                compartment_id=identity_client.audited_tenancy,
+            )
+            report.status = "PASS"
+            report.status_extended = "No active storage service-level administrator policies grant manage permissions without excluding delete permissions."
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/stackit/services/objectstorage/__init__.py b/prowler/providers/stackit/services/objectstorage/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/__init__.py b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.metadata.json b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.metadata.json
new file mode 100644
index 0000000000..38da16c5fa
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "stackit",
+  "CheckID": "objectstorage_access_key_expiration",
+  "CheckTitle": "ObjectStorage access keys should have an expiration date",
+  "CheckType": [],
+  "ServiceName": "objectstorage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "**ObjectStorage access keys** should have an explicit expiration date. Long-lived credentials increase the blast radius of a credential compromise because they cannot expire on their own. Setting an expiration date enforces periodic rotation and limits the exposure window if a key is leaked.",
+  "Risk": "If an **ObjectStorage access key** is leaked, stolen, or forgotten without an expiration date, it remains usable indefinitely. An attacker can retain persistent access to object storage resources until the key is manually revoked.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.stackit.cloud/products/storage/object-storage/",
+    "https://docs.stackit.cloud/products/storage/object-storage/how-tos/create-and-delete-object-storage-credentials/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. In the STACKIT Portal navigate to Object Storage > Access Keys. 2. Delete the non-expiring access key. 3. Create a new access key with an expiration date appropriate for your rotation policy (e.g. 90 days). 4. Update all applications and services that use the old key with the new credentials.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Create **ObjectStorage access keys** with an explicit expiration date and establish a rotation process. Delete non-expiring keys and replace them with time-limited credentials. A rotation period of **90 days or less** is recommended.",
+      "Url": "https://hub.prowler.com/check/objectstorage_access_key_expiration"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Access keys are scoped to credentials groups. This check evaluates all access keys across all credentials groups in the project."
+}
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.py b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.py
new file mode 100644
index 0000000000..2fb49ac725
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.py
@@ -0,0 +1,27 @@
+from prowler.lib.check.models import Check, CheckReportStackIT
+from prowler.providers.stackit.services.objectstorage.objectstorage_client import (
+    objectstorage_client,
+)
+
+
+class objectstorage_access_key_expiration(Check):
+    def execute(self):
+        findings = []
+        for key in objectstorage_client.access_keys:
+            report = CheckReportStackIT(
+                metadata=self.metadata(),
+                resource=key,
+            )
+            report.resource_id = key.key_id
+            report.resource_name = key.display_name
+            report.location = key.region
+
+            if key.has_expiration():
+                report.status = "PASS"
+                report.status_extended = f"Access key {key.display_name} has an expiration date set ({key.expires})."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Access key {key.display_name} has no expiration date and never rotates."
+
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/__init__.py b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.metadata.json b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.metadata.json
new file mode 100644
index 0000000000..cd587c72da
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "stackit",
+  "CheckID": "objectstorage_bucket_object_lock_enabled",
+  "CheckTitle": "ObjectStorage buckets should have S3 Object Lock enabled",
+  "CheckType": [],
+  "ServiceName": "objectstorage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "storage",
+  "Description": "**S3 Object Lock** prevents objects from being deleted or overwritten for a fixed period or indefinitely. Enabling it protects against accidental deletion and ransomware by enforcing a **write-once-read-many (WORM)** model. Object Lock can only be enabled when the bucket is created.",
+  "Risk": "Without **Object Lock**, objects can be deleted or overwritten at any time, increasing the risk of data loss from accidental deletion, malicious actors, or ransomware. Backups and compliance data are particularly vulnerable.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.stackit.cloud/products/storage/object-storage/",
+    "https://docs.stackit.cloud/products/storage/object-storage/how-tos/object-lock-bucket/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "Object Lock must be enabled at bucket creation time and cannot be enabled on an existing bucket. Create a new bucket with Object Lock enabled and migrate your data to it.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Create **ObjectStorage buckets** with S3 Object Lock enabled for workloads that require data immutability, compliance archiving, or ransomware protection. Object Lock cannot be retroactively enabled on existing buckets.",
+      "Url": "https://hub.prowler.com/check/objectstorage_bucket_object_lock_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Object Lock can only be activated at bucket creation. Buckets without Object Lock are not necessarily misconfigured — evaluate based on the sensitivity and compliance requirements of the stored data."
+}
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.py b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.py
new file mode 100644
index 0000000000..89a3c1d3fb
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.py
@@ -0,0 +1,31 @@
+from prowler.lib.check.models import Check, CheckReportStackIT
+from prowler.providers.stackit.services.objectstorage.objectstorage_client import (
+    objectstorage_client,
+)
+
+
+class objectstorage_bucket_object_lock_enabled(Check):
+    def execute(self):
+        findings = []
+        for bucket in objectstorage_client.buckets:
+            report = CheckReportStackIT(
+                metadata=self.metadata(),
+                resource=bucket,
+            )
+            report.resource_id = bucket.name
+            report.resource_name = bucket.name
+            report.location = bucket.region
+
+            if bucket.object_lock_enabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Bucket {bucket.name} has S3 Object Lock enabled."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Bucket {bucket.name} does not have S3 Object Lock enabled."
+                )
+
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/__init__.py b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.metadata.json b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.metadata.json
new file mode 100644
index 0000000000..44088e5889
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.metadata.json
@@ -0,0 +1,39 @@
+{
+  "Provider": "stackit",
+  "CheckID": "objectstorage_bucket_retention_policy",
+  "CheckTitle": "ObjectStorage buckets should have a default retention policy configured",
+  "CheckType": [],
+  "ServiceName": "objectstorage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "storage",
+  "Description": "An **ObjectStorage default retention policy** automatically applies a minimum retention period to every object uploaded to the bucket, preventing deletion or overwriting before the period expires. Without it, objects can be removed immediately after upload, undermining compliance and data durability requirements.",
+  "Risk": "Buckets without a **default retention policy** offer no automatic protection against premature object deletion. Compliance data, audit logs, and backups may be deleted before their required retention period elapses.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.stackit.cloud/products/storage/object-storage/",
+    "https://docs.stackit.cloud/products/storage/object-storage/how-tos/object-lock-default-retention/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "Use the STACKIT Object Storage API or Portal to set a default retention policy on the bucket. Choose COMPLIANCE mode for strict immutability or GOVERNANCE mode to allow privileged users to override the policy.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure a **default retention policy** on every bucket that stores compliance-relevant or sensitive data. Choose `COMPLIANCE` mode for regulatory requirements and `GOVERNANCE` mode when administrative overrides are acceptable.",
+      "Url": "https://hub.prowler.com/check/objectstorage_bucket_retention_policy"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "objectstorage_bucket_object_lock_enabled"
+  ],
+  "Notes": "A default retention policy requires Object Lock to be enabled on the bucket. Buckets without Object Lock cannot have a retention policy."
+}
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.py b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.py
new file mode 100644
index 0000000000..a9dbc7ed2b
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.py
@@ -0,0 +1,30 @@
+from prowler.lib.check.models import Check, CheckReportStackIT
+from prowler.providers.stackit.services.objectstorage.objectstorage_client import (
+    objectstorage_client,
+)
+
+
+class objectstorage_bucket_retention_policy(Check):
+    def execute(self):
+        findings = []
+        for bucket in objectstorage_client.buckets:
+            report = CheckReportStackIT(
+                metadata=self.metadata(),
+                resource=bucket,
+            )
+            report.resource_id = bucket.name
+            report.resource_name = bucket.name
+            report.location = bucket.region
+
+            if bucket.retention_days and bucket.retention_days > 0:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Bucket {bucket.name} has a default retention policy of "
+                    f"{bucket.retention_days} day(s) in {bucket.retention_mode} mode."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Bucket {bucket.name} does not have a default retention policy configured."
+
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_client.py b/prowler/providers/stackit/services/objectstorage/objectstorage_client.py
new file mode 100644
index 0000000000..56cdbfd0bf
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    ObjectStorageService,
+)
+
+objectstorage_client = ObjectStorageService(Provider.get_global_provider())
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_service.py b/prowler/providers/stackit/services/objectstorage/objectstorage_service.py
new file mode 100644
index 0000000000..e37545ec24
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_service.py
@@ -0,0 +1,306 @@
+import json
+from datetime import datetime, timezone
+from typing import Optional
+
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.stackit.stackit_provider import StackitProvider, suppress_stderr
+
+
+class ObjectStorageService:
+    def __init__(self, provider: StackitProvider):
+        self.provider = provider
+        self.project_id = provider.identity.project_id
+        self.regional_clients = provider.generate_regional_clients("objectstorage")
+
+        self.buckets: list[Bucket] = []
+        self.access_keys: list[AccessKey] = []
+
+        self._fetch_all_regions()
+
+    def _fetch_all_regions(self):
+        for region, client in self.regional_clients.items():
+            try:
+                self._list_buckets(client, region)
+                self._list_access_keys(client, region)
+            except Exception as error:
+                if getattr(error, "status", None) == 404:
+                    logger.info(
+                        f"StackIT project {self.project_id} has no ObjectStorage "
+                        f"presence in region {region}; skipping."
+                    )
+                    continue
+                raise
+
+    def _handle_api_call(self, api_function, *args, **kwargs):
+        try:
+            with suppress_stderr():
+                return api_function(*args, **kwargs)
+        except Exception as e:
+            self.provider.handle_api_error(e)
+            raise
+
+    def _list_buckets(self, client, region: str):
+        response = self._handle_api_call(
+            client.list_buckets, project_id=self.project_id, region=region
+        )
+
+        buckets_list = getattr(response, "buckets", None) or []
+        if isinstance(response, dict):
+            buckets_list = response.get("buckets", [])
+
+        for bucket_data in buckets_list:
+            try:
+                if hasattr(bucket_data, "name"):
+                    name = bucket_data.name
+                    object_lock_enabled = getattr(
+                        bucket_data, "object_lock_enabled", False
+                    )
+                elif isinstance(bucket_data, dict):
+                    name = bucket_data.get("name", "")
+                    object_lock_enabled = bucket_data.get("objectLockEnabled", False)
+                else:
+                    continue
+            except Exception as e:
+                logger.error(f"Error processing bucket: {e}")
+                continue
+
+            retention_days, retention_mode = self._get_default_retention(
+                client, region, name
+            )
+
+            self.buckets.append(
+                Bucket(
+                    name=name,
+                    region=region,
+                    project_id=self.project_id,
+                    object_lock_enabled=object_lock_enabled,
+                    retention_days=retention_days,
+                    retention_mode=retention_mode,
+                )
+            )
+
+        logger.info(f"Listed {len(buckets_list)} buckets in {region}")
+
+    def _get_default_retention(
+        self, client, region: str, bucket_name: str
+    ) -> tuple[Optional[int], Optional[str]]:
+        try:
+            response = self._handle_api_call(
+                client.get_default_retention,
+                project_id=self.project_id,
+                region=region,
+                bucket_name=bucket_name,
+            )
+            days = getattr(response, "days", None)
+            mode = getattr(response, "mode", None)
+            if isinstance(response, dict):
+                days = response.get("days")
+                mode = response.get("mode")
+            return days, str(mode) if mode else None
+        except Exception as e:
+            if getattr(e, "status", None) == 404:
+                return None, None
+            raise
+
+    def _list_access_keys(self, client, region: str):
+        credentials_groups_response = self._handle_api_call(
+            client.list_credentials_groups, project_id=self.project_id, region=region
+        )
+
+        credentials_groups = (
+            getattr(credentials_groups_response, "credentials_groups", None) or []
+        )
+        if isinstance(credentials_groups_response, dict):
+            credentials_groups = credentials_groups_response.get(
+                "credentialsGroups",
+                credentials_groups_response.get("credentials_groups", []),
+            )
+
+        total_keys = 0
+
+        for credentials_group_data in credentials_groups:
+            try:
+                if isinstance(credentials_group_data, dict):
+                    credentials_group_id = credentials_group_data.get(
+                        "id",
+                        credentials_group_data.get(
+                            "groupId",
+                            credentials_group_data.get("credentialsGroupId", ""),
+                        ),
+                    )
+                    credentials_group_name = credentials_group_data.get(
+                        "displayName",
+                        credentials_group_data.get("name", credentials_group_id),
+                    )
+                else:
+                    credentials_group_id = (
+                        getattr(credentials_group_data, "id", None)
+                        or getattr(credentials_group_data, "group_id", None)
+                        or getattr(credentials_group_data, "credentials_group_id", "")
+                    )
+                    credentials_group_name = getattr(
+                        credentials_group_data,
+                        "display_name",
+                        getattr(credentials_group_data, "name", credentials_group_id),
+                    )
+            except Exception as e:
+                logger.error(f"Error processing credentials group: {e}")
+                continue
+
+            if not credentials_group_id:
+                continue
+
+            response = self._list_access_keys_response(
+                client, region, credentials_group_id
+            )
+            keys_list = self._extract_access_keys(response)
+
+            for key_data in keys_list:
+                try:
+                    if hasattr(key_data, "key_id"):
+                        key_id = key_data.key_id
+                        display_name = getattr(key_data, "display_name", key_id)
+                        expires = getattr(key_data, "expires", None)
+                    elif isinstance(key_data, dict):
+                        key_id = key_data.get("keyId", key_data.get("key_id", ""))
+                        display_name = key_data.get(
+                            "displayName", key_data.get("display_name", key_id)
+                        )
+                        expires = key_data.get("expires")
+                    else:
+                        continue
+
+                    if not key_id:
+                        continue
+
+                    self.access_keys.append(
+                        AccessKey(
+                            key_id=key_id,
+                            display_name=display_name,
+                            expires=expires,
+                            region=region,
+                            project_id=self.project_id,
+                            credentials_group_id=credentials_group_id,
+                            credentials_group_name=credentials_group_name,
+                        )
+                    )
+                except Exception as e:
+                    logger.error(f"Error processing access key: {e}")
+                    continue
+
+            total_keys += len(keys_list)
+
+        logger.info(f"Listed {total_keys} access keys in {region}")
+
+    def _list_access_keys_response(
+        self, client, region: str, credentials_group_id: str
+    ):
+        raw_method = None
+        if callable(
+            getattr(type(client), "list_access_keys_without_preload_content", None)
+        ):
+            raw_method = client.list_access_keys_without_preload_content
+        elif callable(vars(client).get("list_access_keys_without_preload_content")):
+            raw_method = vars(client)["list_access_keys_without_preload_content"]
+
+        if raw_method:
+            response = self._handle_api_call(
+                raw_method,
+                project_id=self.project_id,
+                region=region,
+                credentials_group=credentials_group_id,
+            )
+            self._raise_for_raw_response_status(response)
+            return response
+
+        return self._handle_api_call(
+            client.list_access_keys,
+            project_id=self.project_id,
+            region=region,
+            credentials_group=credentials_group_id,
+        )
+
+    def _raise_for_raw_response_status(self, response):
+        status = getattr(response, "status", None)
+        if status is None:
+            status = getattr(response, "status_code", None)
+        if isinstance(status, int) and status >= 400:
+            error = Exception(
+                f"StackIT ObjectStorage list_access_keys failed with status {status}"
+            )
+            error.status = status
+            self.provider.handle_api_error(error)
+            raise error
+
+    @staticmethod
+    def _extract_access_keys(response) -> list:
+        payload = response
+        if not isinstance(payload, (dict, list)):
+            json_method = getattr(response, "json", None)
+            if callable(json_method):
+                payload = json_method()
+            elif hasattr(response, "data"):
+                payload = ObjectStorageService._parse_raw_json(response.data)
+            elif hasattr(response, "text"):
+                payload = ObjectStorageService._parse_raw_json(response.text)
+
+        if isinstance(payload, dict):
+            return payload.get("accessKeys", payload.get("access_keys", []))
+        if isinstance(payload, list):
+            return payload
+        return getattr(response, "access_keys", None) or []
+
+    @staticmethod
+    def _parse_raw_json(raw):
+        if raw in (None, b"", ""):
+            return {}
+        if isinstance(raw, (bytes, bytearray)):
+            raw = raw.decode("utf-8")
+        if isinstance(raw, str):
+            return json.loads(raw)
+        return raw
+
+
+class Bucket(BaseModel):
+    name: str
+    region: str
+    project_id: str
+    object_lock_enabled: bool = False
+    retention_days: Optional[int] = None
+    retention_mode: Optional[str] = None
+
+
+class AccessKey(BaseModel):
+    key_id: str
+    display_name: str
+    # None or a sentinel year-0001 date string means the key never expires.
+    expires: Optional[str] = None
+    region: str
+    project_id: str
+    credentials_group_id: Optional[str] = None
+    credentials_group_name: Optional[str] = None
+
+    def has_expiration(self) -> bool:
+        """Return True if the key has a real (non-sentinel) expiration date."""
+        if not self.expires:
+            return False
+        try:
+            expires_str = self.expires.replace("Z", "+00:00")
+            dt = datetime.fromisoformat(expires_str)
+            # Year 0001 (or earlier) is the SDK sentinel for "never expires"
+            return dt.year > 1
+        except (ValueError, AttributeError):
+            return False
+
+    def expires_within_days(self, days: int) -> bool:
+        """Return True if the key expires within the given number of days from now."""
+        if not self.has_expiration():
+            return False
+        expires_str = self.expires.replace("Z", "+00:00")
+        dt = datetime.fromisoformat(expires_str)
+        if dt.tzinfo is None:
+            dt = dt.replace(tzinfo=timezone.utc)
+        delta = dt - datetime.now(tz=timezone.utc)
+        return delta.days <= days
diff --git a/prowler/providers/stackit/stackit_provider.py b/prowler/providers/stackit/stackit_provider.py
index 417555ef1d..4c34afd31b 100644
--- a/prowler/providers/stackit/stackit_provider.py
+++ b/prowler/providers/stackit/stackit_provider.py
@@ -15,6 +15,7 @@ from colorama import Style
 # loader and surfacing as a misleading empty report.
 from stackit.core.configuration import Configuration
 from stackit.iaas import DefaultApi as IaasDefaultApi
+from stackit.objectstorage import DefaultApi as ObjectStorageDefaultApi
 from stackit.resourcemanager import DefaultApi as ResourceManagerDefaultApi
 
 from prowler.config.config import (
@@ -224,11 +225,17 @@ class StackitProvider(Provider):
             return json_regions.intersection(audited_regions)
         return json_regions
 
+    _SERVICE_API_CLASS = {
+        "iaas": IaasDefaultApi,
+        "objectstorage": ObjectStorageDefaultApi,
+    }
+
     def generate_regional_clients(self, service: str = "iaas") -> dict:
         """Generate regional API clients for the given service.
 
         Returns dict: {"eu01": DefaultApi_client, "eu02": DefaultApi_client}
         """
+        api_class = self._SERVICE_API_CLASS.get(service, IaasDefaultApi)
         regional_clients = {}
         service_regions = self.get_available_service_regions(
             service, self._audited_regions
@@ -240,7 +247,7 @@ class StackitProvider(Provider):
                     self._service_account_key_path,
                     self._service_account_key,
                 )
-                client = IaasDefaultApi(config)
+                client = api_class(config)
                 client.region = region  # Attach region attribute
                 regional_clients[region] = client
 
diff --git a/prowler/providers/stackit/stackit_regions_by_service.json b/prowler/providers/stackit/stackit_regions_by_service.json
index d9c8cdb9be..5841d4e32d 100644
--- a/prowler/providers/stackit/stackit_regions_by_service.json
+++ b/prowler/providers/stackit/stackit_regions_by_service.json
@@ -5,6 +5,12 @@
         "eu01",
         "eu02"
       ]
+    },
+    "objectstorage": {
+      "regions": [
+        "eu01",
+        "eu02"
+      ]
     }
   }
 }
diff --git a/pyproject.toml b/pyproject.toml
index a87e200e4b..f3cec52678 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,7 +5,7 @@ requires = ["hatchling"]
 [dependency-groups]
 dev = [
   "bandit==1.8.3",
-  "black==25.1.0",
+  "black==26.3.1",
   "coverage==7.6.12",
   "docker==7.1.0",
   "filelock==3.20.3",
@@ -17,7 +17,7 @@ dev = [
   "openapi-spec-validator==0.7.1",
   "prek==0.3.9",
   "pylint==3.3.4",
-  "pytest==8.3.5",
+  "pytest==9.0.3",
   "pytest-cov==6.0.0",
   "pytest-env==1.1.5",
   "pytest-randomly==3.16.0",
@@ -32,10 +32,10 @@ classifiers = [
   "Programming Language :: Python :: 3",
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
-  "Programming Language :: Python :: 3.12"
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13"
 ]
 dependencies = [
-  "awsipranges==0.3.3",
   "alive-progress==3.3.0",
   "azure-identity==1.21.0",
   "azure-keyvault-keys==4.10.0",
@@ -73,15 +73,15 @@ dependencies = [
   "dash-bootstrap-components==2.0.3",
   "defusedxml==0.7.1",
   "detect-secrets==1.5.0",
-  "dulwich==0.23.0",
+  "dulwich==1.2.5",
   "google-api-python-client==2.163.0",
   "google-auth-httplib2==0.2.0",
   "jsonschema==4.23.0",
   "kubernetes==32.0.1",
   "markdown==3.10.2",
-  "microsoft-kiota-abstractions==1.9.2",
+  "microsoft-kiota-abstractions==1.9.9",
+  "numpy==2.2.6",
   "msgraph-sdk==1.55.0",
-  "numpy==2.0.2",
   "okta==3.4.2",
   "openstacksdk==4.2.0",
   "pandas==2.2.3",
@@ -95,11 +95,12 @@ dependencies = [
   "slack-sdk==3.39.0",
   "stackit-core==0.2.0",
   "stackit-iaas==1.4.0",
+  "stackit-objectstorage==1.4.0",
   "stackit-resourcemanager==0.8.0",
   "tabulate==0.9.0",
   "tzlocal==5.3.1",
   "uuid6==2024.7.10",
-  "py-iam-expand==0.1.0",
+  "py-iam-expand==0.3.0",
   "h2==4.3.0",
   "oci==2.169.0",
   "alibabacloud_credentials==1.0.3",
@@ -122,8 +123,8 @@ license = "Apache-2.0"
 maintainers = [{name = "Prowler Engineering", email = "engineering@prowler.com"}]
 name = "prowler"
 readme = "README.md"
-requires-python = ">=3.10,<3.13"
-version = "5.30.0"
+requires-python = ">=3.10,<3.14"
+version = "5.31.0"
 
 [project.scripts]
 prowler = "prowler.__main__:prowler"
@@ -161,7 +162,7 @@ constraint-dependencies = [
   "aenum==3.1.17",
   "aiofiles==24.1.0",
   "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.13.5",
+  "aiohttp==3.14.0",
   "aiosignal==1.4.0",
   "alibabacloud-actiontrail20200706==2.4.1",
   "alibabacloud-credentials==1.0.3",
@@ -204,7 +205,7 @@ constraint-dependencies = [
   "azure-core==1.41.0",
   "azure-mgmt-core==1.6.0",
   "bandit==1.8.3",
-  "black==25.1.0",
+  "black==26.3.1",
   "blinker==1.9.0",
   "certifi==2026.4.22",
   "cffi==2.0.0",
@@ -266,12 +267,12 @@ constraint-dependencies = [
   "markupsafe==3.0.3",
   "mccabe==0.7.0",
   "mdurl==0.1.2",
-  "microsoft-kiota-authentication-azure==1.9.2",
-  "microsoft-kiota-http==1.9.2",
-  "microsoft-kiota-serialization-form==1.9.2",
-  "microsoft-kiota-serialization-json==1.9.2",
-  "microsoft-kiota-serialization-multipart==1.9.2",
-  "microsoft-kiota-serialization-text==1.9.2",
+  "microsoft-kiota-authentication-azure==1.9.9",
+  "microsoft-kiota-http==1.9.9",
+  "microsoft-kiota-serialization-form==1.9.9",
+  "microsoft-kiota-serialization-json==1.9.9",
+  "microsoft-kiota-serialization-multipart==1.9.9",
+  "microsoft-kiota-serialization-text==1.9.9",
   "mock==5.2.0",
   "moto==5.1.11",
   "mpmath==1.3.0",
@@ -314,16 +315,17 @@ constraint-dependencies = [
   "pydash==8.0.6",
   "pyflakes==3.2.0",
   "pygments==2.20.0",
-  "pyjwt==2.12.1",
+  "pyjwt==2.13.0",
   "pylint==3.3.4",
   "pynacl==1.6.2",
   "pyopenssl==26.2.0",
   "pyparsing==3.3.2",
-  "pytest==8.3.5",
+  "pytest==9.0.3",
   "pytest-cov==6.0.0",
   "pytest-env==1.1.5",
   "pytest-randomly==3.16.0",
   "pytest-xdist==3.6.1",
+  "pytokens==0.4.1",
   "pywin32==311",
   "pyyaml==6.0.3",
   "referencing==0.36.2",
@@ -363,3 +365,13 @@ constraint-dependencies = [
   "zstd==1.5.7.3"
 ]
 override-dependencies = ["okta==3.4.2"]
+
+[tool.vulture]
+# Suppress known false positives. The CI command only passes --exclude and
+# --min-confidence on the CLI, so ignore_names from here still applies (vulture
+# only overrides the keys set on the CLI).
+# - mock_* : pytest fixtures injected as test params but unused in the body
+# (e.g. mock_sensitive_args in tests/lib/cli/redact_test.py)
+# - view   : DRF BasePermission.has_object_permission(self, request, view, obj)
+# framework-required signature param in skills/django-drf template assets
+ignore_names = ["mock_*", "view"]
diff --git a/scripts/development/dev-local.sh b/scripts/development/dev-local.sh
new file mode 100755
index 0000000000..d193b81532
--- /dev/null
+++ b/scripts/development/dev-local.sh
@@ -0,0 +1,558 @@
+#!/usr/bin/env bash
+#
+# Local dev for Prowler API + worker.
+# Postgres / Valkey / Neo4j run in Docker via docker-compose-dev.yml;
+# Django and Celery run natively.
+#
+# Quick start:
+#   make dev-setup   first-time bootstrap (deps, migrations, fixtures)
+#   make dev         launch api + worker + postgres logs in tmux
+#   make dev-attach  attach to the tmux session in the current terminal pane
+#   make dev-launch  use fixed ports and attach interactive local dev
+#   make dev-stop    stop everything: tmux + stop + remove containers
+#   make dev-clean   remove stopped containers only (data preserved)
+#   make dev-wipe    full nuke: kill + clean + delete ./_data/
+#
+# Agent / non-interactive usage: 'make dev' is idempotent, runs
+# everything detached, blocks until the API answers HTTP, and ends with
+# parseable key=value lines (api_url=, api_log=, worker_log=,
+# postgres_log=, attach_cmd=, stop_cmd=).
+# Every pane is teed ANSI-stripped to _data/logs/{api,worker,postgres}.log
+# (truncated per run), so logs are readable with tail -f, no tmux needed.
+#
+# 'attach' attaches to tmux inside the current terminal pane.
+#
+# Inside the tmux session "prowler-dev-<compose-project>" the prefix key is Ctrl+b. After it:
+#   d              detach (everything keeps running; reattach: make dev-attach)
+#   <arrows>       move between panes
+#   z              zoom current pane (toggle)
+#   [              scrollback mode (q to exit)
+#   x              kill current pane (asks for confirmation)
+#   &              kill current window
+#   :kill-session  end the whole session
+#
+# How to stop everything from inside tmux:
+#   1) Ctrl+b then d           detach back to your shell
+#   2) make dev-stop           tears down tmux + containers
+# Alternative without detaching: open a new tmux window with Ctrl+b then c
+# and run make dev-stop there; the session will close itself.
+#
+# Stop just the python procs (keep containers up to skip a slow neo4j boot next time):
+#   ./scripts/development/dev-local.sh down
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$REPO_ROOT"
+
+path_hash() {
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$REPO_ROOT" | shasum | awk '{print substr($1, 1, 8)}'
+  else
+    printf '%s' "$REPO_ROOT" | cksum | awk '{print $1}'
+  fi
+}
+
+compose_project_default() {
+  local base hash
+  base="$(basename "$REPO_ROOT" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9_-]+/-/g; s/^-+//; s/-+$//')"
+  hash="$(path_hash)"
+  printf '%s-%s' "${base:-prowler}" "$hash"
+}
+
+export COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-$(compose_project_default)}"
+
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
+
+export POSTGRES_HOST=localhost
+export POSTGRES_PORT="${POSTGRES_PORT:-5432}"
+export VALKEY_HOST=localhost
+export VALKEY_PORT="${VALKEY_PORT:-6379}"
+export VALKEY_SCHEME="${VALKEY_SCHEME:-redis}"
+export NEO4J_HOST=localhost
+export NEO4J_PORT="${NEO4J_PORT:-7687}"
+export NEO4J_HTTP_PORT="${NEO4J_HTTP_PORT:-7474}"
+export DJANGO_SETTINGS_MODULE=config.django.devel
+export DJANGO_DEBUG="${DJANGO_DEBUG:-True}"
+export DJANGO_PORT="${DJANGO_PORT:-8080}"
+export DJANGO_LOGGING_FORMATTER="${DJANGO_LOGGING_FORMATTER:-human_readable}"
+export DJANGO_LOGGING_LEVEL="${DJANGO_LOGGING_LEVEL:-info}"
+export DJANGO_MANAGE_DB_PARTITIONS="${DJANGO_MANAGE_DB_PARTITIONS:-False}"
+
+if docker compose version >/dev/null 2>&1; then
+  COMPOSE=(docker compose)
+else
+  COMPOSE=(docker-compose)
+fi
+COMPOSE_FILE="docker-compose-dev.yml"
+
+log()  { printf '\033[1;34m→\033[0m %s\n' "$*"; }
+ok()   { printf '\033[1;32m✓\033[0m %s\n' "$*"; }
+warn() { printf '\033[1;33m!\033[0m %s\n' "$*"; }
+
+require_uv() {
+  if ! command -v uv >/dev/null 2>&1; then
+    warn "uv not found in PATH. Install: https://docs.astral.sh/uv/getting-started/installation/"
+    exit 1
+  fi
+}
+
+services_up() {
+  log "Starting postgres + valkey + neo4j via Docker (waits for healthchecks)..."
+  "${COMPOSE[@]}" -f "$COMPOSE_FILE" up -d --wait postgres valkey neo4j
+  ok "Services ready: pg:${POSTGRES_PORT} / valkey:${VALKEY_PORT} / neo4j:${NEO4J_PORT} / neo4j-http:${NEO4J_HTTP_PORT}"
+}
+
+kill_tmux_session() {
+  command -v tmux >/dev/null 2>&1 || return 0
+  if tmux has-session -t "$TMUX_SESSION" 2>/dev/null; then
+    log "Killing tmux session '$TMUX_SESSION'"
+    tmux kill-session -t "$TMUX_SESSION"
+  fi
+}
+
+tmux_pane_count() {
+  tmux list-panes -t "$TMUX_SESSION:" 2>/dev/null | wc -l | tr -d ' '
+}
+
+# Tee a tmux pane's output to _data/logs/<name>.log so non-interactive
+# consumers (scripts, agents) can follow the stack without attaching.
+# ANSI codes are stripped; the file is truncated on session creation so
+# its content always matches the current run.
+pipe_pane_log() {
+  local pane="$1" name="$2"
+  local logfile="$REPO_ROOT/_data/logs/$name.log"
+  : > "$logfile"
+  tmux pipe-pane -t "$pane" -o "perl -pe 'BEGIN{\$|=1} s/\\e\\[[0-9;?]*[A-Za-z]//g' >> '$logfile'"
+}
+
+# Stop native dev processes (api/worker/beat) launched outside tmux. Scoped by
+# cwd under REPO_ROOT so other prowler clones running their own stacks are not
+# touched.
+kill_native_procs() {
+  command -v pgrep >/dev/null 2>&1 || return 0
+  command -v lsof  >/dev/null 2>&1 || return 0
+
+  local pids="" pid pcwd pat
+  for pat in "manage.py runserver" "celery -A config.celery worker" "celery -A config.celery beat"; do
+    while IFS= read -r pid; do
+      [ -n "$pid" ] || continue
+      pcwd="$(lsof -a -d cwd -p "$pid" 2>/dev/null | awk 'NR>1 {print $NF; exit}')"
+      case "$pcwd" in
+        "$REPO_ROOT"|"$REPO_ROOT"/*) pids="$pids $pid" ;;
+      esac
+    done < <(pgrep -f "$pat" 2>/dev/null)
+  done
+
+  pids="$(printf '%s\n' "$pids" | tr ' ' '\n' | sed '/^$/d' | sort -u | xargs)"
+  [ -z "$pids" ] && return 0
+
+  log "Stopping native dev procs ($pids) under $REPO_ROOT"
+  # shellcheck disable=SC2086
+  kill -TERM $pids 2>/dev/null || true
+  sleep 0.5
+  # shellcheck disable=SC2086
+  kill -KILL $pids 2>/dev/null || true
+}
+
+services_down() {
+  kill_tmux_session
+  kill_native_procs
+  log "Stopping postgres + valkey + neo4j..."
+  "${COMPOSE[@]}" -f "$COMPOSE_FILE" stop postgres valkey neo4j
+}
+
+services_status() {
+  "${COMPOSE[@]}" -f "$COMPOSE_FILE" ps postgres valkey neo4j
+}
+
+deps() {
+  require_uv
+  log "uv sync (api/)..."
+  (cd api && uv sync)
+}
+
+migrate() {
+  require_uv
+  log "Applying migrations (admin DB)..."
+  (
+    cd api/src/backend
+    uv run python manage.py check_and_fix_socialaccount_sites_migration --database admin
+    uv run python manage.py migrate --database admin
+  )
+  ok "Migrations applied"
+}
+
+fixtures() {
+  require_uv
+  log "Loading dev fixtures..."
+  (
+    cd api/src/backend
+    for fixture in api/fixtures/dev/*.json; do
+      [ -f "$fixture" ] || continue
+      echo "  loading $(basename "$fixture")"
+      uv run python manage.py loaddata "$fixture" --database admin
+    done
+  )
+  ok "Fixtures loaded"
+}
+
+api_run() {
+  require_uv
+  log "Starting Django API on [::]:${DJANGO_PORT} (IPv4 + IPv6 dual-stack)"
+  cd api/src/backend
+  exec uv run python manage.py runserver "[::]:${DJANGO_PORT}"
+}
+
+worker_run() {
+  require_uv
+  log "Starting Celery worker"
+  cd api/src/backend
+  exec uv run python -m celery -A config.celery worker \
+    -l "${DJANGO_LOGGING_LEVEL}" \
+    -Q celery,scans,scan-reports,deletion,backfill,overview,integrations,compliance,attack-paths-scans \
+    -E
+}
+
+beat_run() {
+  require_uv
+  log "Starting Celery beat (DatabaseScheduler)"
+  cd api/src/backend
+  exec uv run python -m celery -A config.celery beat \
+    -l "${DJANGO_LOGGING_LEVEL}" \
+    --scheduler django_celery_beat.schedulers:DatabaseScheduler
+}
+
+TMUX_SESSION="prowler-dev-${COMPOSE_PROJECT_NAME}"
+SCRIPT_PATH="$REPO_ROOT/scripts/development/dev-local.sh"
+
+require_tmux() {
+  if ! command -v tmux >/dev/null 2>&1; then
+    warn "tmux not installed. Run: brew install tmux"
+    exit 1
+  fi
+}
+
+remove_repo_compose_containers() {
+  command -v docker >/dev/null 2>&1 || return 0
+  local ids
+  ids="$(
+    docker ps -aq 2>/dev/null \
+      | while IFS= read -r id; do
+          docker inspect --format '{{.ID}} {{index .Config.Labels "com.docker.compose.project.working_dir"}}' "$id" 2>/dev/null || true
+        done \
+      | awk -v repo="$REPO_ROOT" '$2 == repo {print $1}'
+  )"
+  [ -n "$ids" ] || return 0
+  warn "Removing existing Docker containers for this repo before launch"
+  # shellcheck disable=SC2086
+  docker rm -f $ids >/dev/null
+}
+
+remove_docker_containers_on_ports() {
+  command -v docker >/dev/null 2>&1 || return 0
+  local all_ids ids_to_remove="" id port published_ports
+  all_ids="$(docker ps -aq 2>/dev/null || true)"
+  [ -n "$all_ids" ] || return 0
+
+  for id in $all_ids; do
+    published_ports="$(docker inspect --format '{{range $containerPort, $bindings := .HostConfig.PortBindings}}{{range $bindings}}{{.HostPort}}{{"\n"}}{{end}}{{end}}' "$id" 2>/dev/null || true)"
+    [ -n "$published_ports" ] || continue
+    for port in "$@"; do
+      if printf '%s\n' "$published_ports" | grep -qx "$port"; then
+        ids_to_remove="$ids_to_remove $id"
+        break
+      fi
+    done
+  done
+
+  ids_to_remove="$(printf '%s\n' "$ids_to_remove" | tr ' ' '\n' | sed '/^$/d' | sort -u | xargs)"
+  [ -n "$ids_to_remove" ] || return 0
+  warn "Removing Docker containers publishing fixed dev ports: $ids_to_remove"
+  # shellcheck disable=SC2086
+  docker rm -f $ids_to_remove >/dev/null
+}
+
+kill_listeners_on_ports() {
+  command -v lsof >/dev/null 2>&1 || return 0
+  local pids="" port port_pids
+  for port in "$@"; do
+    port_pids="$(lsof -nP -tiTCP:"$port" -sTCP:LISTEN 2>/dev/null || true)"
+    [ -n "$port_pids" ] && pids="$pids $port_pids"
+  done
+
+  pids="$(printf '%s\n' "$pids" | tr ' ' '\n' | sed '/^$/d' | sort -u | xargs)"
+  [ -n "$pids" ] || return 0
+  warn "Killing local processes listening on fixed dev ports: $pids"
+  # shellcheck disable=SC2086
+  kill -TERM $pids 2>/dev/null || true
+  sleep 0.5
+  # shellcheck disable=SC2086
+  kill -KILL $pids 2>/dev/null || true
+}
+
+clear_dev_port_conflicts() {
+  local ports=("$DJANGO_PORT" "$POSTGRES_PORT" "$VALKEY_PORT" "$NEO4J_PORT" "$NEO4J_HTTP_PORT")
+  log "Ensuring fixed dev ports are free: api:${DJANGO_PORT} pg:${POSTGRES_PORT} valkey:${VALKEY_PORT} neo4j:${NEO4J_PORT} neo4j-http:${NEO4J_HTTP_PORT}"
+  remove_docker_containers_on_ports "${ports[@]}"
+  kill_listeners_on_ports "${ports[@]}"
+}
+
+# Block until the API answers HTTP on DJANGO_PORT (any status code counts).
+wait_for_api() {
+  local timeout="${1:-90}" waited=0
+  log "Waiting for API on :${DJANGO_PORT} (timeout ${timeout}s)..."
+  until curl -s -o /dev/null --max-time 2 "http://localhost:${DJANGO_PORT}/"; do
+    waited=$((waited + 1))
+    if [ "$waited" -ge "$timeout" ]; then
+      warn "API not responding after ${timeout}s. Check _data/logs/api.log"
+      return 1
+    fi
+    sleep 1
+  done
+  ok "API responding on :${DJANGO_PORT}"
+}
+
+needs_db_bootstrap() {
+  ! "${COMPOSE[@]}" -f "$COMPOSE_FILE" exec -T postgres \
+      psql -U prowler -d prowler_db -c 'select 1' >/dev/null 2>&1
+}
+
+bootstrap_db_if_needed() {
+  if needs_db_bootstrap; then
+    warn "App DB user not ready. Bootstrapping (deps + migrate + fixtures)..."
+    deps
+    migrate
+    fixtures
+    ok "DB bootstrap complete"
+  fi
+}
+
+all_run() {
+  require_tmux
+  require_uv
+  services_up
+  bootstrap_db_if_needed
+
+  # Wrap a command so it auto-runs as the pane's foreground process and, on
+  # exit (e.g. Ctrl+C), drops into the user's login shell instead of closing.
+  # Avoids the `send-keys` race where keys arrive before zsh+starship are ready.
+  local user_shell="${SHELL:-/bin/zsh}"
+  pane_cmd() {
+    printf 'bash -c %q' "$1; exec ${user_shell}"
+  }
+  local api_cmd worker_cmd pg_cmd
+  api_cmd="$(pane_cmd "$SCRIPT_PATH api")"
+  worker_cmd="$(pane_cmd "$SCRIPT_PATH worker")"
+  pg_cmd="$(pane_cmd "${COMPOSE[*]} -f $COMPOSE_FILE logs -f postgres")"
+
+  # If a tmux server is already running (e.g. another project's session), new
+  # sessions inherit THAT server's env, not the launcher shell's env. Pass our
+  # overrides explicitly so each pane sees the right project name, ports, etc.
+  local -a env_args=()
+  local var
+  for var in COMPOSE_PROJECT_NAME \
+             POSTGRES_HOST POSTGRES_PORT \
+             VALKEY_HOST VALKEY_PORT VALKEY_SCHEME \
+             NEO4J_HOST NEO4J_PORT NEO4J_HTTP_PORT \
+             DJANGO_SETTINGS_MODULE DJANGO_DEBUG DJANGO_PORT \
+             DJANGO_LOGGING_FORMATTER DJANGO_LOGGING_LEVEL \
+             DJANGO_MANAGE_DB_PARTITIONS; do
+    env_args+=(-e "${var}=${!var-}")
+  done
+
+  local expected_panes=3
+
+  if tmux has-session -t "$TMUX_SESSION" 2>/dev/null; then
+    local current_panes
+    current_panes="$(tmux_pane_count)"
+    if [ "$current_panes" -lt "$expected_panes" ]; then
+      warn "Session '$TMUX_SESSION' has $current_panes pane(s), expected $expected_panes. Rebuilding it."
+      tmux kill-session -t "$TMUX_SESSION"
+    else
+      log "Session '$TMUX_SESSION' already exists"
+    fi
+  fi
+
+  if ! tmux has-session -t "$TMUX_SESSION" 2>/dev/null; then
+    log "Creating tmux session '$TMUX_SESSION' (api / worker / db logs)"
+    tmux new-session -d -s "$TMUX_SESSION" -n services -c "$REPO_ROOT" "${env_args[@]}" "$api_cmd"
+    tmux split-window -t "$TMUX_SESSION:0.0" -v -p 50 -c "$REPO_ROOT" "${env_args[@]}" "$worker_cmd"
+    tmux split-window -t "$TMUX_SESSION:0.1" -h -p 50 -c "$REPO_ROOT" "${env_args[@]}" "$pg_cmd"
+    tmux select-pane -t "$TMUX_SESSION:0.0"
+    tmux set-option -t "$TMUX_SESSION" -g mouse on >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g bell-action none >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g visual-bell off >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g monitor-bell off >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g monitor-activity off >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g visual-activity off >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g activity-action none >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g silence-action none >/dev/null
+    tmux bind-key -T copy-mode MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "pbcopy" 2>/dev/null
+    tmux bind-key -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "pbcopy" 2>/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g status-right " API:${DJANGO_PORT} | DB:${POSTGRES_PORT} | Broker:${VALKEY_PORT} " >/dev/null
+
+    mkdir -p "$REPO_ROOT/_data/logs"
+    pipe_pane_log "$TMUX_SESSION:0.0" api
+    pipe_pane_log "$TMUX_SESSION:0.1" worker
+    pipe_pane_log "$TMUX_SESSION:0.2" postgres
+  fi
+
+  wait_for_api 90
+
+  ok "Dev stack ready (detached)"
+  cat <<EOF
+api_url=http://localhost:${DJANGO_PORT}/api/v1
+api_log=_data/logs/api.log
+worker_log=_data/logs/worker.log
+postgres_log=_data/logs/postgres.log
+EOF
+  cat <<EOF
+attach_cmd=make dev-attach
+stop_cmd=make dev-stop
+EOF
+}
+
+attach_run() {
+  require_tmux
+  if ! tmux has-session -t "$TMUX_SESSION" 2>/dev/null; then
+    warn "No session '$TMUX_SESSION'. Starting it with: $0 all"
+    all_run
+  else
+    local current_panes
+    current_panes="$(tmux_pane_count)"
+    if [ "$current_panes" -lt 3 ]; then
+      warn "Session '$TMUX_SESSION' only has $current_panes pane(s). Rebuilding with db logs."
+      tmux kill-session -t "$TMUX_SESSION"
+      all_run
+    fi
+  fi
+  if [ -n "${TMUX:-}" ]; then
+    tmux switch-client -t "$TMUX_SESSION"
+  else
+    tmux attach-session -t "$TMUX_SESSION"
+  fi
+}
+
+clean_run() {
+  log "Removing stopped containers from the compose project..."
+  "${COMPOSE[@]}" -f "$COMPOSE_FILE" rm -f
+  ok "Stopped containers removed (data volumes under ./_data/ untouched)"
+}
+
+wipe_run() {
+  warn "DESTRUCTIVE: this will tear down everything AND delete ./_data/"
+  warn "  postgres database, valkey state, neo4j graph, api jwt keys - all gone."
+  warn "  Next start will require 'make dev-setup' from scratch."
+  kill_run
+  if [ -d ./_data ]; then
+    log "Removing ./_data/ ..."
+    rm -rf ./_data
+  fi
+  ok "Wipe complete. Run 'make dev-setup' for a fresh environment."
+}
+
+kill_run() {
+  kill_tmux_session
+  services_down
+  clean_run
+  ok "Dev stack stopped (tmux killed, containers stopped + removed)"
+}
+
+launch_run() {
+  require_uv
+  kill_tmux_session
+  remove_repo_compose_containers
+  clear_dev_port_conflicts
+
+  log "Launching dev stack in tmux inside the current terminal"
+  log "  api:${DJANGO_PORT} pg:${POSTGRES_PORT} valkey:${VALKEY_PORT} neo4j:${NEO4J_PORT} neo4j-http:${NEO4J_HTTP_PORT}"
+  all_run
+  attach_run
+}
+
+setup() {
+  services_up
+  deps
+  migrate
+  fixtures
+  ok "Setup complete."
+  cat <<EOF
+
+Next run everything in one window:
+  make dev                    # api + worker in tmux
+
+API will be available at http://localhost:${DJANGO_PORT}/api/v1/
+EOF
+}
+
+usage() {
+  cat <<EOF
+Usage: $0 <command>
+
+One-window dev (tmux inside the terminal):
+  all        api + worker + postgres logs in 3 panes (detached,
+             blocks until API responds,
+             ends with parseable api_url= / *_log= / attach_cmd= / stop_cmd= lines)
+  attach     Reattach to the existing dev session
+             Attaches tmux inside the current terminal pane.
+             Pane output is also written to _data/logs/{api,worker,postgres}.log
+             (ANSI-stripped, truncated per run) - usable without attaching
+  kill       Stop tmux + stop containers + remove them (full teardown)
+  launch     Use fixed ports, clear conflicts, then run 'all' and attach tmux
+
+Platform support:
+  macOS      Supported
+  Linux      Should work when Docker, tmux, and uv are available
+  Windows    Requires script changes before it can be supported
+
+State (containers postgres + valkey + neo4j):
+  up         Start postgres + valkey + neo4j (waits for healthchecks)
+  down       Stop tmux + postgres + valkey + neo4j (keeps containers around)
+  status     Show container status
+  clean      Remove all stopped containers in the project (data volumes preserved)
+  wipe       Full nuke: kill + clean + delete ./_data/
+
+Python (native, foreground - usually launched via 'all'):
+  api        Run Django API (runserver)
+  worker     Run Celery worker
+  beat       Run Celery beat scheduler
+
+One-shots:
+  setup      up + deps + migrate + fixtures (first-time / fresh DB)
+  deps       uv sync inside api/
+  migrate    Apply migrations to admin DB
+  fixtures   Load dev fixtures
+
+Typical flow:
+  make dev-setup              # first time only
+  make dev                    # daily dev
+  make dev-stop               # when done
+EOF
+}
+
+case "${1:-help}" in
+  all)       shift; if [ "$#" -gt 0 ]; then warn "'all $*' is not supported. Use: $0 all"; exit 1; fi; all_run ;;
+  attach)    attach_run ;;
+  kill)      kill_run ;;
+  launch)    launch_run ;;
+  clean)     clean_run ;;
+  wipe)      wipe_run ;;
+  up)        services_up ;;
+  down)      services_down ;;
+  status)    services_status ;;
+  api)       api_run ;;
+  worker)    worker_run ;;
+  beat)      beat_run ;;
+  setup)     setup ;;
+  deps)      deps ;;
+  migrate)   migrate ;;
+  fixtures)  fixtures ;;
+  help|-h|--help|*) usage ;;
+esac
diff --git a/skills/README.md b/skills/README.md
index 47bf7e5562..cfc65527a9 100644
--- a/skills/README.md
+++ b/skills/README.md
@@ -23,12 +23,12 @@ Run the setup script to configure skills for all supported AI coding assistants:
 
 This creates symlinks so each tool finds skills in its expected location:
 
-| Tool | Symlink Created |
-|------|-----------------|
-| Claude Code / OpenCode | `.claude/skills/` |
-| Codex (OpenAI) | `.codex/skills/` |
-| GitHub Copilot | `.github/skills/` |
-| Gemini CLI | `.gemini/skills/` |
+| Tool | Created by setup |
+|------|------------------|
+| Claude Code | `.claude/skills/` symlink and `CLAUDE.md` |
+| Gemini CLI | `.gemini/skills/` symlink and `GEMINI.md` |
+| Codex (OpenAI) | `.codex/skills/` symlink (uses `AGENTS.md` natively) |
+| GitHub Copilot | `.github/copilot-instructions.md` symlink to `AGENTS.md` |
 
 After running setup, restart your AI coding assistant to load the skills.
 
diff --git a/skills/prowler-tour/SKILL.md b/skills/prowler-tour/SKILL.md
new file mode 100644
index 0000000000..8511581a47
--- /dev/null
+++ b/skills/prowler-tour/SKILL.md
@@ -0,0 +1,99 @@
+---
+name: prowler-tour
+description: >
+  Keeps product-tour definitions aligned with the UI features they describe.
+  Trigger: When modifying UI components that have associated tours, editing tour
+  definition files, or renaming data-tour-id attributes.
+license: Apache-2.0
+metadata:
+  author: prowler-cloud
+  version: "1.0"
+  scope: [root, ui]
+  auto_invoke:
+    - "Editing a UI file containing data-tour-id attributes"
+    - "Adding, updating, or removing a tour definition (*.tour.ts)"
+    - "Renaming or removing a data-tour-id attribute value"
+    - "Changing button labels or section headings on a tour-covered page"
+    - "Restructuring routes or layouts covered by a tour"
+allowed-tools: Read, Glob, Grep
+---
+
+# prowler-tour
+
+**Report-only.** This skill never edits tour files or UI files; it inspects
+the change, reports drift it finds between tours and the covered UI, and
+recommends actions for the developer to apply.
+
+## Early-exit rule
+
+Run this check first. Most UI edits are not tour-related — exit cheaply.
+
+1. Glob `ui/lib/tours/*.tour.ts`.
+2. For each tour, check whether any `coversFiles` glob pattern matches any
+   file in the current change.
+3. If no tour matches, respond **exactly**:
+
+   > No tour affected — skipping alignment check
+
+   and exit. Do not proceed to the checklist.
+4. If at least one tour matches, continue to "Drift checklist" for that tour.
+
+## Drift checklist
+
+For each affected tour, evaluate every item. Skip items that obviously do
+not apply, but list explicitly which items were checked.
+
+1. **Orphan selectors** — every step's `target` (which composes to
+   `data-tour-id="<tour-id>-<step.target>"`) must resolve to a real element
+   in the codebase. Grep `ui/` for the expected attribute value; report
+   any step whose target is missing.
+2. **Renamed selectors** — a `data-tour-id` attribute was edited in this
+   change. Match it back to any tour step referencing the old value.
+3. **Outdated copy** — a popover `title`/`description` references a button
+   label, heading, or term that no longer exists on the covered page.
+4. **Obsolete steps** — a step describes a section, panel, or workflow
+   that was removed.
+5. **Missing steps** — a new feature was added on the covered surface
+   without a corresponding step (e.g. a new panel, a new primary action,
+   a new wizard stage).
+6. **Reordered flow** — the user's path through the feature changed (e.g.
+   query builder moved before scan selection) and the step order no
+   longer reflects it.
+
+## Version-bump decision tree
+
+Apply per tour after listing drift:
+
+- **NO bump** when the change is cosmetic. Examples: fix a typo, soften
+  copy, rename a `data-tour-id` selector while keeping the same step,
+  swap one screenshot for another, tighten wording.
+- **BUMP `version`** when the user-visible flow changes materially.
+  Examples: a new step was added or removed; the order changed; an
+  anchored target was retargeted to a different panel; the tour now
+  covers a new feature on the surface.
+
+When in doubt, ask: "Would a user who already saw the previous version
+miss something useful by not seeing this one?" If yes, bump.
+
+## Output format
+
+When emitting a report, follow the exact structure in
+`references/output-format.md`. The structure is mandatory because the
+report is consumed downstream and tolerates no field reordering.
+
+## What this skill MUST NOT do
+
+- Do not edit `*.tour.ts` files. This skill is report-only.
+- Do not edit UI files to add or rename `data-tour-id` attributes.
+- Do not invent new tours. Authoring a new tour is a separate, deliberate
+  decision — the developer makes it, not the skill.
+- Do not flag drift in tours whose `coversFiles` do not match any file
+  in the current change. Stick to the early-exit rule.
+
+## See also
+
+- `references/output-format.md` — exact report template (read when
+  emitting a report).
+- `references/tours-architecture.md` — code map for the tour abstraction
+  under `ui/lib/tours/`.
+- `assets/tour-template.ts` — boilerplate for authoring a new `*.tour.ts`.
diff --git a/skills/prowler-tour/assets/tour-template.ts b/skills/prowler-tour/assets/tour-template.ts
new file mode 100644
index 0000000000..cc264a4678
--- /dev/null
+++ b/skills/prowler-tour/assets/tour-template.ts
@@ -0,0 +1,51 @@
+// @ts-nocheck -- template only; resolves once copied into `ui/lib/tours/`
+/**
+ * Tour template — copy this file to `ui/lib/tours/<your-id>.tour.ts` and
+ * fill in the placeholders. See `references/tours-architecture.md` for the
+ * design context.
+ *
+ * Conventions:
+ *   - Declare via `defineTour({...})` (NOT `: TourDefinition`) so TS
+ *     preserves the literal union of `target` values. `useDriverTour` uses
+ *     that union to validate `stepHandlers` keys and `waitForStep` args.
+ *   - `id` is kebab-case and unique across all tours.
+ *   - Anchored steps reference DOM via `data-tour-id="<id>-<step.target>"`;
+ *     the hook composes the CSS selector automatically.
+ *   - `coversFiles` lists the globs that describe the tour's surface; the
+ *     `prowler-tour` skill consumes this to decide whether to evaluate
+ *     drift on a given change.
+ *   - Material flow changes bump `version`; cosmetic edits do not.
+ */
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+} from "@/lib/tours/tour-types";
+
+export const yourTour = defineTour({
+  id: "your-tour-id",
+  version: 1,
+  coversFiles: [
+    // List the UI files this tour describes, using globs under `ui/`.
+    // Example: "ui/app/(prowler)/your-feature/**"
+  ],
+  steps: [
+    {
+      // Modal step — no anchor. Use for intros, outros, and any step
+      // that does not point at a specific DOM element.
+      title: "Welcome",
+      description: "Short, plain-English description.",
+    },
+    {
+      // Anchored step. The hook resolves
+      // `[data-tour-id="your-tour-id-step-name"]` lazily, so the element
+      // can be conditionally rendered as long as it exists when the step
+      // becomes active.
+      target: "step-name",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Where the action is",
+      description: "Tell the user what to look at here and why.",
+    },
+  ],
+});
diff --git a/skills/prowler-tour/references/output-format.md b/skills/prowler-tour/references/output-format.md
new file mode 100644
index 0000000000..ecd82c4d8e
--- /dev/null
+++ b/skills/prowler-tour/references/output-format.md
@@ -0,0 +1,31 @@
+# Tour Alignment Report — output format
+
+The report is consumed downstream. Field names, order, and headings are
+load-bearing — do not rename, reorder, or omit them.
+
+## Template
+
+```text
+## Tour Alignment Report
+**Tour:** `<tour-id>@v<version>`
+**Files touched:** <comma-separated list of files in the change>
+
+### Drift detected
+- <one bullet per drift item; include file:line where available>
+
+### Recommended actions
+1. <numbered, actionable steps the developer should take>
+
+### Version bump verdict
+- <BUMP | NO bump> — <one-line rationale>
+```
+
+## Rules
+
+- One report per affected tour. If multiple tours are affected, separate
+  reports with a `---` line.
+- If no drift is detected for an affected tour, still emit the report:
+  put "No drift detected." under "Drift detected" and "None required."
+  under "Recommended actions". The verdict line is still mandatory.
+- The verdict is exactly one of `BUMP` or `NO bump` — see the
+  version-bump decision tree in `SKILL.md`.
diff --git a/skills/prowler-tour/references/tours-architecture.md b/skills/prowler-tour/references/tours-architecture.md
new file mode 100644
index 0000000000..9a5c8f49e0
--- /dev/null
+++ b/skills/prowler-tour/references/tours-architecture.md
@@ -0,0 +1,44 @@
+# Tours Architecture
+
+The product-tour abstraction lives under [`ui/lib/tours/`](../../../ui/lib/tours/).
+This skill operates on tour definitions that follow this architecture.
+
+## Code map
+
+| File | Purpose |
+|---|---|
+| `ui/lib/tours/tour-types.ts` | Public type surface: `TourDefinition`, `TourStep`, `TourId`, `TourCompletionRecord`, completion-state const map. Also exports `defineTour(...)` — the required authoring helper that preserves literal step `target`s so `useDriverTour` can type-check `stepHandlers` keys and `waitForStep` arguments. |
+| `ui/lib/tours/tour-config.ts` | `baseDriverConfig`, `getDriverConfig(theme, overrides?)`, overlay-color map. |
+| `ui/lib/tours/store/tour-completion-store.ts` | Persistence interface — the swap point for future API adapters. |
+| `ui/lib/tours/store/local-storage-adapter.ts` | The only adapter in the PoC. Key format: `prowler.tour.<id>.v<version>`. |
+| `ui/lib/tours/use-driver-tour.ts` | React hook. Initializes driver.js, derives `overlayColor` from `useTheme()`, persists completion. |
+| `ui/lib/tours/<id>.tour.ts` | One file per tour. Declared via `defineTour({...})` (not `: TourDefinition`) and imported by the page that opts the user in. |
+| `ui/styles/tours.css` | `.driver-popover.prowler-theme` — every color resolved via `var(--...)` from `globals.css`. |
+
+## Selector convention
+
+Tour steps anchor via `data-tour-id="<tour-id>-<step.target>"`. The hook
+composes the CSS selector at runtime; tour authors only provide the step
+name in `step.target`. Class-based, ID-based, structural selectors are
+forbidden — they couple tours to styling decisions that legitimately
+change.
+
+## Identity and versioning
+
+A tour is `{ id, version }`. The localStorage key composes both. A
+**material content change** bumps `version`; cosmetic edits do not. The
+decision tree lives in the parent SKILL.md.
+
+## Persistence scope
+
+Per-user, cross-tenant. A user who completed `attack-paths@v1` in tenant
+A does not see the tour again in tenant B, even if they can access the
+feature there. The future `UserTourState` model (documented in
+`design.md`, not built) is FK to `User`, not `Membership`.
+
+## Drift = #1 risk
+
+Without the maintenance skill + the optional CI gate
+(`ui/scripts/check-tour-alignment.mjs`), tours decay silently as the
+covered UI evolves. The parent SKILL.md enumerates the six drift
+categories the skill checks for.
diff --git a/tests/config/config_test.py b/tests/config/config_test.py
index 1af6e32df2..2a7aecd330 100644
--- a/tests/config/config_test.py
+++ b/tests/config/config_test.py
@@ -471,6 +471,32 @@ class Test_Config:
         all_frameworks = get_available_compliance_frameworks()
         assert "csa_ccm_4.0" in all_frameworks
 
+    @mock.patch("prowler.config.config._get_ep_compliance_dirs")
+    def test_get_available_compliance_frameworks_dedupes_ep_collisions_with_builtins(
+        self, mock_dirs
+    ):
+        """Entry-point compliance frameworks that collide with a built-in
+        name must appear only once in the available frameworks list.
+        Built-in wins silently — same policy as the universal frameworks
+        loop and as Compliance.get_bulk."""
+        import json
+        import tempfile
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            # cis_2.0_aws ships as a built-in under prowler/compliance/aws/
+            json_path = os.path.join(tmpdir, "cis_2.0_aws.json")
+            with open(json_path, "w") as f:
+                json.dump({"Framework": "CIS", "Provider": "aws"}, f)
+
+            mock_dirs.return_value = {"aws": tmpdir}
+
+            frameworks = get_available_compliance_frameworks("aws")
+
+            assert frameworks.count("cis_2.0_aws") == 1, (
+                f"Expected cis_2.0_aws to appear exactly once, got "
+                f"{frameworks.count('cis_2.0_aws')} occurrences in: {frameworks}"
+            )
+
     def test_load_and_validate_config_file_aws(self):
         path = pathlib.Path(os.path.dirname(os.path.realpath(__file__)))
         config_test_file = f"{path}/fixtures/config.yaml"
@@ -508,6 +534,32 @@ class Test_Config:
         assert load_and_validate_config_file("azure", config_test_file) == {}
         assert load_and_validate_config_file("kubernetes", config_test_file) == {}
 
+    def test_load_and_validate_config_file_namespaced_non_listed_provider(self):
+        path = pathlib.Path(os.path.dirname(os.path.realpath(__file__)))
+        config_test_file = f"{path}/fixtures/config_namespaced_external.yaml"
+        # github is a built-in not in the legacy hardcoded list; namespaced format must unwrap it.
+        assert load_and_validate_config_file("github", config_test_file) == {
+            "token": "abc",
+            "org": "prowler-cloud",
+        }
+
+    def test_load_and_validate_config_file_namespaced_external_provider(self):
+        path = pathlib.Path(os.path.dirname(os.path.realpath(__file__)))
+        config_test_file = f"{path}/fixtures/config_namespaced_external.yaml"
+        # External plug-in provider: namespaced format must unwrap its block.
+        assert load_and_validate_config_file("custom_plugin", config_test_file) == {
+            "setting": "value",
+            "nested": {"key": 42},
+        }
+
+    def test_load_and_validate_config_file_namespaced_missing_provider(self):
+        path = pathlib.Path(os.path.dirname(os.path.realpath(__file__)))
+        config_test_file = f"{path}/fixtures/config_namespaced_external.yaml"
+        # Provider with no section in a namespaced file must return empty config,
+        # not the full file (prevents cross-provider config leakage).
+        assert load_and_validate_config_file("aws", config_test_file) == {}
+        assert load_and_validate_config_file("gcp", config_test_file) == {}
+
     def test_load_and_validate_config_file_invalid_config_file_path(self, caplog):
         provider = "aws"
         config_file_path = "invalid/path/to/fixer_config.yaml"
diff --git a/tests/config/fixtures/config_namespaced_external.yaml b/tests/config/fixtures/config_namespaced_external.yaml
new file mode 100644
index 0000000000..ec9f75c698
--- /dev/null
+++ b/tests/config/fixtures/config_namespaced_external.yaml
@@ -0,0 +1,8 @@
+# Namespaced config covering a non-listed built-in (github) and an external plugin.
+github:
+  token: abc
+  org: prowler-cloud
+custom_plugin:
+  setting: value
+  nested:
+    key: 42
diff --git a/tests/dashboard/__init__.py b/tests/dashboard/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/dashboard/common_methods_test.py b/tests/dashboard/common_methods_test.py
new file mode 100644
index 0000000000..b2137589c5
--- /dev/null
+++ b/tests/dashboard/common_methods_test.py
@@ -0,0 +1,81 @@
+import pandas as pd
+from dash import dash_table
+
+from dashboard.common_methods import get_section_containers_generic
+
+
+def _datatable_column_ids(component):
+    """Collect the column ids of every DataTable in a Dash component tree."""
+    if isinstance(component, dash_table.DataTable):
+        return [[c["id"] for c in component.columns]]
+    children = getattr(component, "children", None)
+    if children is None:
+        return []
+    if not isinstance(children, (list, tuple)):
+        children = [children]
+    return [cols for child in children for cols in _datatable_column_ids(child)]
+
+
+def _df(**extra):
+    data = {
+        "REQUIREMENTS_ID": ["req1"],
+        "STATUS": ["PASS"],
+        "CHECKID": ["check1"],
+        "REGION": ["us-east-1"],
+        "ACCOUNTID": ["123"],
+        "RESOURCEID": ["res1"],
+    }
+    data.update(extra)
+    return pd.DataFrame(data)
+
+
+class TestGetSectionContainersGeneric:
+    def test_one_container_per_section(self):
+        """One outer container per distinct section value."""
+        df = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec A", "Sec B"],
+                "REQUIREMENTS_ID": ["req1", "req2", "req3"],
+                "STATUS": ["PASS", "FAIL", "PASS"],
+                "CHECKID": ["c1", "c2", "c3"],
+                "REGION": ["-"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+                "RESOURCEID": ["r1", "r2", "r3"],
+            }
+        )
+        result = get_section_containers_generic(
+            df, "REQUIREMENTS_ATTRIBUTES_SECTION", "REQUIREMENTS_ID"
+        )
+        assert len(result.children) == 2
+
+    def test_inner_title_includes_id_and_description(self):
+        """Inner accordion title is '<id> - <description>'."""
+        df = _df(
+            REQUIREMENTS_ATTRIBUTES_SECTION=["Sec A"],
+            REQUIREMENTS_DESCRIPTION=["Ensure MFA"],
+        )
+        rendered = str(
+            get_section_containers_generic(
+                df, "REQUIREMENTS_ATTRIBUTES_SECTION", "REQUIREMENTS_ID"
+            )
+        )
+        assert "req1 - Ensure MFA" in rendered
+
+    def test_arbitrary_ids_do_not_crash(self):
+        """Non-numeric ids are sorted lexicographically without raising."""
+        df = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A"] * 3,
+                "REQUIREMENTS_ID": ["AC-2(1)", "foo-bar", "step.1.2"],
+                "STATUS": ["PASS", "FAIL", "PASS"],
+                "CHECKID": ["c1", "c2", "c3"],
+                "REGION": ["-"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+                "RESOURCEID": ["r1", "r2", "r3"],
+            }
+        )
+        result = get_section_containers_generic(
+            df, "REQUIREMENTS_ATTRIBUTES_SECTION", "REQUIREMENTS_ID"
+        )
+        tables = _datatable_column_ids(result)
+        assert tables and all("CHECKID" in cols for cols in tables)
diff --git a/tests/dashboard/compliance/__init__.py b/tests/dashboard/compliance/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/dashboard/compliance/generic_test.py b/tests/dashboard/compliance/generic_test.py
new file mode 100644
index 0000000000..4e36833ada
--- /dev/null
+++ b/tests/dashboard/compliance/generic_test.py
@@ -0,0 +1,204 @@
+import pandas as pd
+from dash import dash_table, html
+
+from dashboard.compliance.generic import get_table
+
+
+def _make_minimal_df(**extra_cols):
+    """Create a minimal valid DataFrame for get_table tests."""
+    data = {
+        "REQUIREMENTS_ID": ["req1"],
+        "STATUS": ["PASS"],
+        "CHECKID": ["check1"],
+        "REGION": ["us-east-1"],
+        "ACCOUNTID": ["123456789"],
+        "RESOURCEID": ["res1"],
+    }
+    data.update(extra_cols)
+    return pd.DataFrame(data)
+
+
+def _datatable_column_ids(component):
+    """Collect the column ids of every DataTable in a Dash component tree."""
+    if isinstance(component, dash_table.DataTable):
+        return [[c["id"] for c in component.columns]]
+    children = getattr(component, "children", None)
+    if children is None:
+        return []
+    if not isinstance(children, (list, tuple)):
+        children = [children]
+    return [cols for child in children for cols in _datatable_column_ids(child)]
+
+
+class TestGetTable:
+    def test_groups_by_section(self):
+        """SC-001a: df with REQUIREMENTS_ATTRIBUTES_SECTION returns Div grouped by section."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": [
+                    "Section A",
+                    "Section A",
+                    "Section A",
+                    "Section B",
+                    "Section B",
+                ],
+                "REQUIREMENTS_ID": [
+                    "ctrl-alpha",
+                    "ctrl-alpha",
+                    "ctrl-alpha",
+                    "ctrl-beta",
+                    "ctrl-beta",
+                ],
+                "STATUS": ["PASS", "FAIL", "PASS", "FAIL", "FAIL"],
+                "CHECKID": ["check1", "check2", "check3", "check4", "check5"],
+                "REGION": ["us-east-1"] * 5,
+                "ACCOUNTID": ["123"] * 5,
+                "RESOURCEID": ["res1", "res2", "res3", "res4", "res5"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert result.className == "compliance-data-layout"
+        assert len(result.children) == 2  # one container per distinct section
+
+    def test_flat_fallback_no_attributes(self):
+        """SC-001b: No REQUIREMENTS_ATTRIBUTES_* cols → grouped by REQUIREMENTS_ID."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ID": ["req1", "req1", "req2"],
+                "STATUS": ["PASS", "FAIL", "FAIL"],
+                "CHECKID": ["check1", "check2", "check3"],
+                "REGION": ["us-east-1"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+                "RESOURCEID": ["res1", "res2", "res3"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert result.className == "compliance-data-layout"
+        # 2 distinct REQUIREMENTS_ID values → 2 group containers
+        assert len(result.children) == 2
+
+    def test_arbitrary_ids_no_crash(self):
+        """ADR-2 / R1 regression guard: non-numeric REQUIREMENTS_IDs must not raise ValueError.
+
+        get_section_containers_cis sorts by version_tuple which calls int() on each
+        dotted/dashed segment and crashes on IDs like 'AC-2(1)'. Selecting format4
+        (no version sort) is the fix. This test is a permanent guard against regression.
+        """
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ID": ["AC-2(1)", "foo-bar", "step.1.2"],
+                "STATUS": ["PASS", "FAIL", "PASS"],
+                "CHECKID": ["check1", "check2", "check3"],
+                "REGION": ["us-east-1"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+                "RESOURCEID": ["res1", "res2", "res3"],
+            }
+        )
+        # Must not raise ValueError
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+
+    def test_discovers_multiple_attribute_columns(self):
+        """SC-005a: Multiple REQUIREMENTS_ATTRIBUTES_* cols present → no AttributeError;
+        component tree is non-empty."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec B"],
+                "REQUIREMENTS_ATTRIBUTES_CATEGORY": ["Cat 1", "Cat 2"],
+                "REQUIREMENTS_ATTRIBUTES_CONTROL_ID": ["C1", "C2"],
+                "REQUIREMENTS_ID": ["req1", "req2"],
+                "STATUS": ["PASS", "FAIL"],
+                "CHECKID": ["check1", "check2"],
+                "REGION": ["us-east-1"] * 2,
+                "ACCOUNTID": ["123"] * 2,
+                "RESOURCEID": ["res1", "res2"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert result.children  # non-empty component tree
+
+    def test_novel_attribute_column_names(self):
+        """SC-005b: Novel attr col names without a SECTION col → first attr col used as
+        grouping; returns a valid html.Div without any code change required."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_DOMAIN": ["Domain A", "Domain B"],
+                "REQUIREMENTS_ATTRIBUTES_SUBDOMAIN": ["Sub 1", "Sub 2"],
+                "REQUIREMENTS_ID": ["req1", "req2"],
+                "STATUS": ["PASS", "FAIL"],
+                "CHECKID": ["check1", "check2"],
+                "REGION": ["us-east-1"] * 2,
+                "ACCOUNTID": ["123"] * 2,
+                "RESOURCEID": ["res1", "res2"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert len(result.children) > 0
+
+    def test_manual_only_requirements(self):
+        """SC-008a: All rows have STATUS='MANUAL' → returns html.Div with non-empty
+        children; result is not the 'No data found' string."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec B"],
+                "REQUIREMENTS_ID": ["req1", "req2"],
+                "STATUS": ["MANUAL", "MANUAL"],
+                "CHECKID": ["check1", "check2"],
+                "REGION": ["us-east-1"] * 2,
+                "ACCOUNTID": ["123"] * 2,
+                "RESOURCEID": ["res1", "res2"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert not isinstance(result, str)
+        assert result.children  # non-empty
+
+    def test_empty_dataframe(self):
+        """SC-009a: Zero rows with correct column schema → valid html.Div; no exception."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": pd.Series([], dtype=str),
+                "REQUIREMENTS_ID": pd.Series([], dtype=str),
+                "STATUS": pd.Series([], dtype=str),
+                "CHECKID": pd.Series([], dtype=str),
+                "REGION": pd.Series([], dtype=str),
+                "ACCOUNTID": pd.Series([], dtype=str),
+                "RESOURCEID": pd.Series([], dtype=str),
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+
+    def test_get_table_returns_html_div(self):
+        """SC-012a: Smoke test — isinstance(get_table(df), html.Div) is True."""
+        data = _make_minimal_df(
+            REQUIREMENTS_ATTRIBUTES_SECTION=["Sec A"],
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+
+
+class TestNestedRendering:
+    def test_section_and_requirement_id_are_separate_levels(self):
+        """Section is the outer level; requirement id + description the inner."""
+        data = _make_minimal_df(
+            REQUIREMENTS_ATTRIBUTES_SECTION=["3 Compute Services"],
+            REQUIREMENTS_DESCRIPTION=["Ensure only MFA enabled identities"],
+        )
+        rendered = str(get_table(data))
+        assert "3 Compute Services" in rendered
+        assert "req1 - Ensure only MFA enabled identities" in rendered
+
+    def test_checks_table_is_nested_under_requirement(self):
+        """The checks table sits at the innermost level."""
+        data = _make_minimal_df(
+            REQUIREMENTS_ATTRIBUTES_SECTION=["Sec A"],
+            REQUIREMENTS_DESCRIPTION=["Some requirement"],
+        )
+        tables = _datatable_column_ids(get_table(data))
+        assert tables and all("CHECKID" in cols for cols in tables)
diff --git a/tests/dashboard/pages/__init__.py b/tests/dashboard/pages/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/dashboard/pages/compliance_dispatch_test.py b/tests/dashboard/pages/compliance_dispatch_test.py
new file mode 100644
index 0000000000..78bd88ce68
--- /dev/null
+++ b/tests/dashboard/pages/compliance_dispatch_test.py
@@ -0,0 +1,179 @@
+from unittest.mock import MagicMock, patch
+
+import pandas as pd
+import pytest
+from dash import html
+
+from dashboard.pages.compliance import _dispatch_compliance_renderer
+
+
+def _make_dispatch_df(**extra_cols):
+    """Minimal DataFrame with the columns required by the dedup step."""
+    data = {
+        "REQUIREMENTS_ID": ["req1", "req2"],
+        "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec A"],
+        "STATUS": ["PASS", "FAIL"],
+        "CHECKID": ["check1", "check2"],
+        "RESOURCEID": ["res1", "res2"],
+        "STATUSEXTENDED": ["", ""],
+        "REGION": ["us-east-1", "us-east-1"],
+        "ACCOUNTID": ["123456789", "123456789"],
+    }
+    data.update(extra_cols)
+    return pd.DataFrame(data)
+
+
+class TestDispatchComplianceRenderer:
+    def test_builtin_name_uses_builtin_module(self):
+        """SC-002a: analytics_input='cis_4_0_aws' resolves real builtin module;
+        returns (html.Div, DataFrame) 2-tuple."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ID": ["1.1", "1.2"],
+                "REQUIREMENTS_DESCRIPTION": ["Description 1", "Description 2"],
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Section A", "Section A"],
+                "CHECKID": ["check1", "check2"],
+                "STATUS": ["PASS", "FAIL"],
+                "REGION": ["us-east-1", "us-east-1"],
+                "ACCOUNTID": ["123456789", "123456789"],
+                "RESOURCEID": ["res1", "res2"],
+                "STATUSEXTENDED": ["Pass", "Fail"],
+            }
+        )
+        table, result_data = _dispatch_compliance_renderer(data, "cis_4_0_aws")
+        assert isinstance(table, html.Div)
+        assert isinstance(result_data, pd.DataFrame)
+
+    def test_unknown_name_falls_back_to_generic(self):
+        """SC-003a: Unknown analytics_input raises ModuleNotFoundError → generic
+        fallback is called with the deduped dataframe."""
+        data = _make_dispatch_df()
+        sentinel = MagicMock(
+            return_value=html.Div([], className="compliance-data-layout")
+        )
+
+        with patch("dashboard.compliance.generic.get_table", sentinel):
+            table, result_data = _dispatch_compliance_renderer(data, "myfw_dynprovider")
+
+        sentinel.assert_called_once()
+        assert isinstance(table, html.Div)
+        assert isinstance(result_data, pd.DataFrame)
+
+    def test_import_error_is_not_swallowed(self):
+        """SC-003b: ImportError (NOT ModuleNotFoundError) is re-raised; except clause
+        is exact — only ModuleNotFoundError routes to generic."""
+        data = _make_dispatch_df()
+
+        with patch(
+            "dashboard.pages.compliance.importlib.import_module",
+            side_effect=ImportError("custom error"),
+        ):
+            with pytest.raises(ImportError, match="custom error"):
+                _dispatch_compliance_renderer(data, "anything")
+
+    def test_get_table_error_in_generic_surfaces(self):
+        """SC-004a: ValueError from generic.get_table propagates (not swallowed);
+        get_table is called OUTSIDE the try block."""
+        data = _make_dispatch_df()
+
+        with patch(
+            "dashboard.compliance.generic.get_table",
+            side_effect=ValueError("boom"),
+        ):
+            with pytest.raises(ValueError, match="boom"):
+                _dispatch_compliance_renderer(data, "myfw_dynprovider")
+
+    def test_get_table_error_in_builtin_surfaces(self):
+        """REQ-004 / ADR-1: RuntimeError from a builtin get_table propagates;
+        proving get_table is called outside the try block."""
+        data = _make_dispatch_df()
+        mock_module = MagicMock()
+        mock_module.get_table.side_effect = RuntimeError("table error")
+
+        with patch(
+            "dashboard.pages.compliance.importlib.import_module",
+            return_value=mock_module,
+        ):
+            with pytest.raises(RuntimeError, match="table error"):
+                _dispatch_compliance_renderer(data, "some_builtin_fw")
+
+    def test_dedup_applied_before_get_table(self):
+        """ADR-1: Duplicate rows (identical CHECKID/STATUS/RESOURCEID/STATUSEXTENDED)
+        are dropped; returned data has the deduplicated row count."""
+        # Row 0 and row 1 are identical in all dedup-key columns; row 2 is unique.
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec A", "Sec B"],
+                "REQUIREMENTS_ID": ["req1", "req1", "req2"],
+                "STATUS": ["PASS", "PASS", "FAIL"],
+                "CHECKID": ["check1", "check1", "check2"],
+                "RESOURCEID": ["res1", "res1", "res2"],
+                "STATUSEXTENDED": ["", "", ""],
+                "REGION": ["us-east-1"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+            }
+        )
+        mock_module = MagicMock()
+        mock_module.get_table.return_value = html.Div([])
+
+        with patch(
+            "dashboard.pages.compliance.importlib.import_module",
+            return_value=mock_module,
+        ):
+            table, result_data = _dispatch_compliance_renderer(data, "some_fw")
+
+        assert len(result_data) == 2  # one duplicate removed
+
+    def test_muted_column_added_to_dedup_when_present(self):
+        """ADR-1 edge case: When MUTED column is present, it is included in the dedup
+        subset at index 2; rows differing only in MUTED are kept as distinct rows."""
+        # Both rows share CHECKID/STATUS/RESOURCEID/STATUSEXTENDED but differ in MUTED.
+        # With MUTED in dedup_columns, both rows are kept (2 rows after dedup).
+        # Without MUTED in dedup_columns, they would be collapsed to 1 row.
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec A"],
+                "REQUIREMENTS_ID": ["req1", "req1"],
+                "STATUS": ["PASS", "PASS"],
+                "CHECKID": ["check1", "check1"],
+                "RESOURCEID": ["res1", "res1"],
+                "STATUSEXTENDED": ["", ""],
+                "MUTED": ["True", "False"],
+                "REGION": ["us-east-1", "us-east-1"],
+                "ACCOUNTID": ["123", "123"],
+            }
+        )
+        mock_module = MagicMock()
+        mock_module.get_table.return_value = html.Div([])
+
+        with patch(
+            "dashboard.pages.compliance.importlib.import_module",
+            return_value=mock_module,
+        ):
+            table, result_data = _dispatch_compliance_renderer(data, "some_fw")
+
+        # MUTED at idx 2 means these two rows have different dedup keys → both kept
+        assert len(result_data) == 2
+
+    def test_returns_table_and_data_tuple(self):
+        """ADR-1 interface contract: _dispatch_compliance_renderer returns a
+        2-tuple (table, deduped_data)."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ID": ["1.1", "1.2"],
+                "REQUIREMENTS_DESCRIPTION": ["Desc 1", "Desc 2"],
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Section A", "Section A"],
+                "CHECKID": ["check1", "check2"],
+                "STATUS": ["PASS", "FAIL"],
+                "REGION": ["us-east-1", "us-east-1"],
+                "ACCOUNTID": ["123456789", "123456789"],
+                "RESOURCEID": ["res1", "res2"],
+                "STATUSEXTENDED": ["", ""],
+            }
+        )
+        result = _dispatch_compliance_renderer(data, "cis_4_0_aws")
+        assert isinstance(result, tuple)
+        assert len(result) == 2
+        table, deduped_data = result
+        assert isinstance(table, html.Div)
+        assert isinstance(deduped_data, pd.DataFrame)
diff --git a/tests/dashboard/pages/conftest.py b/tests/dashboard/pages/conftest.py
new file mode 100644
index 0000000000..a5c674c7de
--- /dev/null
+++ b/tests/dashboard/pages/conftest.py
@@ -0,0 +1,7 @@
+import dash
+
+# Initialize a minimal Dash app so that dashboard page modules can call
+# dash.register_page() during import without raising PageError.
+# This module-level initialization runs during pytest collection, before
+# any test file in this directory is imported.
+_test_app = dash.Dash("prowler_test_app", use_pages=True, pages_folder="")
diff --git a/tests/dashboard/pages/scope_columns_test.py b/tests/dashboard/pages/scope_columns_test.py
new file mode 100644
index 0000000000..a8aea34221
--- /dev/null
+++ b/tests/dashboard/pages/scope_columns_test.py
@@ -0,0 +1,60 @@
+import pandas as pd
+
+from dashboard.pages.compliance import _ensure_scope_columns
+
+
+def _df(columns):
+    """Build a one-row DataFrame preserving the given column order."""
+    return pd.DataFrame({col: ["x"] for col in columns})
+
+
+class TestEnsureScopeColumns:
+    def test_aws_account_and_region_preserved(self):
+        """A provider that already emits ACCOUNTID and REGION is left untouched."""
+        df = _df(["PROVIDER", "DESCRIPTION", "ACCOUNTID", "REGION", "ASSESSMENTDATE"])
+        result = _ensure_scope_columns(df)
+        assert "ACCOUNTID" in result.columns
+        assert "REGION" in result.columns
+        assert result["ACCOUNTID"].iloc[0] == "x"
+
+    def test_okta_single_scope_column_becomes_accountid(self):
+        """Okta's ORGANIZATIONDOMAIN becomes ACCOUNTID; REGION falls back."""
+        df = _df(["PROVIDER", "DESCRIPTION", "ORGANIZATIONDOMAIN", "ASSESSMENTDATE"])
+        df["ORGANIZATIONDOMAIN"] = ["trial-123.okta.com"]
+        result = _ensure_scope_columns(df)
+        assert "ACCOUNTID" in result.columns
+        assert "ORGANIZATIONDOMAIN" not in result.columns
+        assert result["ACCOUNTID"].iloc[0] == "trial-123.okta.com"
+        assert result["REGION"].iloc[0] == "-"
+
+    def test_two_unknown_scope_columns_map_to_account_and_region(self):
+        """Two scope columns map positionally to ACCOUNTID and REGION."""
+        df = _df(["PROVIDER", "DESCRIPTION", "TENANCYID", "LOCATION", "ASSESSMENTDATE"])
+        df["TENANCYID"] = ["tenant-1"]
+        df["LOCATION"] = ["eu-west-1"]
+        result = _ensure_scope_columns(df)
+        assert result["ACCOUNTID"].iloc[0] == "tenant-1"
+        assert result["REGION"].iloc[0] == "eu-west-1"
+
+    def test_no_scope_columns_fall_back_to_dash(self):
+        """No scope columns → both ACCOUNTID and REGION fall back to '-'."""
+        df = _df(["PROVIDER", "DESCRIPTION", "ASSESSMENTDATE"])
+        result = _ensure_scope_columns(df)
+        assert result["ACCOUNTID"].iloc[0] == "-"
+        assert result["REGION"].iloc[0] == "-"
+
+    def test_missing_anchors_still_fall_back_to_dash(self):
+        """Without DESCRIPTION/ASSESSMENTDATE anchors, both fall back to '-'."""
+        df = _df(["PROVIDER", "FOO", "BAR"])
+        result = _ensure_scope_columns(df)
+        assert result["ACCOUNTID"].iloc[0] == "-"
+        assert result["REGION"].iloc[0] == "-"
+
+    def test_existing_accountid_does_not_consume_region_scope(self):
+        """An existing ACCOUNTID is kept; the leftover scope becomes REGION."""
+        df = _df(["PROVIDER", "DESCRIPTION", "ACCOUNTID", "LOCATION", "ASSESSMENTDATE"])
+        df["ACCOUNTID"] = ["acc-1"]
+        df["LOCATION"] = ["us-east-2"]
+        result = _ensure_scope_columns(df)
+        assert result["ACCOUNTID"].iloc[0] == "acc-1"
+        assert result["REGION"].iloc[0] == "us-east-2"
diff --git a/tests/lib/check/compliance_check_test.py b/tests/lib/check/compliance_check_test.py
index 73f93e3b38..631c134302 100644
--- a/tests/lib/check/compliance_check_test.py
+++ b/tests/lib/check/compliance_check_test.py
@@ -540,7 +540,9 @@ class TestCompliance:
     ):
         object = mock.Mock()
         object.path = "/path/to/compliance"
-        object.name = "framework1_aws"
+        # list_compliance_modules yields dotted module names; get_bulk matches
+        # the last segment exactly against the provider.
+        object.name = "prowler.compliance.aws"
         mock_list_modules.return_value = [object]
 
         mock_listdir.return_value = ["framework1_aws.json"]
diff --git a/tests/lib/check/models_test.py b/tests/lib/check/models_test.py
index 71fd1f718b..f17e359441 100644
--- a/tests/lib/check/models_test.py
+++ b/tests/lib/check/models_test.py
@@ -95,6 +95,38 @@ class TestCheckMetada:
             "/path/to/accessanalyzer_enabled/accessanalyzer_enabled.metadata.json"
         )
 
+    @mock.patch("prowler.lib.check.models.logger")
+    @mock.patch("prowler.lib.check.models.load_check_metadata")
+    @mock.patch("prowler.lib.check.models.recover_checks_from_provider")
+    def test_get_bulk_builtin_wins_on_check_id_collision(
+        self, mock_recover_checks, mock_load_metadata, mock_logger
+    ):
+        """Regression guard: when an entry-point plug-in re-registers a
+        built-in CheckID, the BUILT-IN metadata wins (first-write-wins) and
+        the plug-in is IGNORED. The override is surfaced via a warning so
+        the user knows their plug-in duplicate is being skipped and can
+        rename it. Matches the precedence in `_resolve_check_module`. See
+        PR #10700 review (HugoPBrito)."""
+        # Built-in first, plug-in last (matches recover_checks_from_provider order)
+        mock_recover_checks.return_value = [
+            ("accessanalyzer_enabled", "/builtin/accessanalyzer_enabled"),
+            ("accessanalyzer_enabled", "/plugin/accessanalyzer_enabled"),
+        ]
+
+        builtin_metadata = mock.MagicMock(CheckID="accessanalyzer_enabled")
+        plugin_metadata = mock.MagicMock(CheckID="accessanalyzer_enabled")
+        mock_load_metadata.side_effect = [builtin_metadata, plugin_metadata]
+
+        result = CheckMetadata.get_bulk(provider="aws")
+
+        # Built-in wins (first-write-wins on CheckID), plug-in is ignored
+        assert result["accessanalyzer_enabled"] is builtin_metadata
+        # Override is surfaced via warning naming the plug-in metadata file
+        mock_logger.warning.assert_called_once()
+        warning_msg = mock_logger.warning.call_args.args[0]
+        assert "accessanalyzer_enabled" in warning_msg
+        assert "/plugin/accessanalyzer_enabled" in warning_msg
+
     @mock.patch("prowler.lib.check.models.load_check_metadata")
     @mock.patch("prowler.lib.check.models.recover_checks_from_provider")
     def test_list(self, mock_recover_checks, mock_load_metadata):
diff --git a/tests/lib/check/tool_wrapper_test.py b/tests/lib/check/tool_wrapper_test.py
new file mode 100644
index 0000000000..5f4f0c7f88
--- /dev/null
+++ b/tests/lib/check/tool_wrapper_test.py
@@ -0,0 +1,124 @@
+"""Unit tests for prowler.lib.check.tool_wrapper.
+
+Covers the leaf helper directly (Provider.is_tool_wrapper_provider delegates
+to it). Tests the frozenset fast path, the entry-point fallback for external
+plug-ins, the broken-plug-in path, the no-match path, and the module-level
+cache.
+"""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def _clear_ep_class_cache():
+    """Reset the leaf module's cache between tests so they stay independent."""
+    from prowler.lib.check import tool_wrapper
+
+    tool_wrapper._ep_class_cache.clear()
+    yield
+    tool_wrapper._ep_class_cache.clear()
+
+
+def _make_entry_point(name, cls):
+    """Create a mock entry point whose `load()` returns `cls`."""
+    ep = MagicMock()
+    ep.name = name
+    ep.load.return_value = cls
+    return ep
+
+
+class TestIsToolWrapperProvider:
+    """is_tool_wrapper_provider: frozenset + entry-point fallback."""
+
+    @pytest.mark.parametrize("name", ["iac", "llm", "image"])
+    def test_returns_true_for_builtin_tool_wrappers(self, name):
+        from prowler.lib.check.tool_wrapper import is_tool_wrapper_provider
+
+        assert is_tool_wrapper_provider(name) is True
+
+    @pytest.mark.parametrize("name", ["aws", "azure", "gcp", "github", "kubernetes"])
+    def test_returns_false_for_regular_builtins(self, name):
+        from prowler.lib.check.tool_wrapper import is_tool_wrapper_provider
+
+        assert is_tool_wrapper_provider(name) is False
+
+    @patch("prowler.lib.check.tool_wrapper.importlib.metadata.entry_points")
+    def test_returns_true_for_external_plugin_with_flag(self, mock_eps):
+        from prowler.lib.check.tool_wrapper import is_tool_wrapper_provider
+
+        cls = MagicMock(is_external_tool_provider=True)
+        mock_eps.return_value = [_make_entry_point("custom_wrapper", cls)]
+
+        assert is_tool_wrapper_provider("custom_wrapper") is True
+
+    @patch("prowler.lib.check.tool_wrapper.importlib.metadata.entry_points")
+    def test_returns_false_for_external_plugin_without_flag(self, mock_eps):
+        from prowler.lib.check.tool_wrapper import is_tool_wrapper_provider
+
+        cls = MagicMock(is_external_tool_provider=False)
+        mock_eps.return_value = [_make_entry_point("vanilla_external", cls)]
+
+        assert is_tool_wrapper_provider("vanilla_external") is False
+
+    @patch("prowler.lib.check.tool_wrapper.importlib.metadata.entry_points")
+    def test_returns_false_for_unknown_provider(self, mock_eps):
+        from prowler.lib.check.tool_wrapper import is_tool_wrapper_provider
+
+        mock_eps.return_value = []
+
+        assert is_tool_wrapper_provider("does-not-exist") is False
+
+    @patch("prowler.lib.check.tool_wrapper.importlib.metadata.entry_points")
+    def test_builtin_name_shortcircuits_before_loading_same_name_plugin(self, mock_eps):
+        """A plug-in registered under a built-in's name cannot flip the
+        built-in onto the tool-wrapper path, and its module is never loaded."""
+        from prowler.lib.check.tool_wrapper import is_tool_wrapper_provider
+
+        malicious = _make_entry_point("aws", MagicMock(is_external_tool_provider=True))
+        mock_eps.return_value = [malicious]
+
+        # `aws` is a built-in, so classification short-circuits to False...
+        assert is_tool_wrapper_provider("aws") is False
+        # ...and the shadowing plug-in's code is never executed via ep.load().
+        malicious.load.assert_not_called()
+
+
+class TestLoadEpClass:
+    """_load_ep_class: cache, broken plug-ins, no-match."""
+
+    @patch("prowler.lib.check.tool_wrapper.importlib.metadata.entry_points")
+    def test_caches_result_across_calls(self, mock_eps):
+        from prowler.lib.check.tool_wrapper import _load_ep_class
+
+        cls = MagicMock(is_external_tool_provider=True)
+        mock_eps.return_value = [_make_entry_point("cached_one", cls)]
+
+        first = _load_ep_class("cached_one")
+        second = _load_ep_class("cached_one")
+
+        assert first is cls
+        assert second is cls
+        # entry_points consulted only on the first call
+        assert mock_eps.call_count == 1
+
+    @patch("prowler.lib.check.tool_wrapper.importlib.metadata.entry_points")
+    def test_returns_none_for_broken_plugin(self, mock_eps):
+        from prowler.lib.check.tool_wrapper import _load_ep_class
+
+        broken_ep = MagicMock()
+        broken_ep.name = "broken"
+        broken_ep.load.side_effect = ImportError("plug-in is broken")
+        mock_eps.return_value = [broken_ep]
+
+        assert _load_ep_class("broken") is None
+
+    @patch("prowler.lib.check.tool_wrapper.importlib.metadata.entry_points")
+    def test_returns_none_when_no_entry_point_matches(self, mock_eps):
+        from prowler.lib.check.tool_wrapper import _load_ep_class
+
+        cls = MagicMock()
+        mock_eps.return_value = [_make_entry_point("other_provider", cls)]
+
+        assert _load_ep_class("missing_provider") is None
diff --git a/tests/lib/check/universal_compliance_models_test.py b/tests/lib/check/universal_compliance_models_test.py
index 5a3e4aae56..c8f614488c 100644
--- a/tests/lib/check/universal_compliance_models_test.py
+++ b/tests/lib/check/universal_compliance_models_test.py
@@ -1,5 +1,7 @@
 import json
 import os
+import tempfile
+from unittest.mock import MagicMock, patch
 
 import pytest
 from pydantic.v1 import ValidationError
@@ -23,6 +25,7 @@ from prowler.lib.check.compliance_models import (
     TableLabels,
     UniversalComplianceRequirement,
     adapt_legacy_to_universal,
+    get_bulk_compliance_frameworks_universal,
     load_compliance_framework_universal,
 )
 from tests.lib.outputs.compliance.fixtures import (
@@ -1116,3 +1119,121 @@ class TestAttributesMetadataValidation:
                 ],
                 attributes_metadata=self._metadata(enum=["high", "low"]),
             )
+
+
+class TestGetBulkUniversalEntryPoints:
+    """Entry-point discovery for universal (multi-provider) compliance frameworks."""
+
+    @staticmethod
+    def _write_universal_json(directory, filename, framework, display_name):
+        data = {
+            "framework": framework,
+            "name": display_name,
+            "version": "1.0",
+            "description": "External multi-provider framework",
+            "requirements": [
+                {
+                    "id": "1",
+                    "name": "Requirement 1",
+                    "description": "desc",
+                    "checks": {"fakeexternal": ["check_a"]},
+                }
+            ],
+        }
+        with open(os.path.join(directory, filename), "w") as f:
+            json.dump(data, f)
+
+    @staticmethod
+    def _entry_point(path):
+        module = MagicMock()
+        module.__path__ = [path]
+        ep = MagicMock()
+        ep.name = "fakeexternal"
+        ep.group = "prowler.compliance.universal"
+        ep.load.return_value = module
+        return ep
+
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_includes_external_universal_framework(self, mock_list_modules, mock_ep):
+        mock_list_modules.return_value = []
+        with tempfile.TemporaryDirectory() as ep_dir:
+            self._write_universal_json(
+                ep_dir, "customuniversal_1.0.json", "CustomUniversal", "Custom"
+            )
+            mock_ep.return_value = [self._entry_point(ep_dir)]
+
+            bulk = get_bulk_compliance_frameworks_universal("fakeexternal")
+
+        mock_ep.assert_called_with(group="prowler.compliance.universal")
+        assert "customuniversal_1.0" in bulk
+        assert bulk["customuniversal_1.0"].framework == "CustomUniversal"
+
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_builtin_wins_over_external_on_name_collision(
+        self, mock_list_modules, mock_ep
+    ):
+        with (
+            tempfile.TemporaryDirectory() as root,
+            tempfile.TemporaryDirectory() as ep_dir,
+        ):
+            builtin_sub = os.path.join(root, "builtinprov")
+            os.makedirs(builtin_sub)
+            self._write_universal_json(
+                builtin_sub, "shared_1.0.json", "SharedFramework", "Built-in"
+            )
+            builtin_module = MagicMock()
+            builtin_module.module_finder.path = root
+            builtin_module.name = "prowler.compliance.builtinprov"
+            mock_list_modules.return_value = [builtin_module]
+
+            self._write_universal_json(
+                ep_dir, "shared_1.0.json", "SharedFramework", "External"
+            )
+            mock_ep.return_value = [self._entry_point(ep_dir)]
+
+            bulk = get_bulk_compliance_frameworks_universal("fakeexternal")
+
+        assert "shared_1.0" in bulk
+        assert bulk["shared_1.0"].name == "Built-in"
+
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_loads_all_frameworks_in_a_single_entry_point_path(
+        self, mock_list_modules, mock_ep
+    ):
+        """All JSONs in one entry-point directory are added, not collapsed to one."""
+        mock_list_modules.return_value = []
+        with tempfile.TemporaryDirectory() as ep_dir:
+            self._write_universal_json(ep_dir, "fw_a_1.0.json", "FwA", "Framework A")
+            self._write_universal_json(ep_dir, "fw_b_1.0.json", "FwB", "Framework B")
+            mock_ep.return_value = [self._entry_point(ep_dir)]
+
+            bulk = get_bulk_compliance_frameworks_universal("fakeexternal")
+
+        assert "fw_a_1.0" in bulk
+        assert "fw_b_1.0" in bulk
+
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_merges_frameworks_from_multiple_packages_same_provider(
+        self, mock_list_modules, mock_ep
+    ):
+        """Two packages under the same provider name are both discovered."""
+        mock_list_modules.return_value = []
+        with (
+            tempfile.TemporaryDirectory() as dir_a,
+            tempfile.TemporaryDirectory() as dir_b,
+        ):
+            self._write_universal_json(dir_a, "pkg_a_1.0.json", "PkgA", "Package A")
+            self._write_universal_json(dir_b, "pkg_b_1.0.json", "PkgB", "Package B")
+            mock_ep.return_value = [
+                self._entry_point(dir_a),
+                self._entry_point(dir_b),
+            ]
+
+            bulk = get_bulk_compliance_frameworks_universal("fakeexternal")
+
+        assert "pkg_a_1.0" in bulk
+        assert "pkg_b_1.0" in bulk
diff --git a/tests/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_table_test.py b/tests/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_table_test.py
new file mode 100644
index 0000000000..6382dc1d2c
--- /dev/null
+++ b/tests/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_table_test.py
@@ -0,0 +1,132 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.asd_essential_eight.asd_essential_eight import (
+    get_asd_essential_eight_table,
+)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, sections, framework="ASD-Essential-Eight"):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestASDEssentialEightTable:
+    """Test cases verifying multi-section counting and provider-column attribution for the ASD Essential Eight compliance table."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_asd_essential_eight_table(
+            findings,
+            bulk_metadata,
+            "asd_essential_eight_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging was
+        # undercounted because the per-section count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_asd_essential_eight_table(
+            findings,
+            bulk_metadata,
+            "asd_essential_eight_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched ASD-Essential-Eight
+        compliance, never from a different framework that happens to be the last
+        entry in the check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_asd_essential_eight_table(
+            findings,
+            bulk_metadata,
+            "asd_essential_eight_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/c5/__init__.py b/tests/lib/outputs/compliance/c5/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/c5/c5_table_test.py b/tests/lib/outputs/compliance/c5/c5_table_test.py
new file mode 100644
index 0000000000..c423f5af0b
--- /dev/null
+++ b/tests/lib/outputs/compliance/c5/c5_table_test.py
@@ -0,0 +1,130 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.c5.c5 import get_c5_table
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, sections, framework="C5"):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestC5Table:
+    """Verify multi-section counting and provider-column attribution for the compliance table."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_c5_table(
+            findings,
+            bulk_metadata,
+            "c5_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging was
+        # undercounted because the per-section count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_c5_table(
+            findings,
+            bulk_metadata,
+            "c5_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched C5 compliance, never
+        from a different framework that happens to be the last entry in the
+        check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_c5_table(
+            findings,
+            bulk_metadata,
+            "c5_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/ccc/ccc_table_test.py b/tests/lib/outputs/compliance/ccc/ccc_table_test.py
new file mode 100644
index 0000000000..f647aff3d0
--- /dev/null
+++ b/tests/lib/outputs/compliance/ccc/ccc_table_test.py
@@ -0,0 +1,130 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.ccc.ccc import get_ccc_table
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, sections, framework="CCC"):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestCCCTable:
+    """Test cases verifying multi-section counting and provider-column attribution for the compliance table."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_ccc_table(
+            findings,
+            bulk_metadata,
+            "ccc_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging was
+        # undercounted because the per-section count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_ccc_table(
+            findings,
+            bulk_metadata,
+            "ccc_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched CCC compliance, never
+        from a different framework that happens to be the last entry in the
+        check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_ccc_table(
+            findings,
+            bulk_metadata,
+            "ccc_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/cis/cis_table_test.py b/tests/lib/outputs/compliance/cis/cis_table_test.py
new file mode 100644
index 0000000000..c47e1387a0
--- /dev/null
+++ b/tests/lib/outputs/compliance/cis/cis_table_test.py
@@ -0,0 +1,162 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.cis.cis import get_cis_table
+
+
+def _strip_ansi(text):
+    return re.sub(r"\x1b\[[0-9;]*m", "", text)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _attr(section, profile="Level 1"):
+    return SimpleNamespace(Section=section, Profile=profile)
+
+
+def _make_compliance(provider, attributes, version="1.4", framework="CIS"):
+    """Build a per-check CIS compliance with the given (section, profile) attrs."""
+    return SimpleNamespace(
+        Framework=framework,
+        Version=version,
+        Provider=provider,
+        Requirements=[SimpleNamespace(Attributes=attributes)],
+    )
+
+
+def _make_compliance_multi_req(provider, attributes, version="1.4", framework="CIS"):
+    """Build a per-check CIS compliance where each attr is its own requirement,
+    simulating a check that appears in several requirements."""
+    return SimpleNamespace(
+        Framework=framework,
+        Version=version,
+        Provider=provider,
+        Requirements=[SimpleNamespace(Attributes=[attr]) for attr in attributes],
+    )
+
+
+class TestCISTable:
+    """Verify multi-section counting and provider-column attribution for the CIS compliance table."""
+
+    def test_muted_multi_section_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED finding mapped to several sections must increment the
+        per-section Muted column for every section, not only the first seen.
+
+        CIS counts FAIL/PASS through Level 1/Level 2 buckets, so only the Muted
+        per-section count was affected by the undercount bug.
+        """
+        bulk_metadata = {
+            # check_a is muted and belongs to two sections at once.
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("1 IAM"), _attr("2 Logging")])
+                ]
+            ),
+            # A real (non-muted) finding so the table is rendered.
+            "check_b": SimpleNamespace(
+                Compliance=[_make_compliance("aws", [_attr("1 IAM")])]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_cis_table(
+            findings,
+            bulk_metadata,
+            "cis_1.4_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both section rows must carry a Muted count of 1 in their last cell.
+        # Before the fix only the first section seen got incremented.
+        muted_one_rows = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_one_rows) == 2
+
+    def test_same_section_level_not_double_counted(self, capsys, tmp_path):
+        """A single finding whose check maps to several requirements that share
+        the same section and profile must count once for that section/level,
+        not once per requirement (FAIL(1), never FAIL(2))."""
+        bulk_metadata = {
+            # check_a is a single FAIL mapped to two requirements, both in the
+            # same section "1 IAM" and the same profile "Level 1".
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance_multi_req("aws", [_attr("1 IAM"), _attr("1 IAM")])
+                ]
+            ),
+            # A second finding in another section so the table renders.
+            "check_b": SimpleNamespace(
+                Compliance=[_make_compliance("aws", [_attr("2 Logging")])]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_cis_table(
+            findings,
+            bulk_metadata,
+            "cis_1.4_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # The "1 IAM" row must show FAIL(1) for Level 1, never FAIL(2).
+        assert "FAIL(1)" in plain
+        assert "FAIL(2)" not in plain
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched CIS compliance, not
+        from a different framework that trails it in the compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("1 IAM")]),
+                    _make_compliance(
+                        "gcp", [_attr("Other")], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("1 IAM")]),
+                    _make_compliance(
+                        "gcp", [_attr("Other")], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_cis_table(
+            findings,
+            bulk_metadata,
+            "cis_1.4_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The trailing unrelated framework's provider must not leak in.
+        assert "gcp" not in captured.out
diff --git a/tests/lib/outputs/compliance/display_compliance_table_test.py b/tests/lib/outputs/compliance/display_compliance_table_test.py
index 0d2cd5313b..bd854d6d7d 100644
--- a/tests/lib/outputs/compliance/display_compliance_table_test.py
+++ b/tests/lib/outputs/compliance/display_compliance_table_test.py
@@ -96,25 +96,19 @@ class TestDispatchStartswith:
 
     @pytest.mark.parametrize(
         "framework_name",
-        [
-            "csa_ccm_4.0_aws",
-            "csa_ccm_4.0_azure",
-            "csa_ccm_4.0_gcp",
-            "csa_ccm_4.0_oraclecloud",
-            "csa_ccm_4.0_alibabacloud",
-        ],
+        ["c5_aws", "c5_azure", "c5_gcp"],
     )
-    @patch(f"{MODULE}.get_csa_table")
-    def test_csa_dispatch(self, mock_fn, framework_name):
+    @patch(f"{MODULE}.get_c5_table")
+    def test_c5_dispatch(self, mock_fn, framework_name):
         display_compliance_table(compliance_framework=framework_name, **_COMMON)
         mock_fn.assert_called_once()
 
     @pytest.mark.parametrize(
         "framework_name",
-        ["c5_aws", "c5_azure", "c5_gcp"],
+        ["okta_idaas_stig_v1r2_okta"],
     )
-    @patch(f"{MODULE}.get_c5_table")
-    def test_c5_dispatch(self, mock_fn, framework_name):
+    @patch(f"{MODULE}.get_okta_idaas_stig_table")
+    def test_okta_idaas_stig_dispatch(self, mock_fn, framework_name):
         display_compliance_table(compliance_framework=framework_name, **_COMMON)
         mock_fn.assert_called_once()
 
diff --git a/tests/lib/outputs/compliance/ens/ens_table_test.py b/tests/lib/outputs/compliance/ens/ens_table_test.py
new file mode 100644
index 0000000000..2373885dbc
--- /dev/null
+++ b/tests/lib/outputs/compliance/ens/ens_table_test.py
@@ -0,0 +1,235 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.ens.ens import get_ens_table
+
+
+def _strip_ansi(text):
+    return re.sub(r"\x1b\[[0-9;]*m", "", text)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _attr(marco, categoria, tipo="requisito", nivel="alto"):
+    return SimpleNamespace(Marco=marco, Categoria=categoria, Tipo=tipo, Nivel=nivel)
+
+
+def _make_compliance(provider, attributes, framework="ENS"):
+    """Build a per-check ENS compliance with the given marco/categoria attrs."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[SimpleNamespace(Attributes=attributes)],
+    )
+
+
+class TestENSTable:
+    """Test cases for ENS compliance table rendering.
+
+    Verify multi-marco counting and provider-column attribution for the
+    compliance table.
+    """
+
+    def test_no_cumple_marked_in_every_marco(self, capsys, tmp_path):
+        """A single failing finding mapped to several marcos must mark every
+        one of them as NO CUMPLE, not only the first marco seen."""
+        bulk_metadata = {
+            # check_a fails and belongs to two distinct marcos/categorias.
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws",
+                        [
+                            _attr("operacional", "control de acceso"),
+                            _attr("organizativo", "politica de seguridad"),
+                        ],
+                    )
+                ]
+            ),
+            # A passing finding so the overview total reaches 2.
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("operacional", "control de acceso")])
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_ens_table(
+            findings,
+            bulk_metadata,
+            "ens_rd2022_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both marco rows the failing finding maps to must read NO CUMPLE.
+        # Before the fix only the first marco was marked, the second stayed
+        # CUMPLE. Anchor the assertion to the actual marco rows (not the
+        # overview header line which also mentions NO CUMPLE).
+        op_row = [
+            line
+            for line in plain.splitlines()
+            if "operacional/control de acceso" in line
+        ]
+        org_row = [
+            line
+            for line in plain.splitlines()
+            if "organizativo/politica de seguridad" in line
+        ]
+        assert len(op_row) == 1 and "NO CUMPLE" in op_row[0]
+        assert len(org_row) == 1 and "NO CUMPLE" in org_row[0]
+
+    def test_recomendacion_does_not_set_no_cumple(self, capsys, tmp_path):
+        """A FAIL on a 'recomendacion' attribute must not flip a marco to
+        NO CUMPLE (this path is intentionally excluded from the fix)."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws",
+                        [
+                            _attr(
+                                "operacional", "control de acceso", tipo="recomendacion"
+                            )
+                        ],
+                    )
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("organizativo", "politica")])
+                ]
+            ),
+            # A regular (non-recomendacion) check so the results table renders
+            # at least one marco row and the assertion below is not vacuous.
+            "check_c": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("operacional", "continuidad")])
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+            _make_finding("check_c", "PASS"),
+        ]
+
+        get_ens_table(
+            findings,
+            bulk_metadata,
+            "ens_rd2022_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # The recomendacion FAIL must not appear as a NO CUMPLE marco row in the
+        # results table (the overview header line is allowed to mention it).
+        marco_rows = [
+            line
+            for line in plain.splitlines()
+            if "operacional" in line or "organizativo" in line
+        ]
+        # Guard against a vacuous pass: the table must actually render rows.
+        assert marco_rows
+        assert all("NO CUMPLE" not in line for line in marco_rows)
+
+    def test_muted_multi_marco_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED finding mapped to several marcos must increment the
+        per-marco Muted column for every marco, not only the first seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws",
+                        [
+                            _attr("operacional", "control de acceso"),
+                            _attr("organizativo", "politica de seguridad"),
+                        ],
+                    )
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("operacional", "control de acceso")])
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_ens_table(
+            findings,
+            bulk_metadata,
+            "ens_rd2022_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both marco rows the muted finding maps to must report a Muted count of
+        # 1 in their last cell.
+        muted_one_rows = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_one_rows) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Proveedor column must come from the matched ENS compliance, not
+        from a different framework that trails it in the compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws", [_attr("operacional", "control de acceso")]
+                    ),
+                    _make_compliance(
+                        "gcp", [_attr("x", "y")], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws", [_attr("operacional", "control de acceso")]
+                    ),
+                    _make_compliance(
+                        "gcp", [_attr("x", "y")], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_ens_table(
+            findings,
+            bulk_metadata,
+            "ens_rd2022_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        assert "gcp" not in captured.out
diff --git a/tests/lib/outputs/compliance/fixtures.py b/tests/lib/outputs/compliance/fixtures.py
index f085460abd..a8fc7aa7e5 100644
--- a/tests/lib/outputs/compliance/fixtures.py
+++ b/tests/lib/outputs/compliance/fixtures.py
@@ -16,6 +16,7 @@ from prowler.lib.check.compliance_models import (
     Mitre_Requirement_Attribute_Azure,
     Mitre_Requirement_Attribute_GCP,
     Prowler_ThreatScore_Requirement_Attribute,
+    STIG_Requirement_Attribute,
 )
 
 CIS_1_4_AWS = Compliance(
@@ -1258,3 +1259,47 @@ ASD_ESSENTIAL_EIGHT_AWS = Compliance(
         ),
     ],
 )
+
+OKTA_IDAAS_STIG_OKTA = Compliance(
+    Framework="Okta-IDaaS-STIG",
+    Name="DISA Okta Identity as a Service (IDaaS) STIG V1R2",
+    Version="1R2",
+    Provider="Okta",
+    Description="Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS).",
+    Requirements=[
+        Compliance_Requirement(
+            Id="OKTA-APP-000020",
+            Name="Okta must log out a session after a 15-minute period of inactivity.",
+            Description="A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate vicinity of the information system.",
+            Attributes=[
+                STIG_Requirement_Attribute(
+                    Section="CAT II (Medium)",
+                    Severity="medium",
+                    RuleID="SV-273186r1098825_rule",
+                    StigID="OKTA-APP-000020",
+                    CCI=["CCI-000057", "CCI-001133"],
+                    CheckText="Verify the Global Session Policy logs out a session after 15 minutes of inactivity.",
+                    FixText="From the Admin Console configure the Global Session Policy idle timeout to 15 minutes.",
+                )
+            ],
+            Checks=["signon_global_session_idle_timeout_15min"],
+        ),
+        Compliance_Requirement(
+            Id="OKTA-APP-000650",
+            Name="Okta must enforce a minimum 15-character password length.",
+            Description="The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.",
+            Attributes=[
+                STIG_Requirement_Attribute(
+                    Section="CAT II (Medium)",
+                    Severity="medium",
+                    RuleID="SV-273209r1098894_rule",
+                    StigID="OKTA-APP-000650",
+                    CCI=["CCI-000205"],
+                    CheckText="Verify the password policy enforces a minimum length of 15 characters.",
+                    FixText="From the Admin Console set the minimum password length to 15 characters.",
+                )
+            ],
+            Checks=[],
+        ),
+    ],
+)
diff --git a/tests/lib/outputs/compliance/generic/generic_aws_test.py b/tests/lib/outputs/compliance/generic/generic_aws_test.py
index 335d1860ea..335a9ad17d 100644
--- a/tests/lib/outputs/compliance/generic/generic_aws_test.py
+++ b/tests/lib/outputs/compliance/generic/generic_aws_test.py
@@ -9,6 +9,7 @@ from prowler.lib.check.compliance_models import (
     Compliance,
     Compliance_Requirement,
     Generic_Compliance_Requirement_Attribute,
+    ISO27001_2013_Requirement_Attribute,
 )
 from prowler.lib.outputs.compliance.generic.generic import GenericCompliance
 from prowler.lib.outputs.compliance.generic.models import GenericComplianceModel
@@ -198,3 +199,47 @@ class TestAWSGenericCompliance:
         ), f"Expected 1 row driven by framework JSON, got {len(rows)}"
         assert rows[0].Requirements_Id == "req_in_framework"
         assert rows[0].CheckId == "service_check_in_framework"
+
+    def test_transform_tolerates_framework_specific_attribute_schema(self):
+        """GenericCompliance is the documented last-resort renderer, so it must not
+        crash on a framework whose attribute schema lacks the universal fields
+        (Section, SubSection, SubGroup, Service, Type, Comment). ISO27001 declares
+        none of them; missing fields must render as None instead of raising
+        AttributeError and dropping the whole CSV."""
+        framework_name = "ISO27001-2013-External"
+        compliance = Compliance(
+            Framework=framework_name,
+            Name=framework_name,
+            Provider="external",
+            Version="",
+            Description="Framework shipping a provider-specific attribute schema",
+            Requirements=[
+                Compliance_Requirement(
+                    Id="A.5.1.1",
+                    Description="Policies for information security",
+                    Attributes=[
+                        ISO27001_2013_Requirement_Attribute(
+                            Category="Information security policies",
+                            Objetive_ID="A.5.1",
+                            Objetive_Name="Management direction",
+                            Check_Summary="Policy is defined",
+                        )
+                    ],
+                    Checks=["service_test_check_id"],
+                )
+            ],
+        )
+
+        findings = [generate_finding_output(check_id="service_test_check_id")]
+
+        output = GenericCompliance(findings, compliance)
+
+        rows = [row for row in output.data if row.Status != "MANUAL"]
+        assert len(rows) == 1
+        assert rows[0].Requirements_Id == "A.5.1.1"
+        assert rows[0].Requirements_Attributes_Section is None
+        assert rows[0].Requirements_Attributes_SubSection is None
+        assert rows[0].Requirements_Attributes_SubGroup is None
+        assert rows[0].Requirements_Attributes_Service is None
+        assert rows[0].Requirements_Attributes_Type is None
+        assert rows[0].Requirements_Attributes_Comment is None
diff --git a/tests/lib/outputs/compliance/kisa_ismsp/__init__.py b/tests/lib/outputs/compliance/kisa_ismsp/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_table_test.py b/tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_table_test.py
new file mode 100644
index 0000000000..be0fe25ad5
--- /dev/null
+++ b/tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_table_test.py
@@ -0,0 +1,137 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.kisa_ismsp.kisa_ismsp import get_kisa_ismsp_table
+
+# The generator matches a compliance when its Framework starts with "KISA" and
+# its Version is contained in the compliance_framework argument.
+COMPLIANCE_FRAMEWORK = "kisa-isms-p-2023_aws"
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(
+    provider, sections, framework="KISA-ISMS-P", version="kisa-isms-p-2023"
+):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Version=version,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestKISAISMSPTable:
+    """Verify multi-section counting and provider-column attribution for the KISA ISMS-P compliance table."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_kisa_ismsp_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging was
+        # undercounted because the per-section count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_kisa_ismsp_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched KISA compliance, never
+        from a different framework that happens to be the last entry in the
+        check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_kisa_ismsp_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/mitre_attack/__init__.py b/tests/lib/outputs/compliance/mitre_attack/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/mitre_attack/mitre_attack_table_test.py b/tests/lib/outputs/compliance/mitre_attack/mitre_attack_table_test.py
new file mode 100644
index 0000000000..3bd69b44e8
--- /dev/null
+++ b/tests/lib/outputs/compliance/mitre_attack/mitre_attack_table_test.py
@@ -0,0 +1,140 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.mitre_attack.mitre_attack import (
+    get_mitre_attack_table,
+)
+
+# The generator matches a compliance when "MITRE-ATTACK" is in its Framework and
+# its Version is contained in the compliance_framework argument.
+COMPLIANCE_FRAMEWORK = "mitre_attack_aws"
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(
+    provider, tactics, framework="MITRE-ATTACK", version="mitre_attack"
+):
+    """Build a per-check compliance covering the given tactics."""
+    return SimpleNamespace(
+        Framework=framework,
+        Version=version,
+        Provider=provider,
+        Requirements=[SimpleNamespace(Tactics=tactics)],
+    )
+
+
+class TestMitreAttackTable:
+    """Test multi-section counting and provider-column attribution for the compliance table."""
+
+    def test_multi_tactic_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several tactics must show FAIL(1) in
+        every tactic, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["Persistence", "Execution"])]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["Persistence"])]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_mitre_attack_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both Persistence and Execution must report FAIL(1); before the fix
+        # Execution was undercounted because the per-tactic count was gated by
+        # the global dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_tactic_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several tactics must increase the
+        per-tactic Muted count in every tactic, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["Persistence", "Execution"])]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["Persistence"])]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A second finding is needed so the table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_mitre_attack_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both Persistence and Execution, so the
+        # Muted column must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched MITRE-ATTACK
+        compliance, never from a different framework that happens to be the last
+        entry in the check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["Persistence"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["Persistence"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_mitre_attack_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/okta_idaas_stig/__init__.py b/tests/lib/outputs/compliance/okta_idaas_stig/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py
new file mode 100644
index 0000000000..fa616c906e
--- /dev/null
+++ b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py
@@ -0,0 +1,139 @@
+from datetime import datetime
+from io import StringIO
+from unittest import mock
+
+from freezegun import freeze_time
+from mock import patch
+
+from prowler.lib.outputs.compliance.okta_idaas_stig.models import OktaIDaaSSTIGModel
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta import (
+    OktaIDaaSSTIG,
+)
+from tests.lib.outputs.compliance.fixtures import OKTA_IDAAS_STIG_OKTA
+from tests.lib.outputs.fixtures.fixtures import generate_finding_output
+
+OKTA_ORG_DOMAIN = "dev-12345.okta.com"
+
+
+class TestOktaIDaaSSTIG:
+    def test_output_transform(self):
+        findings = [
+            generate_finding_output(
+                provider="okta",
+                account_uid=OKTA_ORG_DOMAIN,
+                account_name=OKTA_ORG_DOMAIN,
+                region="global",
+                service_name="signon",
+                check_id="signon_global_session_idle_timeout_15min",
+                resource_uid="okta-global-session-policy",
+                resource_name="Default Policy",
+                compliance={"Okta-IDaaS-STIG-1R2": ["OKTA-APP-000020"]},
+            )
+        ]
+
+        output = OktaIDaaSSTIG(findings, OKTA_IDAAS_STIG_OKTA)
+        output_data = output.data[0]
+        assert isinstance(output_data, OktaIDaaSSTIGModel)
+        assert output_data.Provider == "okta"
+        assert output_data.Framework == OKTA_IDAAS_STIG_OKTA.Framework
+        assert output_data.Name == OKTA_IDAAS_STIG_OKTA.Name
+        assert output_data.OrganizationDomain == OKTA_ORG_DOMAIN
+        assert output_data.Description == OKTA_IDAAS_STIG_OKTA.Description
+        assert output_data.Requirements_Id == OKTA_IDAAS_STIG_OKTA.Requirements[0].Id
+        assert (
+            output_data.Requirements_Name == OKTA_IDAAS_STIG_OKTA.Requirements[0].Name
+        )
+        assert (
+            output_data.Requirements_Description
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Description
+        )
+        assert (
+            output_data.Requirements_Attributes_Section
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].Section
+        )
+        assert (
+            output_data.Requirements_Attributes_Severity
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].Severity.value
+        )
+        assert (
+            output_data.Requirements_Attributes_RuleID
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].RuleID
+        )
+        assert (
+            output_data.Requirements_Attributes_StigID
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].StigID
+        )
+        assert (
+            output_data.Requirements_Attributes_CCI
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].CCI
+        )
+        assert (
+            output_data.Requirements_Attributes_CheckText
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].CheckText
+        )
+        assert (
+            output_data.Requirements_Attributes_FixText
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].FixText
+        )
+        assert output_data.Status == "PASS"
+        assert output_data.StatusExtended == ""
+        assert output_data.ResourceId == "okta-global-session-policy"
+        assert output_data.ResourceName == "Default Policy"
+        assert output_data.CheckId == "signon_global_session_idle_timeout_15min"
+        assert output_data.Muted is False
+        # Test manual check
+        output_data_manual = output.data[1]
+        assert output_data_manual.Provider == "okta"
+        assert output_data_manual.Framework == OKTA_IDAAS_STIG_OKTA.Framework
+        assert output_data_manual.Name == OKTA_IDAAS_STIG_OKTA.Name
+        assert output_data_manual.OrganizationDomain == ""
+        assert (
+            output_data_manual.Requirements_Id
+            == OKTA_IDAAS_STIG_OKTA.Requirements[1].Id
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_Severity
+            == OKTA_IDAAS_STIG_OKTA.Requirements[1].Attributes[0].Severity.value
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_StigID
+            == OKTA_IDAAS_STIG_OKTA.Requirements[1].Attributes[0].StigID
+        )
+        assert output_data_manual.Status == "MANUAL"
+        assert output_data_manual.StatusExtended == "Manual check"
+        assert output_data_manual.ResourceId == "manual_check"
+        assert output_data_manual.ResourceName == "Manual check"
+        assert output_data_manual.CheckId == "manual"
+        assert output_data_manual.Muted is False
+
+    @freeze_time("2025-01-01 00:00:00")
+    @mock.patch(
+        "prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta.timestamp",
+        "2025-01-01 00:00:00",
+    )
+    def test_batch_write_data_to_file(self):
+        mock_file = StringIO()
+        findings = [
+            generate_finding_output(
+                provider="okta",
+                account_uid=OKTA_ORG_DOMAIN,
+                account_name=OKTA_ORG_DOMAIN,
+                region="global",
+                service_name="signon",
+                check_id="signon_global_session_idle_timeout_15min",
+                resource_uid="okta-global-session-policy",
+                resource_name="Default Policy",
+                compliance={"Okta-IDaaS-STIG-1R2": ["OKTA-APP-000020"]},
+            )
+        ]
+        output = OktaIDaaSSTIG(findings, OKTA_IDAAS_STIG_OKTA)
+        output._file_descriptor = mock_file
+
+        with patch.object(mock_file, "close", return_value=None):
+            output.batch_write_data_to_file()
+
+        mock_file.seek(0)
+        content = mock_file.read()
+        expected_csv = f"PROVIDER;DESCRIPTION;ORGANIZATIONDOMAIN;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_NAME;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_SECTION;REQUIREMENTS_ATTRIBUTES_SEVERITY;REQUIREMENTS_ATTRIBUTES_RULEID;REQUIREMENTS_ATTRIBUTES_STIGID;REQUIREMENTS_ATTRIBUTES_CCI;REQUIREMENTS_ATTRIBUTES_CHECKTEXT;REQUIREMENTS_ATTRIBUTES_FIXTEXT;STATUS;STATUSEXTENDED;RESOURCEID;RESOURCENAME;CHECKID;MUTED;FRAMEWORK;NAME\r\nokta;Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS).;{OKTA_ORG_DOMAIN};{datetime.now()};OKTA-APP-000020;Okta must log out a session after a 15-minute period of inactivity.;A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate vicinity of the information system.;CAT II (Medium);medium;SV-273186r1098825_rule;OKTA-APP-000020;['CCI-000057', 'CCI-001133'];Verify the Global Session Policy logs out a session after 15 minutes of inactivity.;From the Admin Console configure the Global Session Policy idle timeout to 15 minutes.;PASS;;okta-global-session-policy;Default Policy;signon_global_session_idle_timeout_15min;False;Okta-IDaaS-STIG;DISA Okta Identity as a Service (IDaaS) STIG V1R2\r\nokta;Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS).;;{datetime.now()};OKTA-APP-000650;Okta must enforce a minimum 15-character password length.;The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.;CAT II (Medium);medium;SV-273209r1098894_rule;OKTA-APP-000650;['CCI-000205'];Verify the password policy enforces a minimum length of 15 characters.;From the Admin Console set the minimum password length to 15 characters.;MANUAL;Manual check;manual_check;Manual check;manual;False;Okta-IDaaS-STIG;DISA Okta Identity as a Service (IDaaS) STIG V1R2\r\n"
+
+        assert content == expected_csv
diff --git a/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py
new file mode 100644
index 0000000000..3017ea4f92
--- /dev/null
+++ b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py
@@ -0,0 +1,136 @@
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig import (
+    get_okta_idaas_stig_table,
+)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, sections, framework="Okta-IDaaS-STIG"):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestOktaIDaaSSTIGTable:
+    """Test cases for Okta IDaaS STIG compliance table rendering."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            # check_a belongs to two sections at once.
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("okta", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("okta", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_okta_idaas_stig_table(
+            findings,
+            bulk_metadata,
+            "okta_idaas_stig_1r2",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging
+        # was undercounted and rendered as plain PASS.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("okta", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("okta", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_okta_idaas_stig_table(
+            findings,
+            bulk_metadata,
+            "okta_idaas_stig_1r2",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows. Before the fix only the first section seen
+        # was incremented, leaving the second at 0.
+        # Strip ANSI color codes before counting the bare values per row.
+        import re
+
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # Each section row ends with its Muted value in its own cell; both rows
+        # must carry a Muted count of 1.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched Okta-IDaaS-STIG
+        compliance, never from a different framework that happens to be the
+        last entry in the check's compliance list."""
+        # check_a maps to Okta-IDaaS-STIG (provider "okta") but its compliance
+        # list ends with a *different* framework whose provider is "aws". With
+        # the bug the leaked loop variable made the table render "aws".
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("okta", ["IAM"]),
+                    _make_compliance("aws", ["Other"], framework="OtherFramework"),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("okta", ["IAM"]),
+                    _make_compliance("aws", ["Other"], framework="OtherFramework"),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_okta_idaas_stig_table(
+            findings,
+            bulk_metadata,
+            "okta_idaas_stig_1r2",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "okta" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "aws" not in captured.out
diff --git a/tests/lib/outputs/compliance/process_universal_test.py b/tests/lib/outputs/compliance/process_universal_test.py
index fa8b737ddd..4dc957ed4f 100644
--- a/tests/lib/outputs/compliance/process_universal_test.py
+++ b/tests/lib/outputs/compliance/process_universal_test.py
@@ -12,6 +12,7 @@ Also validates that print_compliance_frameworks and print_compliance_requirement
 work with universal ComplianceFramework objects (dict checks, None provider).
 """
 
+import csv
 import json
 import os
 from datetime import datetime, timezone
@@ -124,6 +125,41 @@ def _make_universal_framework(name="TestFW", version="1.0", with_table_config=Tr
     )
 
 
+def _make_framework_with_manual(name="MixedFW", version="1.0"):
+    """Framework with one aws-covered requirement and one manual one.
+
+    The manual requirement has no aws checks, so for provider ``aws`` it is
+    emitted as a manual row/event — used to assert manual requirements are
+    not duplicated when the writer is reused across streaming batches.
+    """
+    reqs = [
+        UniversalComplianceRequirement(
+            id="1.1",
+            description="Covered requirement",
+            attributes={"Section": "IAM"},
+            checks={"aws": ["check_a"]},
+        ),
+        UniversalComplianceRequirement(
+            id="2.1",
+            description="Manual requirement",
+            attributes={"Section": "GOV"},
+            checks={"aws": []},
+        ),
+    ]
+    metadata = [AttributeMetadata(key="Section", type="str")]
+    outputs = OutputsConfig(table_config=TableConfig(group_by="Section"))
+    return ComplianceFramework(
+        framework=name,
+        name=f"{name} Framework",
+        provider="AWS",
+        version=version,
+        description="Test framework",
+        requirements=reqs,
+        attributes_metadata=metadata,
+        outputs=outputs,
+    )
+
+
 # ── Tests ────────────────────────────────────────────────────────────
 
 
@@ -728,3 +764,243 @@ class TestIdempotency:
         # FW1 writer instances unchanged
         assert second_writers[0] is first_writers[0]
         assert second_writers[1] is first_writers[1]
+
+
+class TestStreamingBatches:
+    """Streaming-aware behaviour: ``from_cli`` / ``is_last`` / ``_flush``.
+
+    Regression coverage for the API streaming path where the helper is
+    invoked once per finding batch: before the fix only the first batch
+    was written (batches 2..N silently dropped) and manual requirements
+    were re-emitted on every batch.
+    """
+
+    def _run_batches(self, tmp_path, fw, key, batches):
+        """Invoke the helper once per (findings, is_last) batch, sharing
+        ``generated_outputs`` so writers are reused like the API does."""
+        generated = {"compliance": []}
+        for findings, is_last in batches:
+            process_universal_compliance_frameworks(
+                input_compliance_frameworks={key},
+                universal_frameworks={key: fw},
+                finding_outputs=findings,
+                output_directory=str(tmp_path),
+                output_filename="out",
+                provider="aws",
+                generated_outputs=generated,
+                from_cli=False,
+                is_last=is_last,
+            )
+        return generated
+
+    def test_defaults_preserve_cli_single_call(self, tmp_path):
+        """Defaults (``from_cli=True``, ``is_last=True``): a single call
+        still finalizes a valid, closed OCSF JSON array (CLI unchanged)."""
+        fw = _make_universal_framework()
+        generated = {"compliance": []}
+        process_universal_compliance_frameworks(
+            input_compliance_frameworks={"test_fw_1.0"},
+            universal_frameworks={"test_fw_1.0": fw},
+            finding_outputs=[_make_finding("check_a")],
+            output_directory=str(tmp_path),
+            output_filename="out",
+            provider="aws",
+            generated_outputs=generated,
+        )
+        ocsf_path = tmp_path / "compliance" / "out_test_fw_1.0.ocsf.json"
+        data = json.loads(ocsf_path.read_text())
+        assert isinstance(data, list) and len(data) >= 1
+
+    def test_multibatch_csv_keeps_every_batch(self, tmp_path):
+        """Findings from batches 2..N must not be dropped (the bug)."""
+        fw = _make_universal_framework()
+        f1 = _make_finding("check_a", status="PASS")
+        f2 = _make_finding("check_a", status="FAIL")
+        generated = self._run_batches(
+            tmp_path, fw, "fw_1.0", [([f1], False), ([f2], True)]
+        )
+        content = (tmp_path / "compliance" / "out_fw_1.0.csv").read_text()
+        assert "check_a is PASS" in content  # batch 1
+        assert "check_a is FAIL" in content  # batch 2 — regression
+        # writer reused, not recreated: still just 1 CSV + 1 OCSF
+        assert len(generated["compliance"]) == 2
+
+    def test_multibatch_ocsf_valid_array_with_every_batch(self, tmp_path):
+        """OCSF is a valid (closed) JSON array holding every batch's
+        events only after the ``is_last=True`` call."""
+        fw = _make_universal_framework()
+        f1 = _make_finding("check_a", status="PASS")
+        f2 = _make_finding("check_a", status="FAIL")
+        self._run_batches(tmp_path, fw, "fw_1.0", [([f1], False), ([f2], True)])
+        data = json.loads(
+            (tmp_path / "compliance" / "out_fw_1.0.ocsf.json").read_text()
+        )
+        assert isinstance(data, list)
+        assert len(data) >= 2  # one event per batch finding
+
+    def test_manual_requirement_not_duplicated_across_batches(self, tmp_path):
+        """Manual requirement is emitted once (first batch, via __init__),
+        never re-emitted when the writer is reused (``include_manual=False``)."""
+        fw = _make_framework_with_manual()
+        f1 = _make_finding("check_a", status="PASS")
+        f2 = _make_finding("check_a", status="FAIL")
+        self._run_batches(tmp_path, fw, "fw_1.0", [([f1], False), ([f2], True)])
+        rows = list(
+            csv.DictReader(
+                (tmp_path / "compliance" / "out_fw_1.0.csv").read_text().splitlines(),
+                delimiter=";",
+            )
+        )
+        manual_rows = [r for r in rows if r["STATUS"] == "MANUAL"]
+        assert len(manual_rows) == 1
+        assert manual_rows[0]["REQUIREMENTS_ID"] == "2.1"
+
+        ocsf = json.loads(
+            (tmp_path / "compliance" / "out_fw_1.0.ocsf.json").read_text()
+        )
+        manual_events = [
+            e
+            for e in ocsf
+            if (e.get("compliance") or {}).get("requirements") == ["2.1"]
+        ]
+        assert len(manual_events) == 1
+
+    def test_writer_reused_not_recreated_across_batches(self, tmp_path):
+        """Three batches still yield exactly one CSV + one OCSF writer,
+        and the same instances are reused throughout."""
+        fw = _make_universal_framework()
+        generated = self._run_batches(
+            tmp_path,
+            fw,
+            "fw_1.0",
+            [
+                ([_make_finding("check_a")], False),
+                ([_make_finding("check_a")], False),
+                ([_make_finding("check_a")], True),
+            ],
+        )
+        assert len(generated["compliance"]) == 2
+        assert isinstance(generated["compliance"][0], UniversalComplianceOutput)
+        assert isinstance(generated["compliance"][1], OCSFComplianceOutput)
+
+    def test_label_without_version_still_outputs(self, tmp_path):
+        """Empty framework version → label is the framework name only;
+        the helper still produces both artifacts without error."""
+        fw = _make_universal_framework(version="")
+        generated = {"compliance": []}
+        processed = process_universal_compliance_frameworks(
+            input_compliance_frameworks={"fw"},
+            universal_frameworks={"fw": fw},
+            finding_outputs=[_make_finding("check_a")],
+            output_directory=str(tmp_path),
+            output_filename="out",
+            provider="aws",
+            generated_outputs=generated,
+            from_cli=False,
+            is_last=True,
+        )
+        assert processed == {"fw"}
+        assert len(generated["compliance"]) == 2
+        assert (tmp_path / "compliance" / "out_fw.csv").exists()
+        assert (tmp_path / "compliance" / "out_fw.ocsf.json").exists()
+
+
+def _csa_like_framework() -> ComplianceFramework:
+    """Build a CSA CCM-style universal framework with checks across providers."""
+    requirement = UniversalComplianceRequirement(
+        id="A&A-01",
+        description="Audit and Assurance",
+        attributes={"Section": "Audit"},
+        checks={
+            "aws": ["aws_check"],
+            "azure": ["azure_check"],
+            "gcp": ["gcp_check"],
+        },
+    )
+    return ComplianceFramework(
+        framework="CSA_CCM",
+        name="CSA Cloud Controls Matrix",
+        version="4.0",
+        description="Multi-provider framework",
+        requirements=[requirement],
+        attributes_metadata=[AttributeMetadata(key="Section", type="str")],
+        outputs=OutputsConfig(table_config=TableConfig(group_by="Section")),
+    )
+
+
+class TestMultiProviderUniversalFramework:
+    """A top-level CSA-CCM-style framework produces a CSV+OCSF pair scoped
+    to the provider it is invoked with."""
+
+    @pytest.mark.parametrize(
+        "provider,check_id",
+        [
+            ("aws", "aws_check"),
+            ("azure", "azure_check"),
+            ("gcp", "gcp_check"),
+        ],
+    )
+    def test_per_provider_outputs_isolated(self, tmp_path, provider, check_id):
+        framework = _csa_like_framework()
+        generated = {"compliance": []}
+
+        process_universal_compliance_frameworks(
+            input_compliance_frameworks={"csa_ccm_4.0"},
+            universal_frameworks={"csa_ccm_4.0": framework},
+            finding_outputs=[_make_finding(check_id, provider=provider)],
+            output_directory=str(tmp_path),
+            output_filename="prowler_output",
+            provider=provider,
+            generated_outputs=generated,
+        )
+
+        ocsf_path = tmp_path / "compliance" / "prowler_output_csa_ccm_4.0.ocsf.json"
+        events = json.loads(ocsf_path.read_text())
+        assert isinstance(events, list)
+        non_manual = [event for event in events if event.get("status_code") != "MANUAL"]
+        assert len(non_manual) == 1
+        assert non_manual[0]["compliance"]["checks"][0]["uid"] == check_id
+
+
+class TestMitreStyleOCSFOutput:
+    """MITRE attrs wrapped as `{"_raw_attributes": [...]}` must not leak
+    the marker key through the OCSF pipeline."""
+
+    def test_mitre_raw_attributes_pass_through_pipeline(self, tmp_path):
+        mitre_requirement = UniversalComplianceRequirement(
+            id="T1078",
+            description="Valid Accounts",
+            attributes={
+                "_raw_attributes": [{"AWSService": "IAM", "Category": "Initial Access"}]
+            },
+            checks={"aws": ["check_a"]},
+        )
+        framework = ComplianceFramework(
+            framework="MITRE",
+            name="MITRE ATT&CK",
+            version="14",
+            description="Mitre",
+            requirements=[mitre_requirement],
+            outputs=OutputsConfig(table_config=TableConfig(group_by="AWSService")),
+        )
+        generated = {"compliance": []}
+
+        process_universal_compliance_frameworks(
+            input_compliance_frameworks={"mitre_attack_aws"},
+            universal_frameworks={"mitre_attack_aws": framework},
+            finding_outputs=[_make_finding("check_a", "PASS")],
+            output_directory=str(tmp_path),
+            output_filename="out",
+            provider="aws",
+            generated_outputs=generated,
+        )
+
+        ocsf_path = tmp_path / "compliance" / "out_mitre_attack_aws.ocsf.json"
+        events = json.loads(ocsf_path.read_text())
+        assert isinstance(events, list) and len(events) >= 1
+        for event in events:
+            requirement_attrs = (event.get("unmapped") or {}).get(
+                "requirement_attributes", {}
+            )
+            assert "_raw_attributes" not in requirement_attrs
+            assert "raw_attributes" not in requirement_attrs
diff --git a/tests/lib/outputs/compliance/prowler_threatscore/__init__.py b/tests/lib/outputs/compliance/prowler_threatscore/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_table_test.py b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_table_test.py
new file mode 100644
index 0000000000..d754395dc3
--- /dev/null
+++ b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_table_test.py
@@ -0,0 +1,147 @@
+import re
+from types import SimpleNamespace
+from unittest import mock
+
+from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore import (
+    get_prowler_threatscore_table,
+)
+
+# Patch target for the Compliance.get_bulk lookup used to render pillars without
+# findings; the tests don't exercise that path so it returns nothing.
+COMPLIANCE_PATH = (
+    "prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore.Compliance"
+)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, pillars, framework="ProwlerThreatScore"):
+    """Build a per-check compliance covering the given pillars (Section)."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(
+                Attributes=[SimpleNamespace(Section=pillar, LevelOfRisk=5, Weight=100)]
+            )
+            for pillar in pillars
+        ],
+    )
+
+
+class TestProwlerThreatScoreTable:
+    """Verify multi-section counting and provider-column attribution for the compliance table."""
+
+    def test_multi_pillar_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several pillars must show FAIL(1) in
+        every pillar, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Encryption"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        with mock.patch(COMPLIANCE_PATH) as compliance_mock:
+            compliance_mock.get_bulk.return_value = {}
+            get_prowler_threatscore_table(
+                findings,
+                bulk_metadata,
+                "prowler_threatscore_aws",
+                "output",
+                str(tmp_path),
+                False,
+            )
+
+        captured = capsys.readouterr()
+        # Both IAM and Encryption must report FAIL(1); before the fix Encryption
+        # was undercounted because the per-pillar count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_pillar_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several pillars must increase the
+        per-pillar Muted count in every pillar, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Encryption"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        with mock.patch(COMPLIANCE_PATH) as compliance_mock:
+            compliance_mock.get_bulk.return_value = {}
+            get_prowler_threatscore_table(
+                findings,
+                bulk_metadata,
+                "prowler_threatscore_aws",
+                "output",
+                str(tmp_path),
+                False,
+            )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Encryption, so the Muted
+        # column must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched ProwlerThreatScore
+        compliance, never from a different framework that happens to be the last
+        entry in the check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        with mock.patch(COMPLIANCE_PATH) as compliance_mock:
+            compliance_mock.get_bulk.return_value = {}
+            get_prowler_threatscore_table(
+                findings,
+                bulk_metadata,
+                "prowler_threatscore_aws",
+                "output",
+                str(tmp_path),
+                False,
+            )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/universal/ocsf_compliance_test.py b/tests/lib/outputs/compliance/universal/ocsf_compliance_test.py
index 71429fc1ca..db6b78de28 100644
--- a/tests/lib/outputs/compliance/universal/ocsf_compliance_test.py
+++ b/tests/lib/outputs/compliance/universal/ocsf_compliance_test.py
@@ -202,6 +202,26 @@ class TestOCSFComplianceOutput:
         assert cf.status_code == "MANUAL"
         assert cf.finding_info.uid == "manual-MANUAL-1"
 
+    def test_include_manual_false_skips_manual(self):
+        """``_transform(..., include_manual=False)`` emits check events but
+        NOT manual requirement events. The streaming caller passes ``False``
+        for batches 2..N so manual events are not duplicated."""
+        covered = _simple_requirement("REQ-1", ["check_a"])
+        manual = _simple_requirement("MANUAL-1", checks=[])
+        fw = _make_framework([covered, manual])
+        findings = [_make_finding("check_a")]
+
+        output = OCSFComplianceOutput(findings=findings, framework=fw, provider="aws")
+        # __init__ transforms with include_manual=True (default) → manual present
+        assert any(cf.status_code == "MANUAL" for cf in output.data)
+
+        # A subsequent batch re-transforms with include_manual=False
+        output._data.clear()
+        output._transform(findings, fw, "TestFW-1.0", include_manual=False)
+
+        assert len(output.data) == 1  # only the check event, no manual
+        assert all(cf.status_code != "MANUAL" for cf in output.data)
+
     def test_multi_provider_checks_dict(self):
         req = UniversalComplianceRequirement(
             id="REQ-1",
@@ -631,3 +651,103 @@ class TestNoTopLevelOCSFImport:
         import prowler.lib.outputs.compliance.universal.ocsf_compliance as mod
 
         assert "OCSF" not in dir(mod)
+
+
+def _mitre_requirement(req_id="T1078", entries=None):
+    """Build a MITRE-style requirement with `_raw_attributes` wrapping."""
+    return UniversalComplianceRequirement(
+        id=req_id,
+        description="Valid Accounts",
+        attributes={
+            "_raw_attributes": entries
+            or [{"AWSService": "IAM", "Category": "Initial Access"}]
+        },
+        checks={"aws": ["check_a"]},
+    )
+
+
+class TestMitreRawAttributes:
+    """MITRE attrs wrapped as `{"_raw_attributes": [...]}` must not leak
+    the marker key into the OCSF payload."""
+
+    def test_raw_attributes_key_not_in_unmapped(self):
+        framework = _make_framework([_mitre_requirement()])
+        findings = [_make_finding("check_a", "PASS")]
+
+        output = OCSFComplianceOutput(
+            findings=findings, framework=framework, provider="aws"
+        )
+
+        requirement_attrs = (output.data[0].unmapped or {}).get(
+            "requirement_attributes", {}
+        )
+        assert "_raw_attributes" not in requirement_attrs
+        assert "raw_attributes" not in requirement_attrs
+
+    def test_finding_serializes_with_raw_attributes(self):
+        framework = _make_framework(
+            [
+                _mitre_requirement(
+                    entries=[
+                        {"AWSService": "IAM", "Category": "Initial Access"},
+                        {"AWSService": "STS", "Category": "Privilege Escalation"},
+                    ]
+                )
+            ]
+        )
+        findings = [_make_finding("check_a", "PASS")]
+
+        output = OCSFComplianceOutput(
+            findings=findings, framework=framework, provider="aws"
+        )
+        compliance_finding = output.data[0]
+        if hasattr(compliance_finding, "model_dump_json"):
+            payload = json.loads(compliance_finding.model_dump_json(exclude_none=True))
+        else:
+            payload = json.loads(compliance_finding.json(exclude_none=True))
+        assert payload["compliance"]["requirements"] == ["T1078"]
+
+
+class TestProviderFiltering:
+    """OCSF writer scopes findings against `requirement.checks[provider]`."""
+
+    def test_check_for_other_provider_not_emitted(self):
+        azure_only_requirement = UniversalComplianceRequirement(
+            id="REQ-1",
+            description="Azure-only requirement",
+            attributes={},
+            checks={"azure": ["check_a"]},
+        )
+        framework = _make_framework([azure_only_requirement])
+        findings = [_make_finding("check_a", "PASS", provider="aws")]
+
+        output = OCSFComplianceOutput(
+            findings=findings, framework=framework, provider="aws"
+        )
+
+        assert all(
+            compliance_finding.status_code == "MANUAL"
+            for compliance_finding in output.data
+        )
+
+    def test_no_provider_aggregates_all_checks(self):
+        multi_provider_requirement = UniversalComplianceRequirement(
+            id="REQ-1",
+            description="Multi-provider requirement",
+            attributes={},
+            checks={"aws": ["check_a"], "azure": ["check_b"]},
+        )
+        framework = _make_framework([multi_provider_requirement])
+        findings = [
+            _make_finding("check_a", "PASS", provider="aws"),
+            _make_finding("check_b", "FAIL", provider="azure"),
+        ]
+
+        output = OCSFComplianceOutput(
+            findings=findings, framework=framework, provider=None
+        )
+
+        statuses = sorted(
+            compliance_finding.status_code for compliance_finding in output.data
+        )
+        assert statuses == ["FAIL", "PASS"]
diff --git a/tests/lib/outputs/compliance/universal/universal_output_test.py b/tests/lib/outputs/compliance/universal/universal_output_test.py
index 391a9015d7..d0fdf0f178 100644
--- a/tests/lib/outputs/compliance/universal/universal_output_test.py
+++ b/tests/lib/outputs/compliance/universal/universal_output_test.py
@@ -122,6 +122,43 @@ class TestManualRequirements:
         assert manual_rows[0].dict()["Requirements_Id"] == "manual-1"
         assert manual_rows[0].dict()["ResourceId"] == "manual_check"
 
+    def test_include_manual_false_skips_manual_rows(self, tmp_path):
+        """``_transform(..., include_manual=False)`` emits finding rows but
+        NOT manual requirements. The streaming caller passes ``False`` for
+        batches 2..N so manual rows are not duplicated across batches."""
+        reqs = [
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "IAM"},
+                checks={"aws": ["check_a"]},
+            ),
+            UniversalComplianceRequirement(
+                id="manual-1",
+                description="manual check",
+                attributes={"Section": "Governance"},
+                checks={},
+            ),
+        ]
+        metadata = [AttributeMetadata(key="Section", type="str")]
+        fw = _make_framework(reqs, metadata, TableConfig(group_by="Section"))
+        findings = [_make_finding("check_a", "PASS", {"TestFW-1.0": ["1.1"]})]
+
+        output = UniversalComplianceOutput(
+            findings=findings,
+            framework=fw,
+            file_path=str(tmp_path / "t.csv"),
+        )
+        # __init__ transforms with include_manual=True (default) → manual present
+        assert any(r.dict()["Status"] == "MANUAL" for r in output.data)
+
+        # A subsequent batch re-transforms with include_manual=False
+        output._data.clear()
+        output._transform(findings, fw, "TestFW-1.0", include_manual=False)
+
+        assert len(output.data) == 1  # only the finding row, no manual
+        assert all(r.dict()["Status"] != "MANUAL" for r in output.data)
+
 
 class TestMITREExtraColumns:
     def test_mitre_columns_present(self, tmp_path):
diff --git a/tests/lib/outputs/compliance/universal/universal_table_test.py b/tests/lib/outputs/compliance/universal/universal_table_test.py
index 7598c43c8b..abe3d0c3d0 100644
--- a/tests/lib/outputs/compliance/universal/universal_table_test.py
+++ b/tests/lib/outputs/compliance/universal/universal_table_test.py
@@ -1,3 +1,4 @@
+import re
 from types import SimpleNamespace
 from unittest.mock import MagicMock
 
@@ -26,6 +27,10 @@ def _make_finding(check_id, status="PASS", muted=False):
     return finding
 
 
+def _strip_ansi(text):
+    return re.sub(r"\x1b\[[0-9;]*m", "", text)
+
+
 def _make_framework(requirements, table_config, provider="AWS"):
     return ComplianceFramework(
         framework="TestFW",
@@ -39,6 +44,8 @@ def _make_framework(requirements, table_config, provider="AWS"):
 
 
 class TestBuildRequirementCheckMap:
+    """Test cases for building the requirement-to-check map of a framework."""
+
     def test_basic(self):
         reqs = [
             UniversalComplianceRequirement(
@@ -103,6 +110,8 @@ class TestBuildRequirementCheckMap:
 
 
 class TestGetGroupKey:
+    """Test cases for resolving the group key of a requirement."""
+
     def test_normal_field(self):
         req = UniversalComplianceRequirement(
             id="1.1",
@@ -124,7 +133,9 @@ class TestGetGroupKey:
 
 
 class TestGroupedMode:
-    def test_grouped_rendering(self, capsys):
+    """Test cases for grouped-mode universal compliance table rendering."""
+
+    def test_grouped_rendering(self, capsys, tmp_path):
         reqs = [
             UniversalComplianceRequirement(
                 id="1.1",
@@ -156,7 +167,7 @@ class TestGroupedMode:
             bulk_metadata,
             "test_fw",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
         )
@@ -167,9 +178,118 @@ class TestGroupedMode:
         assert "PASS" in captured.out
         assert "FAIL" in captured.out
 
+    def test_grouped_multi_section_no_undercount(self, capsys, tmp_path):
+        """A single check mapped to several sections must be counted in
+        every section it belongs to, not only the first one seen."""
+        reqs = [
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "IAM"},
+                checks={"aws": ["check_a", "check_b"]},
+            ),
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test2",
+                attributes={"Section": "Logging"},
+                checks={"aws": ["check_a"]},
+            ),
+        ]
+        tc = TableConfig(group_by="Section")
+        fw = _make_framework(reqs, tc)
+
+        # check_a (FAIL) belongs to both IAM and Logging sections; check_b
+        # (PASS, IAM only) is added so the overview total reaches 2 and the
+        # results table is rendered.
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both the IAM and Logging rows must report FAIL(1). Before the fix the
+        # second section seen (Logging) was undercounted to FAIL(0) and rendered
+        # as PASS. Anchor each occurrence to its own table row so an unrelated
+        # "FAIL(1)" elsewhere cannot mask an undercount.
+        iam_row = [
+            line for line in plain.splitlines() if "IAM" in line and "FAIL(1)" in line
+        ]
+        logging_row = [
+            line
+            for line in plain.splitlines()
+            if "Logging" in line and "FAIL(1)" in line
+        ]
+        assert len(iam_row) == 1
+        assert len(logging_row) == 1
+
+    def test_grouped_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED finding mapped to several groups must be counted in
+        the per-group Muted column of every group it belongs to."""
+        reqs = [
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "IAM"},
+                checks={"aws": ["check_a", "check_b"]},
+            ),
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test2",
+                attributes={"Section": "Logging"},
+                checks={"aws": ["check_a"]},
+            ),
+        ]
+        tc = TableConfig(group_by="Section")
+        fw = _make_framework(reqs, tc)
+
+        # check_a is MUTED and belongs to both IAM and Logging; check_b is a
+        # plain FAIL so the overview total reaches 2 and the table is rendered.
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            _make_finding("check_b", "FAIL"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # The muted finding belongs to both sections, so both the IAM row and
+        # the Logging row must carry a Muted count of 1 in their last cell.
+        muted_one_rows = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_one_rows) == 2
+
 
 class TestSplitMode:
-    def test_split_rendering(self, capsys):
+    """Test cases for split-mode universal compliance table rendering."""
+
+    def test_split_rendering(self, capsys, tmp_path):
         reqs = [
             UniversalComplianceRequirement(
                 id="1.1",
@@ -204,7 +324,7 @@ class TestSplitMode:
             bulk_metadata,
             "test_fw",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
         )
@@ -214,9 +334,119 @@ class TestSplitMode:
         assert "Level 1" in captured.out
         assert "Level 2" in captured.out
 
+    def test_split_muted_multi_section_not_undercounted(self, capsys, tmp_path):
+        """In split mode a single MUTED finding mapped to several groups must
+        be counted in the Muted column of every group it belongs to."""
+        reqs = [
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "Storage", "Profile": "Level 1"},
+                checks={"aws": ["check_a", "check_b"]},
+            ),
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test2",
+                attributes={"Section": "Logging", "Profile": "Level 1"},
+                checks={"aws": ["check_a"]},
+            ),
+        ]
+        tc = TableConfig(
+            group_by="Section",
+            split_by=SplitByConfig(field="Profile", values=["Level 1", "Level 2"]),
+        )
+        fw = _make_framework(reqs, tc)
+
+        # check_a is MUTED and belongs to both Storage and Logging; check_b is a
+        # plain FAIL so the table is rendered.
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            _make_finding("check_b", "FAIL"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both section rows must carry a Muted count of 1 (last cell). Before the
+        # fix only the first group seen incremented Muted, leaving the other 0.
+        muted_one_rows = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_one_rows) == 2
+
+    def test_split_same_group_value_not_double_counted(self, capsys, tmp_path):
+        """A single finding whose check maps to several requirements that share
+        the same group and split value must count once for that group/split,
+        not once per requirement (FAIL(1), never FAIL(2))."""
+        reqs = [
+            # check_a appears in two requirements, both Storage / Level 1.
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "Storage", "Profile": "Level 1"},
+                checks={"aws": ["check_a"]},
+            ),
+            UniversalComplianceRequirement(
+                id="1.2",
+                description="test2",
+                attributes={"Section": "Storage", "Profile": "Level 1"},
+                checks={"aws": ["check_a"]},
+            ),
+            # A second group so the table renders with more than one finding.
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test3",
+                attributes={"Section": "Logging", "Profile": "Level 1"},
+                checks={"aws": ["check_b"]},
+            ),
+        ]
+        tc = TableConfig(
+            group_by="Section",
+            split_by=SplitByConfig(field="Profile", values=["Level 1", "Level 2"]),
+        )
+        fw = _make_framework(reqs, tc)
+
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # The Storage row must show FAIL(1) for Level 1, never FAIL(2).
+        assert "FAIL(1)" in plain
+        assert "FAIL(2)" not in plain
+
 
 class TestScoredMode:
-    def test_scored_rendering(self, capsys):
+    """Test cases for scored-mode universal compliance table rendering."""
+
+    def test_scored_rendering(self, capsys, tmp_path):
         reqs = [
             UniversalComplianceRequirement(
                 id="1.1",
@@ -251,7 +481,7 @@ class TestScoredMode:
             bulk_metadata,
             "test_fw",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
         )
@@ -261,9 +491,68 @@ class TestScoredMode:
         assert "Score" in captured.out
         assert "Threat Score" in captured.out
 
+    def test_scored_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """In scored mode a single FAIL finding mapped to several groups must
+        show FAIL(1) in every group it belongs to, not only the first one."""
+        reqs = [
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "IAM", "LevelOfRisk": 5, "Weight": 100},
+                checks={"aws": ["check_a", "check_b"]},
+            ),
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test2",
+                attributes={"Section": "Logging", "LevelOfRisk": 3, "Weight": 50},
+                checks={"aws": ["check_a"]},
+            ),
+        ]
+        tc = TableConfig(
+            group_by="Section",
+            scoring=ScoringConfig(risk_field="LevelOfRisk", weight_field="Weight"),
+        )
+        fw = _make_framework(reqs, tc)
+
+        # check_a (FAIL) belongs to both IAM and Logging; check_b (PASS, IAM
+        # only) raises the overview total to 2 so the table is rendered.
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        iam_row = [
+            line for line in plain.splitlines() if "IAM" in line and "FAIL(1)" in line
+        ]
+        logging_row = [
+            line
+            for line in plain.splitlines()
+            if "Logging" in line and "FAIL(1)" in line
+        ]
+        assert len(iam_row) == 1
+        assert len(logging_row) == 1
+
 
 class TestCustomLabels:
-    def test_ens_spanish_labels(self, capsys):
+    """Test cases for custom-label universal compliance table rendering."""
+
+    def test_ens_spanish_labels(self, capsys, tmp_path):
         reqs = [
             UniversalComplianceRequirement(
                 id="1.1",
@@ -300,7 +589,7 @@ class TestCustomLabels:
             bulk_metadata,
             "test_fw",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
         )
@@ -311,7 +600,9 @@ class TestCustomLabels:
 
 
 class TestMultiProviderDictChecks:
-    def test_only_aws_checks_matched(self, capsys):
+    """Test cases for multi-provider dict checks in the universal table."""
+
+    def test_only_aws_checks_matched(self, capsys, tmp_path):
         """With dict checks and provider='aws', only AWS checks match findings."""
         reqs = [
             UniversalComplianceRequirement(
@@ -352,7 +643,7 @@ class TestMultiProviderDictChecks:
             bulk_metadata,
             "multi_cloud",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
             provider="aws",
@@ -366,7 +657,9 @@ class TestMultiProviderDictChecks:
 
 
 class TestNoTableConfig:
-    def test_returns_early_without_table_config(self, capsys):
+    """Test cases for the universal table when no table config is present."""
+
+    def test_returns_early_without_table_config(self, capsys, tmp_path):
         fw = ComplianceFramework(
             framework="TestFW",
             name="Test",
@@ -374,11 +667,11 @@ class TestNoTableConfig:
             description="Test",
             requirements=[],
         )
-        get_universal_table([], {}, "test", "out", "/tmp", False, framework=fw)
+        get_universal_table([], {}, "test", "out", str(tmp_path), False, framework=fw)
         captured = capsys.readouterr()
         assert captured.out == ""
 
-    def test_returns_early_without_framework(self, capsys):
-        get_universal_table([], {}, "test", "out", "/tmp", False, framework=None)
+    def test_returns_early_without_framework(self, capsys, tmp_path):
+        get_universal_table([], {}, "test", "out", str(tmp_path), False, framework=None)
         captured = capsys.readouterr()
         assert captured.out == ""
diff --git a/tests/lib/outputs/jira/jira_test.py b/tests/lib/outputs/jira/jira_test.py
index 03656891c8..76352cb297 100644
--- a/tests/lib/outputs/jira/jira_test.py
+++ b/tests/lib/outputs/jira/jira_test.py
@@ -339,6 +339,88 @@ class TestJiraIntegration:
         with pytest.raises(JiraRefreshTokenError):
             self.jira_integration.refresh_access_token()
 
+    @patch("prowler.lib.outputs.jira.jira.requests.post")
+    @patch.object(Jira, "get_cloud_id", return_value="test_cloud_id")
+    def test_get_auth_sends_timeout(self, mock_get_cloud_id, mock_post):
+        """get_auth must pass a request timeout to avoid hanging on an unresponsive Jira."""
+        # To disable vulture
+        mock_get_cloud_id = mock_get_cloud_id
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "access_token": "test_access_token",
+            "refresh_token": "test_refresh_token",
+            "expires_in": 3600,
+        }
+        mock_post.return_value = mock_response
+
+        self.jira_integration.get_auth("test_auth_code")
+
+        assert mock_post.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
+    @patch("prowler.lib.outputs.jira.jira.requests.get")
+    def test_get_cloud_id_sends_timeout(self, mock_get):
+        """get_cloud_id (OAuth path) must pass a request timeout."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = [{"id": "test_cloud_id"}]
+        mock_get.return_value = mock_response
+
+        self.jira_integration.get_cloud_id("test_access_token")
+
+        assert mock_get.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
+    @patch("prowler.lib.outputs.jira.jira.requests.get")
+    def test_get_cloud_id_basic_auth_sends_timeout(self, mock_get):
+        """get_cloud_id (basic-auth tenant_info path) must pass a request timeout."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"cloudId": "test_cloud_id"}
+        mock_get.return_value = mock_response
+
+        self.jira_integration_basic_auth.get_cloud_id(domain=self.domain)
+
+        assert mock_get.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
+    @patch("prowler.lib.outputs.jira.jira.requests.post")
+    def test_refresh_access_token_sends_timeout(self, mock_post):
+        """refresh_access_token must pass a request timeout."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "access_token": "new_access_token",
+            "refresh_token": "new_refresh_token",
+            "expires_in": 3600,
+        }
+        mock_post.return_value = mock_response
+
+        self.jira_integration.refresh_access_token()
+
+        assert mock_post.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
+    @patch.object(Jira, "get_access_token", return_value="valid_access_token")
+    @patch.object(
+        Jira, "cloud_id", new_callable=PropertyMock, return_value="test_cloud_id"
+    )
+    @patch("prowler.lib.outputs.jira.jira.requests.get")
+    def test_get_projects_sends_timeout(
+        self, mock_get, mock_cloud_id, mock_get_access_token
+    ):
+        """get_projects must pass a request timeout."""
+        # To disable vulture
+        mock_cloud_id = mock_cloud_id
+        mock_get_access_token = mock_get_access_token
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = [{"key": "PROJ1", "name": "Project One"}]
+        mock_get.return_value = mock_response
+
+        self.jira_integration.get_projects()
+
+        assert mock_get.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
     @patch.object(Jira, "get_auth", return_value=None)
     @patch.object(
         Jira,
@@ -1004,6 +1086,89 @@ class TestJiraIntegration:
             for mark in node.get("marks", [])
         )
 
+    @staticmethod
+    def _find_empty_text_nodes(node) -> List[str]:
+        # ADF forbids empty text nodes; collect any to assert the document is valid.
+        empties: List[str] = []
+
+        def walk(current) -> None:
+            if isinstance(current, dict):
+                if current.get("type") == "text" and current.get("text", "") == "":
+                    empties.append(current.get("text", ""))
+                for value in current.values():
+                    walk(value)
+            elif isinstance(current, list):
+                for item in current:
+                    walk(item)
+
+        walk(node)
+        return empties
+
+    def test_get_adf_description_empty_resource_name_has_no_empty_text_nodes(self):
+        # A resource without a name (e.g. an AWS-managed IAM policy) used to emit an
+        # empty ADF text node, making Jira reject the issue with 400 INVALID_INPUT.
+        adf_description = self.jira_integration.get_adf_description(
+            check_id="CHECK-1",
+            check_title="Sample check",
+            severity="CRITICAL",
+            severity_color="#FF0000",
+            status="FAIL",
+            status_color="#FF0000",
+            status_extended="Some status",
+            provider="aws",
+            region="eu-west-1",
+            resource_uid="arn:aws:iam::aws:policy/AdministratorAccess",
+            resource_name="",
+            recommendation_text="",
+        )
+
+        assert self._find_empty_text_nodes(adf_description) == []
+
+        table = adf_description["content"][1]
+        resource_name_row = self._find_table_row(table["content"], "Resource Name")
+        value_cell = resource_name_row["content"][1]
+        assert self._collect_text_from_cell(value_cell) == "-"
+
+    @pytest.mark.parametrize(
+        "field, header",
+        [
+            ("check_id", "Check Id"),
+            ("check_title", "Check Title"),
+            ("status_extended", "Status Extended"),
+            ("provider", "Provider"),
+            ("region", "Region"),
+            ("resource_uid", "Resource UID"),
+            ("resource_name", "Resource Name"),
+        ],
+    )
+    def test_get_adf_description_empty_plain_text_fields_render_placeholder(
+        self, field, header
+    ):
+        base_kwargs = dict(
+            check_id="CHECK-1",
+            check_title="Sample check",
+            severity="HIGH",
+            severity_color="#FF0000",
+            status="FAIL",
+            status_color="#00FF00",
+            status_extended="Some status",
+            provider="aws",
+            region="us-east-1",
+            resource_uid="resource-1",
+            resource_name="resource-name",
+            recommendation_text="",
+        )
+        base_kwargs[field] = ""
+
+        adf_description = self.jira_integration.get_adf_description(**base_kwargs)
+
+        assert self._find_empty_text_nodes(adf_description) == []
+
+        table = adf_description["content"][1]
+        row = self._find_table_row(table["content"], header)
+        value_cell = row["content"][1]
+        assert self._collect_text_from_cell(value_cell) == "-"
+
     @patch.object(Jira, "get_access_token", return_value="valid_access_token")
     @patch.object(
         Jira, "get_available_issue_types", return_value=["Bug", "Task", "Story"]
diff --git a/tests/lib/outputs/ocsf/ocsf_test.py b/tests/lib/outputs/ocsf/ocsf_test.py
index 16ff1ce317..f449fd49f7 100644
--- a/tests/lib/outputs/ocsf/ocsf_test.py
+++ b/tests/lib/outputs/ocsf/ocsf_test.py
@@ -2,8 +2,10 @@ import json
 from datetime import datetime, timezone
 from io import StringIO
 from typing import Optional
+from unittest.mock import MagicMock
 from uuid import UUID
 
+import pytest
 import requests
 from freezegun import freeze_time
 from mock import patch
@@ -300,6 +302,36 @@ class TestOCSF:
     def test_batch_write_data_to_file_without_findings(self):
         assert not OCSF([])._file_descriptor
 
+    def test_batch_write_data_to_file_propagates_oserror(self):
+        """An I/O error (e.g. ENOSPC) while writing a finding must propagate
+        instead of being swallowed, so the caller can fail fast."""
+        findings = [
+            generate_finding_output(
+                status="FAIL",
+                severity="low",
+                muted=False,
+                region=AWS_REGION_EU_WEST_1,
+                timestamp=datetime.now(),
+                resource_details="resource_details",
+                resource_name="resource_name",
+                resource_uid="resource-id",
+                status_extended="status extended",
+            )
+        ]
+
+        output = OCSF(findings)
+        mock_file = MagicMock()
+        mock_file.closed = False
+        # Non-zero so the "[" prelude is skipped and the failure happens on the
+        # per-finding write, the exact path that hit ENOSPC in production.
+        mock_file.tell.return_value = 1
+        mock_file.write.side_effect = OSError(28, "No space left on device")
+        output._file_descriptor = mock_file
+
+        with pytest.raises(OSError) as excinfo:
+            output.batch_write_data_to_file()
+        assert excinfo.value.errno == 28
+
     def test_finding_output_cloud_pass_low_muted(self):
         finding_output = generate_finding_output(
             status="PASS",
diff --git a/tests/lib/outputs/outputs_test.py b/tests/lib/outputs/outputs_test.py
index 87901bd290..ca18717847 100644
--- a/tests/lib/outputs/outputs_test.py
+++ b/tests/lib/outputs/outputs_test.py
@@ -51,9 +51,7 @@ class TestOutputs:
 
     def test_parse_html_string(self):
         string = "CISA: your-systems-3, your-data-1, your-data-2 | CIS-1.4: 2.1.1 | CIS-1.5: 2.1.1 | GDPR: article_32 | AWS-Foundational-Security-Best-Practices: s3 | HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii | GxP-21-CFR-Part-11: 11.10-c, 11.30 | GxP-EU-Annex-11: 7.1-data-storage-damage-protection | NIST-800-171-Revision-2: 3_3_8, 3_5_10, 3_13_11, 3_13_16 | NIST-800-53-Revision-4: sc_28 | NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, cp_9_8, pm_11_b, sc_8_3, sc_8_4, sc_13_a, sc_16_1, sc_28_1, si_19_4 | ENS-RD2022: mp.si.2.aws.s3.1 | NIST-CSF-1.1: ds_1 | RBI-Cyber-Security-Framework: annex_i_1_3 | FFIEC: d3-pc-am-b-12 | PCI-3.2.1: s3 | FedRamp-Moderate-Revision-4: sc-13, sc-28 | FedRAMP-Low-Revision-4: sc-13 | KISA-ISMS-P-2023: 2.6.1 | KISA-ISMS-P-2023-korean: 2.6.1"
-        assert (
-            parse_html_string(string)
-            == """
+        assert parse_html_string(string) == """
 &#x2022;CISA: your-systems-3, your-data-1, your-data-2
 
 &#x2022;CIS-1.4: 2.1.1
@@ -94,7 +92,6 @@ class TestOutputs:
 
 &#x2022;KISA-ISMS-P-2023-korean: 2.6.1
 """
-        )
 
     def test_unroll_tags(self):
         dict_list = [
diff --git a/tests/lib/scan/scan_test.py b/tests/lib/scan/scan_test.py
index b0fe82b7b2..8037668b10 100644
--- a/tests/lib/scan/scan_test.py
+++ b/tests/lib/scan/scan_test.py
@@ -51,7 +51,7 @@ def mock_provider():
 def mock_execute():
     with mock.patch("prowler.lib.scan.scan.execute", autospec=True) as mock_exec:
         findings = [finding]
-        mock_exec.side_effect = lambda *args, **kwargs: findings
+        mock_exec.side_effect = lambda *_args, **_kwargs: findings
         yield mock_exec
 
 
@@ -264,10 +264,10 @@ class TestScan:
     @patch("prowler.lib.scan.scan.update_checks_metadata_with_compliance")
     @patch("prowler.lib.scan.scan.Compliance.get_bulk")
     @patch("prowler.lib.scan.scan.CheckMetadata.get_bulk")
-    @patch("prowler.lib.scan.scan.import_check")
+    @patch("prowler.lib.scan.scan._resolve_check_module")
     def test_scan(
         self,
-        mock_import_check,
+        mock_resolve_check_module,
         mock_get_bulk,
         mock_compliance_get_bulk,
         mock_update_checks_metadata,
@@ -285,7 +285,7 @@ class TestScan:
         mock_check_instance.CheckTitle = "Check if IAM Access Analyzer is enabled"
         mock_check_instance.Categories = []
 
-        mock_import_check.return_value = MagicMock(
+        mock_resolve_check_module.return_value = MagicMock(
             accessanalyzer_enabled=mock_check_class
         )
 
diff --git a/tests/providers/aws/lib/ip_ranges/ip_ranges_test.py b/tests/providers/aws/lib/ip_ranges/ip_ranges_test.py
new file mode 100644
index 0000000000..bce53165d6
--- /dev/null
+++ b/tests/providers/aws/lib/ip_ranges/ip_ranges_test.py
@@ -0,0 +1,112 @@
+import json
+import urllib.error
+from ipaddress import IPv4Network, IPv6Network, ip_address
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.aws.lib.ip_ranges.ip_ranges import get_public_ip_networks
+
+URLOPEN_TARGET = "prowler.providers.aws.lib.ip_ranges.ip_ranges.urllib.request.urlopen"
+
+SAMPLE_RANGES = {
+    "prefixes": [
+        {"ip_prefix": "54.152.0.0/16", "service": "AMAZON"},
+        {"ip_prefix": "3.5.140.0/22", "service": "S3"},
+    ],
+    "ipv6_prefixes": [
+        {"ipv6_prefix": "2600:1f00::/24", "service": "AMAZON"},
+    ],
+}
+
+
+def mock_urlopen(payload):
+    response = MagicMock()
+    response.read.return_value = json.dumps(payload).encode()
+    context_manager = MagicMock()
+    context_manager.__enter__.return_value = response
+    context_manager.__exit__.return_value = False
+    return context_manager
+
+
+class TestGetPublicIPNetworks:
+    def test_parses_ipv4_and_ipv6_prefixes(self):
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(SAMPLE_RANGES)):
+            networks = get_public_ip_networks()
+
+        assert networks == [
+            IPv4Network("54.152.0.0/16"),
+            IPv4Network("3.5.140.0/22"),
+            IPv6Network("2600:1f00::/24"),
+        ]
+
+    def test_known_aws_ip_is_contained(self):
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(SAMPLE_RANGES)):
+            networks = get_public_ip_networks()
+
+        assert any(ip_address("54.152.12.70") in network for network in networks)
+
+    def test_external_ip_is_not_contained(self):
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(SAMPLE_RANGES)):
+            networks = get_public_ip_networks()
+
+        assert not any(ip_address("17.5.7.3") in network for network in networks)
+
+    def test_empty_payload_returns_empty_list(self):
+        with patch(
+            "prowler.providers.aws.lib.ip_ranges.ip_ranges.urllib.request.urlopen",
+            return_value=mock_urlopen({}),
+        ):
+            networks = get_public_ip_networks()
+
+        assert networks == []
+
+    def test_prefixes_missing_cidr_are_skipped(self):
+        payload = {
+            "prefixes": [{"ip_prefix": "10.0.0.0/8"}, {"service": "EC2"}],
+            "ipv6_prefixes": [{"service": "AMAZON"}],
+        }
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(payload)):
+            networks = get_public_ip_networks()
+
+        assert networks == [IPv4Network("10.0.0.0/8")]
+
+    def test_urlopen_failure_returns_empty_list(self):
+        with patch(URLOPEN_TARGET, side_effect=urllib.error.URLError("boom")):
+            networks = get_public_ip_networks()
+
+        assert networks == []
+
+    def test_timeout_returns_empty_list(self):
+        with patch(URLOPEN_TARGET, side_effect=TimeoutError("timed out")):
+            networks = get_public_ip_networks()
+
+        assert networks == []
+
+    def test_invalid_json_returns_empty_list(self):
+        response = MagicMock()
+        response.read.return_value = b"not json"
+        context_manager = MagicMock()
+        context_manager.__enter__.return_value = response
+        context_manager.__exit__.return_value = False
+        with patch(URLOPEN_TARGET, return_value=context_manager):
+            networks = get_public_ip_networks()
+
+        assert networks == []
+
+    def test_malformed_cidr_is_skipped(self):
+        payload = {
+            "prefixes": [
+                {"ip_prefix": "300.0.0.0/8"},
+                {"ip_prefix": "10.0.0.0/8"},
+            ],
+            "ipv6_prefixes": [
+                {"ipv6_prefix": "2600::/129"},
+                {"ipv6_prefix": "2600:1f00::/24"},
+            ],
+        }
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(payload)):
+            networks = get_public_ip_networks()
+
+        assert networks == [
+            IPv4Network("10.0.0.0/8"),
+            IPv6Network("2600:1f00::/24"),
+        ]
diff --git a/tests/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege_test.py b/tests/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege_test.py
new file mode 100644
index 0000000000..c6e5d7f756
--- /dev/null
+++ b/tests/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege_test.py
@@ -0,0 +1,275 @@
+from json import dumps
+from unittest import mock
+
+import botocore
+from boto3 import client
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+AGENT_ID = "test-agent-id"
+AGENT_NAME = "test-agent-name"
+AGENT_ARN = (
+    f"arn:aws:bedrock:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:agent/{AGENT_ID}"
+)
+ROLE_NAME = "AmazonBedrockExecutionRoleForAgents_test"
+ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/{ROLE_NAME}"
+BOUNDARY_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/AgentBoundary"
+
+ASSUME_ROLE_POLICY_DOCUMENT = {
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {"Service": "bedrock.amazonaws.com"},
+            "Action": "sts:AssumeRole",
+        }
+    ],
+}
+
+BOUNDARY_POLICY_DOCUMENT = {
+    "Version": "2012-10-17",
+    "Statement": [{"Effect": "Allow", "Action": "bedrock:*", "Resource": "*"}],
+}
+
+NARROW_INLINE_POLICY = {
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": ["s3:GetObject"],
+            "Resource": ["arn:aws:s3:::my-rag-bucket/*"],
+        }
+    ],
+}
+
+BROAD_INLINE_POLICY = {
+    "Version": "2012-10-17",
+    "Statement": [{"Effect": "Allow", "Action": "*", "Resource": "*"}],
+}
+
+
+# Mock both ListAgents and GetAgent at the botocore level. moto's bedrock-agent
+# support is incomplete for our needs (GetAgent often doesn't echo back the
+# role ARN we set), so we control the responses directly. We also need to keep
+# IAM calls going to moto.
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def _mock_bedrock_agent_factory(role_arn):
+    """Return a mock_make_api_call function that returns role_arn from GetAgent.
+
+    Pass role_arn=None to simulate an agent whose role can't be resolved.
+    """
+
+    def _mock_make_api_call(self, operation_name, kwarg):
+        if operation_name == "ListAgents":
+            return {
+                "agentSummaries": [
+                    {"agentId": AGENT_ID, "agentName": AGENT_NAME},
+                ]
+            }
+        if operation_name == "GetAgent":
+            return {
+                "agent": {
+                    "agentId": AGENT_ID,
+                    "agentName": AGENT_NAME,
+                    "agentResourceRoleArn": role_arn,
+                }
+            }
+        if operation_name == "ListTagsForResource":
+            return {"tags": {}}
+        if operation_name == "ListPrompts":
+            return {"promptSummaries": []}
+        return make_api_call(self, operation_name, kwarg)
+
+    return _mock_make_api_call
+
+
+def _setup_role(
+    *,
+    attached_policy_arns=(),
+    inline_policies=None,
+    permissions_boundary=None,
+):
+    """Create an IAM role in moto with the given configuration. Returns the role ARN."""
+    iam = client("iam", region_name=AWS_REGION_US_EAST_1)
+
+    if permissions_boundary:
+        iam.create_policy(
+            PolicyName="AgentBoundary",
+            PolicyDocument=dumps(BOUNDARY_POLICY_DOCUMENT),
+        )
+
+    create_kwargs = {
+        "RoleName": ROLE_NAME,
+        "AssumeRolePolicyDocument": dumps(ASSUME_ROLE_POLICY_DOCUMENT),
+    }
+    if permissions_boundary:
+        create_kwargs["PermissionsBoundary"] = permissions_boundary
+    iam.create_role(**create_kwargs)
+
+    for policy_arn in attached_policy_arns:
+        iam.attach_role_policy(RoleName=ROLE_NAME, PolicyArn=policy_arn)
+
+    for policy_name, policy_document in (inline_policies or {}).items():
+        iam.put_role_policy(
+            RoleName=ROLE_NAME,
+            PolicyName=policy_name,
+            PolicyDocument=dumps(policy_document),
+        )
+
+    return ROLE_ARN
+
+
+def _run_check(role_arn_for_get_agent):
+    """Build the IAM + BedrockAgent services, patch them in, run the check."""
+    from prowler.providers.aws.services.bedrock.bedrock_service import BedrockAgent
+    from prowler.providers.aws.services.iam.iam_service import IAM
+
+    aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+    with mock.patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=_mock_bedrock_agent_factory(role_arn_for_get_agent),
+    ):
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege.bedrock_agent_client",
+                new=BedrockAgent(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege.iam_client",
+                new=IAM(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege import (
+                bedrock_agent_role_least_privilege,
+            )
+
+            return bedrock_agent_role_least_privilege().execute()
+
+
+class Test_bedrock_agent_role_least_privilege:
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_no_agents(self):
+        """No agents in the account -> zero findings."""
+        from prowler.providers.aws.services.bedrock.bedrock_service import BedrockAgent
+        from prowler.providers.aws.services.iam.iam_service import IAM
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege.bedrock_agent_client",
+                new=BedrockAgent(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege.iam_client",
+                new=IAM(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege import (
+                bedrock_agent_role_least_privilege,
+            )
+
+            assert bedrock_agent_role_least_privilege().execute() == []
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_compliant(self):
+        """Narrow inline policy + boundary + no *FullAccess attached -> PASS."""
+        role_arn = _setup_role(
+            inline_policies={"NarrowAccess": NARROW_INLINE_POLICY},
+            permissions_boundary=BOUNDARY_ARN,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert "follows least privilege" in result[0].status_extended
+        assert result[0].resource_id == AGENT_ID
+        assert result[0].resource_arn == AGENT_ARN
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_full_access_attached(self):
+        """AmazonBedrockFullAccess attached -> FAIL."""
+        role_arn = _setup_role(
+            attached_policy_arns=("arn:aws:iam::aws:policy/AmazonBedrockFullAccess",),
+            inline_policies={"NarrowAccess": NARROW_INLINE_POLICY},
+            permissions_boundary=BOUNDARY_ARN,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "grants full access" in result[0].status_extended
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_administrator_access_attached(self):
+        """AdministratorAccess attached (no FullAccess suffix) -> FAIL via doc-based admin check."""
+        role_arn = _setup_role(
+            attached_policy_arns=("arn:aws:iam::aws:policy/AdministratorAccess",),
+            inline_policies={"NarrowAccess": NARROW_INLINE_POLICY},
+            permissions_boundary=BOUNDARY_ARN,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert (
+            "managed policy AdministratorAccess grants administrative access"
+            in result[0].status_extended
+        )
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_resource_star_broad_action(self):
+        """Inline statement with Action:* on Resource:* -> FAIL."""
+        role_arn = _setup_role(
+            inline_policies={"BroadAccess": BROAD_INLINE_POLICY},
+            permissions_boundary=BOUNDARY_ARN,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "grants administrative access" in result[0].status_extended
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_no_permissions_boundary(self):
+        """Otherwise clean role but missing permissions boundary -> FAIL."""
+        role_arn = _setup_role(
+            inline_policies={"NarrowAccess": NARROW_INLINE_POLICY},
+            permissions_boundary=None,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "no permissions boundary configured" in result[0].status_extended
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_not_resolvable(self):
+        """role_arn returned by GetAgent doesn't match any IAM role -> FAIL."""
+        result = _run_check(
+            role_arn_for_get_agent=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/does-not-exist"
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "could not be resolved" in result[0].status_extended
diff --git a/tests/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials_test.py b/tests/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials_test.py
index bf4f6381b9..d75d248c7c 100644
--- a/tests/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials_test.py
+++ b/tests/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials_test.py
@@ -3,466 +3,197 @@ from unittest import mock
 
 from moto import mock_aws
 
+from prowler.lib.check.models import Severity
 from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider
 
+BEDROCK_SERVICE = "bedrock.amazonaws.com"
+
+
+def _make_user(name="test_user"):
+    from prowler.providers.aws.services.iam.iam_service import User
+
+    return User(
+        name=name,
+        arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/{name}",
+        attached_policies=[],
+        inline_policies=[],
+    )
+
+
+def _make_credential(
+    user,
+    credential_id="test-credential-id",
+    expiration_delta_days=None,
+    service_name=BEDROCK_SERVICE,
+):
+    from prowler.providers.aws.services.iam.iam_service import ServiceSpecificCredential
+
+    expiration_date = (
+        datetime.now(timezone.utc) + timedelta(days=expiration_delta_days)
+        if expiration_delta_days is not None
+        else None
+    )
+    return ServiceSpecificCredential(
+        arn=(
+            f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/{user.name}/"
+            f"credential/{credential_id}"
+        ),
+        user=user,
+        status="Active",
+        create_date=datetime.now(timezone.utc),
+        service_user_name=None,
+        service_credential_alias=None,
+        expiration_date=expiration_date,
+        id=credential_id,
+        service_name=service_name,
+        region=AWS_REGION_US_EAST_1,
+    )
+
+
+def _run_check(credentials):
+    from prowler.providers.aws.services.iam.iam_service import IAM
+
+    aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+    iam = IAM(aws_provider)
+    iam.service_specific_credentials = credentials
+
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ),
+        mock.patch(
+            "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
+            new=iam,
+        ),
+    ):
+        from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
+            bedrock_api_key_no_long_term_credentials,
+        )
+
+        check = bedrock_api_key_no_long_term_credentials()
+        return check.execute()
+
 
 class Test_bedrock_api_key_no_long_term_credentials:
     @mock_aws
     def test_no_bedrock_api_keys(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
-
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=IAM(aws_provider),
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 0
+        assert _run_check([]) == []
 
     @mock_aws
-    def test_bedrock_api_key_with_future_expiration_date(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
+    def test_active_short_expiration_key_fails_high(self):
+        # Per AWS guidance, every active long-term key is a finding regardless of
+        # how soon it expires. Short remaining lifetime does not downgrade severity.
+        credential = _make_credential(_make_user(), expiration_delta_days=30)
+        result = _run_check([credential])
 
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential with future expiration date
-        expiration_date = datetime.now(timezone.utc) + timedelta(days=30)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date,
-            id="test-credential-id",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert "will expire in" in result[0].status_extended
-            assert "test-credential-id" in result[0].status_extended
-            assert "test_user" in result[0].status_extended
-            assert result[0].resource_id == "test-credential-id"
-            assert result[0].region == AWS_REGION_US_EAST_1
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert result[0].check_metadata.Severity == Severity.high
+        assert "is active and will expire in" in result[0].status_extended
+        assert "short-term Bedrock API keys" in result[0].status_extended
 
     @mock_aws
-    def test_bedrock_api_key_with_critical_expiration_date(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
+    def test_active_long_expiration_key_fails_high(self):
+        credential = _make_credential(_make_user(), expiration_delta_days=365)
+        result = _run_check([credential])
 
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential with very far future expiration date (>10000 days)
-        expiration_date = datetime.now(timezone.utc) + timedelta(days=15000)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date,
-            id="test-credential-id",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert "never expires" in result[0].status_extended
-            assert "test-credential-id" in result[0].status_extended
-            assert "test_user" in result[0].status_extended
-            assert result[0].resource_id == "test-credential-id"
-            assert result[0].region == AWS_REGION_US_EAST_1
-            assert check.Severity == "critical"
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert result[0].check_metadata.Severity == Severity.high
+        assert "is active and will expire in" in result[0].status_extended
 
     @mock_aws
-    def test_bedrock_api_key_with_expired_date(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
+    def test_never_expires_key_fails_critical(self):
+        # >10000 days approximates AWS's "no expiration" sentinel (~100 years).
+        credential = _make_credential(_make_user(), expiration_delta_days=15000)
+        result = _run_check([credential])
 
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential with past expiration date
-        expiration_date = datetime.now(timezone.utc) - timedelta(days=30)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date,
-            id="test-credential-id",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 1
-            assert result[0].status == "PASS"
-            assert "has expired" in result[0].status_extended
-            assert "test-credential-id" in result[0].status_extended
-            assert "test_user" in result[0].status_extended
-            assert result[0].resource_id == "test-credential-id"
-            assert result[0].region == AWS_REGION_US_EAST_1
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert result[0].check_metadata.Severity == Severity.critical
+        assert "configured to never expire" in result[0].status_extended
+        assert "short-term Bedrock API keys" in result[0].status_extended
 
     @mock_aws
-    def test_bedrock_api_key_without_expiration_date_ignored(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
+    def test_already_expired_key_passes(self):
+        credential = _make_credential(_make_user(), expiration_delta_days=-30)
+        result = _run_check([credential])
 
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential without expiration date (should be ignored)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=None,  # No expiration date - should be ignored
-            id="test-credential-id",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 0
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert "has already expired" in result[0].status_extended
 
     @mock_aws
-    def test_non_bedrock_api_key_ignored(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
-
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential for a different service
-        expiration_date = datetime.now(timezone.utc) + timedelta(days=30)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date,
-            id="test-credential-id",
-            service_name="codecommit.amazonaws.com",  # Different service
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 0
+    def test_key_without_expiration_date_ignored(self):
+        credential = _make_credential(_make_user(), expiration_delta_days=None)
+        assert _run_check([credential]) == []
 
     @mock_aws
-    def test_multiple_bedrock_api_keys_mixed_scenarios(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
-
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
+    def test_non_bedrock_service_ignored(self):
+        credential = _make_credential(
+            _make_user(),
+            expiration_delta_days=30,
+            service_name="codecommit.amazonaws.com",
         )
+        assert _run_check([credential]) == []
 
-        # Create mock users
-        mock_user1 = User(
-            name="test_user1",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user1",
-            attached_policies=[],
-            inline_policies=[],
+    @mock_aws
+    def test_mixed_scenarios(self):
+        user1, user2, user3 = (
+            _make_user("u1"),
+            _make_user("u2"),
+            _make_user("u3"),
         )
-
-        mock_user2 = User(
-            name="test_user2",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user2",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        mock_user3 = User(
-            name="test_user3",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user3",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential with future expiration date
-        expiration_date1 = datetime.now(timezone.utc) + timedelta(days=30)
-        mock_credential1 = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user1/credential/test-credential-id-1",
-            user=mock_user1,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date1,
-            id="test-credential-id-1",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        # Create a mock service-specific credential with critical expiration date
-        expiration_date2 = datetime.now(timezone.utc) + timedelta(days=15000)
-        mock_credential2 = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user2/credential/test-credential-id-2",
-            user=mock_user2,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date2,
-            id="test-credential-id-2",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        # Create a mock service-specific credential with expired date
-        expiration_date3 = datetime.now(timezone.utc) - timedelta(days=30)
-        mock_credential3 = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user3/credential/test-credential-id-3",
-            user=mock_user3,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date3,
-            id="test-credential-id-3",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [
-            mock_credential1,
-            mock_credential2,
-            mock_credential3,
+        credentials = [
+            _make_credential(user1, "active-key", expiration_delta_days=191),
+            _make_credential(user2, "never-key", expiration_delta_days=15000),
+            _make_credential(user3, "expired-key", expiration_delta_days=-30),
         ]
+        result = _run_check(credentials)
 
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
+        assert len(result) == 3
+        by_id = {r.resource_id: r for r in result}
+
+        assert by_id["active-key"].status == "FAIL"
+        assert by_id["active-key"].check_metadata.Severity == Severity.high
+
+        assert by_id["never-key"].status == "FAIL"
+        assert by_id["never-key"].check_metadata.Severity == Severity.critical
+
+        assert by_id["expired-key"].status == "PASS"
+
+    @mock_aws
+    def test_severity_does_not_leak_never_then_active(self):
+        """Regression: a never-expires key processed before an active key must
+        not bleed `critical` severity into the active finding."""
+        credentials = [
+            _make_credential(
+                _make_user("u-never"), "never-key", expiration_delta_days=15000
             ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
+            _make_credential(
+                _make_user("u-active"), "active-key", expiration_delta_days=191
             ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
+        ]
+        result = _run_check(credentials)
 
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
+        by_id = {r.resource_id: r for r in result}
+        assert by_id["never-key"].check_metadata.Severity == Severity.critical
+        assert by_id["active-key"].check_metadata.Severity == Severity.high
 
-            assert len(result) == 3
+    @mock_aws
+    def test_severity_does_not_leak_active_then_never(self):
+        """Regression: same as above with the reverse iteration order."""
+        credentials = [
+            _make_credential(
+                _make_user("u-active"), "active-key", expiration_delta_days=191
+            ),
+            _make_credential(
+                _make_user("u-never"), "never-key", expiration_delta_days=15000
+            ),
+        ]
+        result = _run_check(credentials)
 
-            # Check the credential with future expiration date (FAIL)
-            fail_result1 = next(
-                r for r in result if r.resource_id == "test-credential-id-1"
-            )
-            assert fail_result1.status == "FAIL"
-            assert "will expire in" in fail_result1.status_extended
-            assert "test-credential-id-1" in fail_result1.status_extended
-            assert "test_user1" in fail_result1.status_extended
-
-            # Check the credential with critical expiration date (FAIL)
-            fail_result2 = next(
-                r for r in result if r.resource_id == "test-credential-id-2"
-            )
-            assert fail_result2.status == "FAIL"
-            assert "never expires" in fail_result2.status_extended
-            assert "test-credential-id-2" in fail_result2.status_extended
-            assert "test_user2" in fail_result2.status_extended
-
-            # Check the credential with expired date (PASS)
-            pass_result = next(
-                r for r in result if r.resource_id == "test-credential-id-3"
-            )
-            assert pass_result.status == "PASS"
-            assert "has expired" in pass_result.status_extended
-            assert "test-credential-id-3" in pass_result.status_extended
-            assert "test_user3" in pass_result.status_extended
+        by_id = {r.resource_id: r for r in result}
+        assert by_id["active-key"].check_metadata.Severity == Severity.high
+        assert by_id["never-key"].check_metadata.Severity == Severity.critical
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py
index 66c2099843..928ff2b47c 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py
@@ -674,3 +674,185 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
             result = check.execute()
 
             assert len(result) == 0
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = ReplaceNetworkAclAssociation) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = CreateNetworkAcl) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured import (
+                cloudwatch_changes_to_network_acls_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_acls_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_substring_only_no_match(self):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured import (
+                cloudwatch_changes_to_network_acls_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_acls_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "No CloudWatch log groups found with metric filters or alarms associated."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py
index afe0f7d3ce..50c8663437 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py
@@ -616,3 +616,95 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
             )
             assert result[0].region == AWS_REGION_US_EAST_1
             assert result[0].resource_tags == [{}]
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = DetachInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = CreateCustomerGateway) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_changes_to_network_gateways_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_changes_to_network_gateways_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_changes_to_network_gateways_alarm_configured import (
+                cloudwatch_changes_to_network_gateways_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_gateways_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py
index 7ec6e32c56..929793eb34 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py
@@ -596,3 +596,185 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = ec2.amazonaws.com) && ($.eventName = DisassociateRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DeleteRouteTable) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = ReplaceRoute) || ($.eventName = CreateRouteTable) || ($.eventName = CreateRoute) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured import (
+                cloudwatch_changes_to_network_route_tables_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_route_tables_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_substring_only_no_match(self):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = ec2.amazonaws.com) && ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DisassociateRouteTable) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured import (
+                cloudwatch_changes_to_network_route_tables_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_route_tables_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "No CloudWatch log groups found with metric filters or alarms associated."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py
index 31f27030ff..57d33cb3fe 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py
@@ -596,3 +596,185 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = EnableVpcClassicLink) || ($.eventName = DisableVpcClassicLink) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = ModifyVpcAttribute) || ($.eventName = DeleteVpc) || ($.eventName = CreateVpc) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured import (
+                cloudwatch_changes_to_vpcs_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_vpcs_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_substring_only_no_match(self):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured import (
+                cloudwatch_changes_to_vpcs_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_vpcs_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "No CloudWatch log groups found with metric filters or alarms associated."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled_test.py
index 30982553b2..62ca14d4ba 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled_test.py
@@ -665,3 +665,97 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_c
             result = check.execute()
 
             assert len(result) == 0
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = config.amazonaws.com) && (($.eventName = PutConfigurationRecorder) || ($.eventName = PutDeliveryChannel) || ($.eventName = DeleteDeliveryChannel) || ($.eventName = StopConfigurationRecorder)) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled import (
+                cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled,
+            )
+
+            check = (
+                cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled_test.py
index fcb98fda3e..3b555bf05b 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled_test.py
@@ -610,3 +610,97 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_c
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = StopLogging) || ($.eventName = StartLogging) || ($.eventName = DeleteTrail) || ($.eventName = UpdateTrail) || ($.eventName = CreateTrail) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled import (
+                cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled,
+            )
+
+            check = (
+                cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures_test.py
index 66b9d8116b..201be76f6d 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_authentication_failures:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.errorMessage = Failed authentication) && ($.eventName = ConsoleLogin) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_log_metric_filter_authentication_failures.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_log_metric_filter_authentication_failures.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_log_metric_filter_authentication_failures import (
+                cloudwatch_log_metric_filter_authentication_failures,
+            )
+
+            check = cloudwatch_log_metric_filter_authentication_failures()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes_test.py
index 3aaf475cbe..534c50c906 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_aws_organizations_changes:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = organizations.amazonaws.com) && ($.eventName = UpdatePolicy) || ($.eventName = UpdateOrganizationalUnit) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = MoveAccount) || ($.eventName = DisablePolicyType) || ($.eventName = DetachPolicy) || ($.eventName = LeaveOrganization) || ($.eventName = InviteAccountToOrganization) || ($.eventName = EnablePolicyType) || ($.eventName = EnableAllFeatures) || ($.eventName = DeletePolicy) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeleteOrganization) || ($.eventName = DeclineHandshake) || ($.eventName = CreatePolicy) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreateOrganization) || ($.eventName = CreateAccount) || ($.eventName = CancelHandshake) || ($.eventName = AttachPolicy) || ($.eventName = AcceptHandshake) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_log_metric_filter_aws_organizations_changes.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_log_metric_filter_aws_organizations_changes.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_log_metric_filter_aws_organizations_changes import (
+                cloudwatch_log_metric_filter_aws_organizations_changes,
+            )
+
+            check = cloudwatch_log_metric_filter_aws_organizations_changes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk_test.py
index 7eb1cae331..f13263cf9f 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk_test.py
@@ -610,3 +610,97 @@ class Test_cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = kms.amazonaws.com) && (($.eventName = ScheduleKeyDeletion) || ($.eventName = DisableKey)) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk import (
+                cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk,
+            )
+
+            check = (
+                cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes_test.py
index 7d2d631f11..aa88f5164d 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_for_s3_bucket_policy_changes:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = s3.amazonaws.com) && (($.eventName = DeleteBucketReplication) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketPolicy) || ($.eventName = PutBucketReplication) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketAcl)) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes import (
+                cloudwatch_log_metric_filter_for_s3_bucket_policy_changes,
+            )
+
+            check = cloudwatch_log_metric_filter_for_s3_bucket_policy_changes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes_test.py
index 06e36688d6..fd3e86d313 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = DetachGroupPolicy) || ($.eventName = AttachGroupPolicy) || ($.eventName = DetachUserPolicy) || ($.eventName = AttachUserPolicy) || ($.eventName = DetachRolePolicy) || ($.eventName = AttachRolePolicy) || ($.eventName = DeletePolicyVersion) || ($.eventName = CreatePolicyVersion) || ($.eventName = DeletePolicy) || ($.eventName = CreatePolicy) || ($.eventName = PutUserPolicy) || ($.eventName = PutRolePolicy) || ($.eventName = PutGroupPolicy) || ($.eventName = DeleteUserPolicy) || ($.eventName = DeleteRolePolicy) || ($.eventName = DeleteGroupPolicy) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_policy_changes.cloudwatch_log_metric_filter_policy_changes.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_policy_changes.cloudwatch_log_metric_filter_policy_changes.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_policy_changes.cloudwatch_log_metric_filter_policy_changes.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_policy_changes.cloudwatch_log_metric_filter_policy_changes import (
+                cloudwatch_log_metric_filter_policy_changes,
+            )
+
+            check = cloudwatch_log_metric_filter_policy_changes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes_test.py
index ede85e8e6e..35dee7b516 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes_test.py
@@ -599,3 +599,95 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = DeleteSecurityGroup) || ($.eventName = CreateSecurityGroup) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = AuthorizeSecurityGroupIngress) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_log_metric_filter_security_group_changes.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_log_metric_filter_security_group_changes.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_log_metric_filter_security_group_changes import (
+                cloudwatch_log_metric_filter_security_group_changes,
+            )
+
+            check = cloudwatch_log_metric_filter_security_group_changes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa_test.py
index df67472cdd..6944860d75 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_sign_in_without_mfa:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.additionalEventData.MFAUsed != Yes) && ($.eventName = ConsoleLogin) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_log_metric_filter_sign_in_without_mfa.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_log_metric_filter_sign_in_without_mfa import (
+                cloudwatch_log_metric_filter_sign_in_without_mfa,
+            )
+
+            check = cloudwatch_log_metric_filter_sign_in_without_mfa()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py
index 8ae7ed980f..33d4bde7d7 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py
@@ -1,3 +1,4 @@
+import pytest
 from boto3 import client
 from moto import mock_aws
 
@@ -5,6 +6,9 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
     CloudWatch,
     Logs,
 )
+from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
+)
 from tests.providers.aws.utils import (
     AWS_ACCOUNT_NUMBER,
     AWS_REGION_US_EAST_1,
@@ -216,3 +220,13 @@ class Test_CloudWatch_Service:
         assert logs.log_groups[arn].kms_id == "test_kms_id"
         assert logs.log_groups[arn].region == AWS_REGION_US_EAST_1
         assert logs.log_groups[arn].tags == [{}]
+
+
+class Test_build_metric_filter_pattern:
+    @pytest.mark.parametrize("bad_operator", ["==", "~=", "<", "<>", ">=", ""])
+    def test_rejects_unsupported_operator(self, bad_operator):
+        with pytest.raises(ValueError, match="unsupported operator"):
+            build_metric_filter_pattern(
+                event_names=["ConsoleLogin"],
+                extra_clauses=[("errorMessage", bad_operator, "Failed authentication")],
+            )
diff --git a/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py b/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py
index d0d1057307..bf27c29632 100644
--- a/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py
+++ b/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py
@@ -1,3 +1,4 @@
+import ssl
 import urllib.error
 import urllib.request
 from unittest import mock
@@ -67,7 +68,7 @@ class Test_codepipeline_project_repo_private:
                     "Connection": {"ProviderType": "GitHub"}
                 }
 
-                def mock_urlopen_side_effect(req, context=None):
+                def mock_urlopen_side_effect(req, **kwargs):
                     raise urllib.error.HTTPError(
                         url="", code=404, msg="", hdrs={}, fp=None
                     )
@@ -145,7 +146,7 @@ class Test_codepipeline_project_repo_private:
                 mock_response.getcode.return_value = 200
                 mock_response.geturl.return_value = f"https://github.com/{repo_id}"
 
-                def mock_urlopen_side_effect(req, context=None):
+                def mock_urlopen_side_effect(req, **kwargs):
                     if "github.com" in req.get_full_url():
                         return mock_response
                     raise urllib.error.HTTPError(
@@ -172,6 +173,145 @@ class Test_codepipeline_project_repo_private:
                 assert result[0].resource_tags == []
                 assert result[0].region == AWS_REGION
 
+    def test_pipeline_repo_ssl_verification_failure(self):
+        """Test that a TLS certificate verification failure is treated as private.
+        When the probe cannot verify the server certificate (e.g. a MITM
+        presenting a forged certificate), the repository must not be reported
+        as public.
+        """
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_aws_provider([AWS_REGION]),
+        ):
+            codepipeline_client = mock.MagicMock
+            pipeline_name = "test-pipeline"
+            pipeline_arn = f"arn:aws:codepipeline:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:pipeline/{pipeline_name}"
+            connection_arn = f"arn:aws:codestar-connections:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:connection/test-connection"
+            repo_id = "prowler-cloud/prowler-private"
+
+            codepipeline_client.pipelines = {
+                pipeline_arn: Pipeline(
+                    name=pipeline_name,
+                    arn=pipeline_arn,
+                    region=AWS_REGION,
+                    source=Source(
+                        type="CodeStarSourceConnection",
+                        repository_id=repo_id,
+                        configuration={
+                            "FullRepositoryId": repo_id,
+                            "ConnectionArn": connection_arn,
+                        },
+                    ),
+                    tags=[],
+                )
+            }
+
+            with (
+                mock.patch(
+                    "prowler.providers.aws.services.codepipeline.codepipeline_service.CodePipeline",
+                    codepipeline_client,
+                ),
+                mock.patch(
+                    "prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private.codepipeline_client",
+                    codepipeline_client,
+                ),
+                mock.patch("boto3.client") as mock_client,
+                mock.patch("urllib.request.urlopen") as mock_urlopen,
+            ):
+                mock_connection = mock_client.return_value
+                mock_connection.get_connection.return_value = {
+                    "Connection": {"ProviderType": "GitHub"}
+                }
+
+                def mock_urlopen_side_effect(req, **kwargs):
+                    raise ssl.SSLError("certificate verify failed")
+
+                mock_urlopen.side_effect = mock_urlopen_side_effect
+
+                from prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private import (
+                    codepipeline_project_repo_private,
+                )
+
+                check = codepipeline_project_repo_private()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+                assert (
+                    result[0].status_extended
+                    == f"CodePipeline {pipeline_name} source repository {repo_id} is private."
+                )
+
+    def test_pipeline_repo_probe_verifies_certificate_and_sets_timeout(self):
+        """Test the probe never disables certificate verification and sets a timeout.
+        Regression test for the SSL verification bypass: the check must not use
+        an unverified SSL context, and every request must carry a timeout.
+        """
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_aws_provider([AWS_REGION]),
+        ):
+            codepipeline_client = mock.MagicMock
+            pipeline_name = "test-pipeline"
+            pipeline_arn = f"arn:aws:codepipeline:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:pipeline/{pipeline_name}"
+            connection_arn = f"arn:aws:codestar-connections:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:connection/test-connection"
+            repo_id = "prowler-cloud/prowler-private"
+
+            codepipeline_client.pipelines = {
+                pipeline_arn: Pipeline(
+                    name=pipeline_name,
+                    arn=pipeline_arn,
+                    region=AWS_REGION,
+                    source=Source(
+                        type="CodeStarSourceConnection",
+                        repository_id=repo_id,
+                        configuration={
+                            "FullRepositoryId": repo_id,
+                            "ConnectionArn": connection_arn,
+                        },
+                    ),
+                    tags=[],
+                )
+            }
+
+            with (
+                mock.patch(
+                    "prowler.providers.aws.services.codepipeline.codepipeline_service.CodePipeline",
+                    codepipeline_client,
+                ),
+                mock.patch(
+                    "prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private.codepipeline_client",
+                    codepipeline_client,
+                ),
+                mock.patch("boto3.client") as mock_client,
+                mock.patch("urllib.request.urlopen") as mock_urlopen,
+                mock.patch("ssl._create_unverified_context") as mock_unverified,
+            ):
+                mock_connection = mock_client.return_value
+                mock_connection.get_connection.return_value = {
+                    "Connection": {"ProviderType": "GitHub"}
+                }
+
+                def mock_urlopen_side_effect(req, **kwargs):
+                    raise urllib.error.HTTPError(
+                        url="", code=404, msg="", hdrs={}, fp=None
+                    )
+
+                mock_urlopen.side_effect = mock_urlopen_side_effect
+
+                from prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private import (
+                    HTTP_TIMEOUT,
+                    codepipeline_project_repo_private,
+                )
+
+                check = codepipeline_project_repo_private()
+                check.execute()
+
+                mock_unverified.assert_not_called()
+                assert mock_urlopen.call_count > 0
+                for call in mock_urlopen.call_args_list:
+                    assert call.kwargs.get("timeout") == HTTP_TIMEOUT
+
     def test_pipeline_public_gitlab_repo(self):
         """Test detection of public GitLab repository in CodePipeline.
         Tests that the check correctly identifies a public GitLab repository
@@ -225,7 +365,7 @@ class Test_codepipeline_project_repo_private:
                 mock_response.getcode.return_value = 200
                 mock_response.geturl.return_value = f"https://gitlab.com/{repo_id}"
 
-                def mock_urlopen_side_effect(req, context=None):
+                def mock_urlopen_side_effect(req, **kwargs):
                     if "gitlab.com" in req.get_full_url():
                         return mock_response
                     raise urllib.error.HTTPError(
diff --git a/tests/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions_test.py b/tests/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions_test.py
new file mode 100644
index 0000000000..f2acf555d1
--- /dev/null
+++ b/tests/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions_test.py
@@ -0,0 +1,491 @@
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_EU_WEST_1,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+orig = botocore.client.BaseClient._make_api_call
+
+
+AGG_ARN_TEMPLATE = (
+    "arn:aws:config:{region}:" + AWS_ACCOUNT_NUMBER + ":config-aggregator/{name}"
+)
+
+
+def _aggregator_payload(
+    name, region, *, org_aware=True, all_regions=True, aws_regions=None
+):
+    payload = {
+        "ConfigurationAggregatorName": name,
+        "ConfigurationAggregatorArn": AGG_ARN_TEMPLATE.format(region=region, name=name),
+    }
+    if org_aware:
+        org_source = {
+            "RoleArn": f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/AWSConfigRoleForOrganizations",
+            "AllAwsRegions": all_regions,
+        }
+        if not all_regions and aws_regions:
+            org_source["AwsRegions"] = aws_regions
+        payload["OrganizationAggregationSource"] = org_source
+    return payload
+
+
+def make_mock_no_aggregators_no_admin():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {"ConfigurationAggregators": []}
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_aggregator_not_org_aware():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "legacy-agg",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=False,
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_org_aggregator_not_all_regions_with_admin():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "partial-org-agg",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=True,
+                        all_regions=False,
+                        aws_regions=[AWS_REGION_EU_WEST_1],
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            return {
+                "DelegatedAdministrators": [
+                    {
+                        "Id": "123456789012",
+                        "Arn": f"arn:aws:organizations::{AWS_ACCOUNT_NUMBER}:account/o-abc123/123456789012",
+                        "Email": "admin@example.com",
+                        "Name": "Security",
+                        "Status": "ACTIVE",
+                        "JoinedMethod": "CREATED",
+                    }
+                ]
+            }
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_full_pass():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "org-aggregator",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=True,
+                        all_regions=True,
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            return {
+                "DelegatedAdministrators": [
+                    {
+                        "Id": "123456789012",
+                        "Arn": f"arn:aws:organizations::{AWS_ACCOUNT_NUMBER}:account/o-abc123/123456789012",
+                        "Email": "admin@example.com",
+                        "Name": "Security",
+                        "Status": "ACTIVE",
+                        "JoinedMethod": "CREATED",
+                    }
+                ]
+            }
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_access_denied_on_orgs():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "org-aggregator",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=True,
+                        all_regions=True,
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            raise botocore.exceptions.ClientError(
+                {
+                    "Error": {
+                        "Code": "AccessDeniedException",
+                        "Message": "User is not authorized to perform: organizations:ListDelegatedAdministrators",
+                    }
+                },
+                operation_name,
+            )
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_aggregators_access_denied():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            raise botocore.exceptions.ClientError(
+                {
+                    "Error": {
+                        "Code": "AccessDeniedException",
+                        "Message": "denied",
+                    }
+                },
+                operation_name,
+            )
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_aggregators_other_client_error():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            raise botocore.exceptions.ClientError(
+                {
+                    "Error": {
+                        "Code": "InternalServerError",
+                        "Message": "boom",
+                    }
+                },
+                operation_name,
+            )
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_aggregators_unexpected_exception():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            raise RuntimeError("simulated transient error")
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_delegated_admins_unexpected_exception():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "org-aggregator",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=True,
+                        all_regions=True,
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            raise RuntimeError("simulated transient error")
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+class Test_config_delegated_admin_and_org_aggregator_all_regions:
+    @mock_aws
+    def test_no_aggregators_no_admin(self):
+        """Test when no aggregators exist in any region and no delegated admin is set."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_no_aggregators_no_admin(),
+        ):
+            aws_provider = set_mocked_aws_provider(
+                [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+            )
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert (
+                    "no Organization Aggregator configured in any region"
+                    in result[0].status_extended
+                )
+                assert (
+                    "no delegated administrator registered for config.amazonaws.com"
+                    in result[0].status_extended
+                )
+
+    @mock_aws
+    def test_aggregator_not_org_aware(self):
+        """Test when an aggregator exists but is not an organization aggregator."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_aggregator_not_org_aware(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                eu_west_1_result = None
+                for finding in result:
+                    if finding.region == AWS_REGION_EU_WEST_1:
+                        eu_west_1_result = finding
+                        break
+
+                assert eu_west_1_result is not None
+                assert eu_west_1_result.status == "FAIL"
+                assert (
+                    "is not an organization aggregator"
+                    in eu_west_1_result.status_extended
+                )
+
+    @mock_aws
+    def test_org_aggregator_not_all_regions_with_admin(self):
+        """Test org aggregator that doesn't cover all AWS regions (delegated admin set)."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_org_aggregator_not_all_regions_with_admin(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                eu_west_1_result = None
+                for finding in result:
+                    if finding.region == AWS_REGION_EU_WEST_1:
+                        eu_west_1_result = finding
+                        break
+
+                assert eu_west_1_result is not None
+                assert eu_west_1_result.status == "FAIL"
+                assert (
+                    "does not cover all AWS regions" in eu_west_1_result.status_extended
+                )
+
+    @mock_aws
+    def test_full_pass(self):
+        """Test PASS: delegated admin set and org aggregator covering all AWS regions."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_full_pass(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                eu_west_1_result = None
+                for finding in result:
+                    if finding.region == AWS_REGION_EU_WEST_1:
+                        eu_west_1_result = finding
+                        break
+
+                assert eu_west_1_result is not None
+                assert eu_west_1_result.status == "PASS"
+                assert (
+                    "is an organization aggregator covering all AWS regions"
+                    in eu_west_1_result.status_extended
+                )
+                assert "delegated admin configured" in eu_west_1_result.status_extended
+                assert eu_west_1_result.resource_arn == AGG_ARN_TEMPLATE.format(
+                    region=AWS_REGION_EU_WEST_1, name="org-aggregator"
+                )
+
+    @mock_aws
+    def test_access_denied_on_organizations(self):
+        """Test that AccessDenied on Organizations is reported as unknown admin state."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_access_denied_on_orgs(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                eu_west_1_result = None
+                for finding in result:
+                    if finding.region == AWS_REGION_EU_WEST_1:
+                        eu_west_1_result = finding
+                        break
+
+                assert eu_west_1_result is not None
+                # The check still runs; aggregator coverage is satisfied but the
+                # delegated-admin status is unknown, so it must FAIL.
+                assert eu_west_1_result.status == "FAIL"
+                assert (
+                    "delegated administrator status for config.amazonaws.com could not be determined"
+                    in eu_west_1_result.status_extended
+                )
+
+    @mock_aws
+    def test_aggregators_access_denied(self):
+        """AccessDenied on DescribeConfigurationAggregators is swallowed: no aggregators recorded for that region."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_aggregators_access_denied(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+            from prowler.providers.aws.services.config.config_service import Config
+
+            service = Config(aws_provider)
+            assert service.aggregators == {}
+
+    @mock_aws
+    def test_aggregators_other_client_error(self):
+        """Non-access ClientError on DescribeConfigurationAggregators is logged at error level."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_aggregators_other_client_error(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+            from prowler.providers.aws.services.config.config_service import Config
+
+            service = Config(aws_provider)
+            assert service.aggregators == {}
+
+    @mock_aws
+    def test_aggregators_unexpected_exception(self):
+        """Non-ClientError on DescribeConfigurationAggregators is caught by bare except."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_aggregators_unexpected_exception(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+            from prowler.providers.aws.services.config.config_service import Config
+
+            service = Config(aws_provider)
+            assert service.aggregators == {}
+
+    @mock_aws
+    def test_delegated_admins_unexpected_exception(self):
+        """Non-ClientError on ListDelegatedAdministrators must still set lookup_failed."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_delegated_admins_unexpected_exception(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+            from prowler.providers.aws.services.config.config_service import Config
+
+            service = Config(aws_provider)
+            assert service.delegated_administrators_lookup_failed is True
+            assert service.delegated_administrators == []
diff --git a/tests/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/elbv2_alb_drop_invalid_header_fields_enabled_test.py b/tests/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/elbv2_alb_drop_invalid_header_fields_enabled_test.py
new file mode 100644
index 0000000000..40d8d91f0d
--- /dev/null
+++ b/tests/providers/aws/services/elbv2/elbv2_alb_drop_invalid_header_fields_enabled/elbv2_alb_drop_invalid_header_fields_enabled_test.py
@@ -0,0 +1,254 @@
+from importlib import import_module
+from unittest import mock
+
+from boto3 import client, resource
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+    AWS_REGION_EU_WEST_1,
+    AWS_REGION_EU_WEST_1_AZA,
+    AWS_REGION_EU_WEST_1_AZB,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+CHECK_MODULE = (
+    "prowler.providers.aws.services.elbv2."
+    "elbv2_alb_drop_invalid_header_fields_enabled."
+    "elbv2_alb_drop_invalid_header_fields_enabled"
+)
+ELBV2_CLIENT_PATCH = f"{CHECK_MODULE}.elbv2_client"
+GLOBAL_PROVIDER_PATCH = ".".join(
+    [
+        "prowler.providers.common.provider.Provider",
+        "get_global_provider",
+    ]
+)
+PASS_STATUS_EXTENDED = " ".join(
+    [
+        "ELBv2 ALB my-lb is configured to drop invalid",
+        "header fields.",
+    ]
+)
+FAIL_STATUS_EXTENDED = (
+    "ELBv2 ALB my-lb is not configured to drop invalid header fields."
+)
+
+
+def get_check_class():
+    return getattr(
+        import_module(CHECK_MODULE),
+        "elbv2_alb_drop_invalid_header_fields_enabled",
+    )
+
+
+class Test_elbv2_alb_drop_invalid_header_fields_enabled:
+    @mock_aws
+    def test_elb_no_balancers(self):
+        from prowler.providers.aws.services.elbv2.elbv2_service import ELBv2
+
+        with (
+            mock.patch(
+                GLOBAL_PROVIDER_PATCH,
+                return_value=set_mocked_aws_provider(
+                    [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+                ),
+            ),
+            mock.patch(
+                ELBV2_CLIENT_PATCH,
+                new=ELBv2(
+                    set_mocked_aws_provider(
+                        [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+                        create_default_organization=False,
+                    )
+                ),
+            ),
+        ):
+            check = get_check_class()()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    @mock_aws
+    def test_elbv2_dropping_invalid_header_fields(self):
+        conn = client("elbv2", region_name=AWS_REGION_EU_WEST_1)
+        ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
+
+        security_group = ec2.create_security_group(
+            GroupName="a-security-group", Description="First One"
+        )
+        vpc = ec2.create_vpc(
+            CidrBlock="172.28.7.0/24",
+            InstanceTenancy="default",
+        )
+        subnet1 = ec2.create_subnet(
+            VpcId=vpc.id,
+            CidrBlock="172.28.7.192/26",
+            AvailabilityZone=AWS_REGION_EU_WEST_1_AZA,
+        )
+        subnet2 = ec2.create_subnet(
+            VpcId=vpc.id,
+            CidrBlock="172.28.7.0/26",
+            AvailabilityZone=AWS_REGION_EU_WEST_1_AZB,
+        )
+
+        lb = conn.create_load_balancer(
+            Name="my-lb",
+            Subnets=[subnet1.id, subnet2.id],
+            SecurityGroups=[security_group.id],
+            Scheme="internal",
+            Type="application",
+        )["LoadBalancers"][0]
+
+        conn.modify_load_balancer_attributes(
+            LoadBalancerArn=lb["LoadBalancerArn"],
+            Attributes=[
+                {
+                    "Key": "routing.http.drop_invalid_header_fields.enabled",
+                    "Value": "true",
+                },
+            ],
+        )
+
+        from prowler.providers.aws.services.elbv2.elbv2_service import ELBv2
+
+        with (
+            mock.patch(
+                GLOBAL_PROVIDER_PATCH,
+                return_value=set_mocked_aws_provider(
+                    [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+                ),
+            ),
+            mock.patch(
+                ELBV2_CLIENT_PATCH,
+                new=ELBv2(
+                    set_mocked_aws_provider(
+                        [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+                        create_default_organization=False,
+                    )
+                ),
+            ),
+        ):
+            check = get_check_class()()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == PASS_STATUS_EXTENDED
+            assert result[0].resource_id == "my-lb"
+            assert result[0].resource_arn == lb["LoadBalancerArn"]
+
+    @mock_aws
+    def test_elbv2_not_dropping_invalid_header_fields(self):
+        conn = client("elbv2", region_name=AWS_REGION_EU_WEST_1)
+        ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
+
+        security_group = ec2.create_security_group(
+            GroupName="a-security-group", Description="First One"
+        )
+        vpc = ec2.create_vpc(
+            CidrBlock="172.28.7.0/24",
+            InstanceTenancy="default",
+        )
+        subnet1 = ec2.create_subnet(
+            VpcId=vpc.id,
+            CidrBlock="172.28.7.192/26",
+            AvailabilityZone=AWS_REGION_EU_WEST_1_AZA,
+        )
+        subnet2 = ec2.create_subnet(
+            VpcId=vpc.id,
+            CidrBlock="172.28.7.0/26",
+            AvailabilityZone=AWS_REGION_EU_WEST_1_AZB,
+        )
+
+        lb = conn.create_load_balancer(
+            Name="my-lb",
+            Subnets=[subnet1.id, subnet2.id],
+            SecurityGroups=[security_group.id],
+            Scheme="internal",
+            Type="application",
+        )["LoadBalancers"][0]
+
+        conn.modify_load_balancer_attributes(
+            LoadBalancerArn=lb["LoadBalancerArn"],
+            Attributes=[
+                {
+                    "Key": "routing.http.drop_invalid_header_fields.enabled",
+                    "Value": "false",
+                },
+            ],
+        )
+
+        from prowler.providers.aws.services.elbv2.elbv2_service import ELBv2
+
+        with (
+            mock.patch(
+                GLOBAL_PROVIDER_PATCH,
+                return_value=set_mocked_aws_provider(
+                    [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+                ),
+            ),
+            mock.patch(
+                ELBV2_CLIENT_PATCH,
+                new=ELBv2(
+                    set_mocked_aws_provider(
+                        [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+                        create_default_organization=False,
+                    )
+                ),
+            ),
+        ):
+            check = get_check_class()()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == FAIL_STATUS_EXTENDED
+            assert result[0].resource_id == "my-lb"
+            assert result[0].resource_arn == lb["LoadBalancerArn"]
+
+    @mock_aws
+    def test_elbv2_network_load_balancer_ignored(self):
+        conn = client("elbv2", region_name=AWS_REGION_EU_WEST_1)
+        ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
+
+        vpc = ec2.create_vpc(
+            CidrBlock="172.28.7.0/24",
+            InstanceTenancy="default",
+        )
+        subnet1 = ec2.create_subnet(
+            VpcId=vpc.id,
+            CidrBlock="172.28.7.192/26",
+            AvailabilityZone=AWS_REGION_EU_WEST_1_AZA,
+        )
+
+        conn.create_load_balancer(
+            Name="my-nlb",
+            Subnets=[subnet1.id],
+            Scheme="internal",
+            Type="network",
+        )
+
+        from prowler.providers.aws.services.elbv2.elbv2_service import ELBv2
+
+        with (
+            mock.patch(
+                GLOBAL_PROVIDER_PATCH,
+                return_value=set_mocked_aws_provider(
+                    [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+                ),
+            ),
+            mock.patch(
+                ELBV2_CLIENT_PATCH,
+                new=ELBv2(
+                    set_mocked_aws_provider(
+                        [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1],
+                        create_default_organization=False,
+                    )
+                ),
+            ),
+        ):
+            check = get_check_class()()
+            result = check.execute()
+
+            assert len(result) == 0
diff --git a/tests/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists_test.py b/tests/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists_test.py
new file mode 100644
index 0000000000..32f5487100
--- /dev/null
+++ b/tests/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists_test.py
@@ -0,0 +1,247 @@
+from unittest import mock
+
+from prowler.providers.aws.services.sagemaker.sagemaker_service import ProcessingJob
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_EU_WEST_1,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+CLARIFY_IMAGE_URI = f"{AWS_ACCOUNT_NUMBER}.dkr.ecr.{AWS_REGION_US_EAST_1}.amazonaws.com/sagemaker-clarify-processing:1.0"
+NON_CLARIFY_IMAGE_URI = f"{AWS_ACCOUNT_NUMBER}.dkr.ecr.{AWS_REGION_US_EAST_1}.amazonaws.com/sagemaker-xgboost:1.0"
+CUSTOM_CLARIFY_IMAGE_URI = f"{AWS_ACCOUNT_NUMBER}.dkr.ecr.{AWS_REGION_US_EAST_1}.amazonaws.com/my-clarify-thing:1.0"
+PROCESSING_JOB_ARN = f"arn:aws:sagemaker:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:processing-job/clarify-job"
+
+
+class Test_sagemaker_clarify_exists:
+    def test_no_processing_jobs_no_scanned_regions(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = []
+        sagemaker_client.processing_jobs_scanned_regions = set()
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_processing_jobs_region_scanned(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = []
+        sagemaker_client.processing_jobs_scanned_regions = {AWS_REGION_US_EAST_1}
+        sagemaker_client.audited_partition = "aws"
+        sagemaker_client.audited_account = AWS_ACCOUNT_NUMBER
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"No SageMaker Clarify processing jobs found in region {AWS_REGION_US_EAST_1}."
+            )
+            assert result[0].resource_id == "sagemaker-clarify"
+
+    def test_non_clarify_processing_job(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = [
+            ProcessingJob(
+                name="xgboost-job",
+                arn=f"arn:aws:sagemaker:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:processing-job/xgboost-job",
+                region=AWS_REGION_US_EAST_1,
+                image_uri=NON_CLARIFY_IMAGE_URI,
+            )
+        ]
+        sagemaker_client.processing_jobs_scanned_regions = {AWS_REGION_US_EAST_1}
+        sagemaker_client.audited_partition = "aws"
+        sagemaker_client.audited_account = AWS_ACCOUNT_NUMBER
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"No SageMaker Clarify processing jobs found in region {AWS_REGION_US_EAST_1}."
+            )
+
+    def test_custom_image_with_clarify_in_name_does_not_match(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = [
+            ProcessingJob(
+                name="my-clarify-thing-job",
+                arn=f"arn:aws:sagemaker:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:processing-job/my-clarify-thing-job",
+                region=AWS_REGION_US_EAST_1,
+                image_uri=CUSTOM_CLARIFY_IMAGE_URI,
+            )
+        ]
+        sagemaker_client.processing_jobs_scanned_regions = {AWS_REGION_US_EAST_1}
+        sagemaker_client.audited_partition = "aws"
+        sagemaker_client.audited_account = AWS_ACCOUNT_NUMBER
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"No SageMaker Clarify processing jobs found in region {AWS_REGION_US_EAST_1}."
+            )
+
+    def test_clarify_processing_job_exists(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = [
+            ProcessingJob(
+                name="clarify-job",
+                arn=PROCESSING_JOB_ARN,
+                region=AWS_REGION_US_EAST_1,
+                image_uri=CLARIFY_IMAGE_URI,
+            )
+        ]
+        sagemaker_client.processing_jobs_scanned_regions = {AWS_REGION_US_EAST_1}
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"SageMaker Clarify processing job clarify-job exists in region {AWS_REGION_US_EAST_1}."
+            )
+            assert result[0].resource_id == "clarify-job"
+            assert result[0].resource_arn == PROCESSING_JOB_ARN
+
+    def test_mixed_regions(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = [
+            ProcessingJob(
+                name="clarify-job",
+                arn=PROCESSING_JOB_ARN,
+                region=AWS_REGION_US_EAST_1,
+                image_uri=CLARIFY_IMAGE_URI,
+            )
+        ]
+        sagemaker_client.processing_jobs_scanned_regions = {
+            AWS_REGION_US_EAST_1,
+            AWS_REGION_EU_WEST_1,
+        }
+        sagemaker_client.audited_partition = "aws"
+        sagemaker_client.audited_account = AWS_ACCOUNT_NUMBER
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+
+            assert len(result) == 2
+
+            results_by_region = {r.region: r for r in result}
+
+            us_result = results_by_region[AWS_REGION_US_EAST_1]
+            assert us_result.status == "PASS"
+            assert (
+                us_result.status_extended
+                == f"SageMaker Clarify processing job clarify-job exists in region {AWS_REGION_US_EAST_1}."
+            )
+
+            eu_result = results_by_region[AWS_REGION_EU_WEST_1]
+            assert eu_result.status == "FAIL"
+            assert (
+                eu_result.status_extended
+                == f"No SageMaker Clarify processing jobs found in region {AWS_REGION_EU_WEST_1}."
+            )
diff --git a/tests/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/sagemaker_models_monitor_enabled_test.py b/tests/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/sagemaker_models_monitor_enabled_test.py
new file mode 100644
index 0000000000..afdb5c6ff7
--- /dev/null
+++ b/tests/providers/aws/services/sagemaker/sagemaker_models_monitor_enabled/sagemaker_models_monitor_enabled_test.py
@@ -0,0 +1,229 @@
+from unittest import mock
+
+from prowler.providers.aws.services.sagemaker.sagemaker_service import (
+    MonitoringSchedule,
+)
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_EU_WEST_1,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+test_monitoring_schedule = "test-monitoring-schedule"
+monitoring_schedule_arn = f"arn:aws:sagemaker:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:monitoring-schedule/{test_monitoring_schedule}"
+
+aggregate_name = "SageMaker Monitoring Schedules"
+unknown_arn = f"arn:aws:sagemaker:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:monitoring-schedule/unknown"
+
+
+class Test_sagemaker_models_monitor_enabled:
+    def test_no_models_monitoring_schedules_exist(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_monitoring_schedules = [
+            MonitoringSchedule(
+                name=aggregate_name,
+                region=AWS_REGION_EU_WEST_1,
+                arn=unknown_arn,
+                has_schedules=False,
+                is_scheduled=False,
+            )
+        ]
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+
+            from prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled import (
+                sagemaker_models_monitor_enabled,
+            )
+
+            check = sagemaker_models_monitor_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].region == AWS_REGION_EU_WEST_1
+            assert (
+                result[0].status_extended
+                == f"No SageMaker monitoring schedules found in region {AWS_REGION_EU_WEST_1}."
+            )
+            assert result[0].resource_id == aggregate_name
+            assert result[0].resource_arn == unknown_arn
+
+    def test_region_with_schedules_but_none_scheduled(self):
+        # A region that has monitoring schedules but none in Scheduled state
+        # must FAIL once.
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_monitoring_schedules = [
+            MonitoringSchedule(
+                name=aggregate_name,
+                region=AWS_REGION_EU_WEST_1,
+                arn=unknown_arn,
+                has_schedules=True,
+                is_scheduled=False,
+            )
+        ]
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+
+            from prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled import (
+                sagemaker_models_monitor_enabled,
+            )
+
+            check = sagemaker_models_monitor_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].region == AWS_REGION_EU_WEST_1
+            assert (
+                result[0].status_extended
+                == f"No active SageMaker monitoring schedule in region {AWS_REGION_EU_WEST_1}; existing schedules are not in Scheduled status."
+            )
+
+    def test_region_with_one_scheduled_passes(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_monitoring_schedules = [
+            MonitoringSchedule(
+                name=test_monitoring_schedule,
+                region=AWS_REGION_EU_WEST_1,
+                arn=monitoring_schedule_arn,
+                has_schedules=True,
+                is_scheduled=True,
+            )
+        ]
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+
+            from prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled import (
+                sagemaker_models_monitor_enabled,
+            )
+
+            check = sagemaker_models_monitor_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].region == AWS_REGION_EU_WEST_1
+            assert (
+                result[0].status_extended
+                == f"SageMaker monitoring schedule {test_monitoring_schedule} is enabled in region {AWS_REGION_EU_WEST_1}."
+            )
+            assert result[0].resource_id == test_monitoring_schedule
+            assert result[0].resource_arn == monitoring_schedule_arn
+
+    def test_scheduled_not_masked_across_regions(self):
+        # Regression: a region without an active monitor must not mask a
+        # Scheduled monitor in another region; one finding per region.
+        scheduled_name = "scheduled-monitor"
+        scheduled_arn = f"arn:aws:sagemaker:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:monitoring-schedule/{scheduled_name}"
+
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_monitoring_schedules = [
+            MonitoringSchedule(
+                name=aggregate_name,
+                region=AWS_REGION_EU_WEST_1,
+                arn=unknown_arn,
+                has_schedules=False,
+                is_scheduled=False,
+            ),
+            MonitoringSchedule(
+                name=scheduled_name,
+                region=AWS_REGION_US_EAST_1,
+                arn=scheduled_arn,
+                has_schedules=True,
+                is_scheduled=True,
+            ),
+        ]
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+
+            from prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled import (
+                sagemaker_models_monitor_enabled,
+            )
+
+            check = sagemaker_models_monitor_enabled()
+            result = check.execute()
+            assert len(result) == 2
+
+            results_by_region = {r.region: r for r in result}
+
+            assert results_by_region[AWS_REGION_EU_WEST_1].status == "FAIL"
+            assert (
+                results_by_region[AWS_REGION_EU_WEST_1].status_extended
+                == f"No SageMaker monitoring schedules found in region {AWS_REGION_EU_WEST_1}."
+            )
+
+            assert results_by_region[AWS_REGION_US_EAST_1].status == "PASS"
+            assert (
+                results_by_region[AWS_REGION_US_EAST_1].status_extended
+                == f"SageMaker monitoring schedule {scheduled_name} is enabled in region {AWS_REGION_US_EAST_1}."
+            )
+
+    def test_empty_schedules_list(self):
+        # Regression: an empty list must not raise and must yield no findings.
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_monitoring_schedules = []
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+
+            from prowler.providers.aws.services.sagemaker.sagemaker_models_monitor_enabled.sagemaker_models_monitor_enabled import (
+                sagemaker_models_monitor_enabled,
+            )
+
+            check = sagemaker_models_monitor_enabled()
+            result = check.execute()
+            assert result == []
diff --git a/tests/providers/aws/services/sagemaker/sagemaker_service_test.py b/tests/providers/aws/services/sagemaker/sagemaker_service_test.py
index d49a506fd9..50431c2e13 100644
--- a/tests/providers/aws/services/sagemaker/sagemaker_service_test.py
+++ b/tests/providers/aws/services/sagemaker/sagemaker_service_test.py
@@ -396,13 +396,13 @@ class Test_SageMaker_Service:
                 sagemaker_service = SageMaker(audit_info)
 
                 # Check that __threading_call__ was called for _list_tags_for_resource
-                # (one for each resource type: models, notebooks, training jobs, endpoint configs, domains)
+                # (one for each resource type: models, notebooks, training jobs, processing jobs, endpoint configs, domains)
                 tag_calls = [
                     c
                     for c in mock_threading_call.call_args_list
                     if c[0][0] == sagemaker_service._list_tags_for_resource
                 ]
-                assert len(tag_calls) == 5
+                assert len(tag_calls) == 6
 
     # Test SageMaker list model package groups
     def test_list_model_package_groups(self):
diff --git a/tests/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions_test.py b/tests/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions_test.py
new file mode 100644
index 0000000000..01af147e9a
--- /dev/null
+++ b/tests/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions_test.py
@@ -0,0 +1,512 @@
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_EU_WEST_1,
+    set_mocked_aws_provider,
+)
+
+orig = botocore.client.BaseClient._make_api_call
+
+HUB_ARN = f"arn:aws:securityhub:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:hub/default"
+
+
+def _active_hub_responses(operation_name):
+    """Return a moto-friendly response for hub-describing API calls.
+
+    Returns None if the operation is not one of the hub APIs (so the caller
+    can fall back to the default behavior).
+    """
+    if operation_name == "DescribeHub":
+        return {
+            "HubArn": HUB_ARN,
+            "SubscribedAt": "2024-01-01T00:00:00.000Z",
+            "AutoEnableControls": True,
+        }
+    if operation_name == "GetEnabledStandards":
+        return {"StandardsSubscriptions": []}
+    if operation_name == "ListEnabledProductsForImport":
+        return {"ProductSubscriptions": []}
+    if operation_name == "ListTagsForResource":
+        return {"Tags": {}}
+    return None
+
+
+def mock_make_api_call_org_admin_and_config(self, operation_name, api_params):
+    """Mock organization admin accounts and configuration APIs - PASS scenario."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {
+            "AdminAccounts": [
+                {
+                    "AdminAccountId": "123456789012",
+                    "AdminStatus": "ENABLED",
+                }
+            ]
+        }
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {
+            "AutoEnable": True,
+            "AutoEnableStandards": "DEFAULT",
+        }
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_org_admin_no_auto_enable(self, operation_name, api_params):
+    """Mock organization admin configured but auto-enable disabled."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {
+            "AdminAccounts": [
+                {
+                    "AdminAccountId": "123456789012",
+                    "AdminStatus": "ENABLED",
+                }
+            ]
+        }
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {
+            "AutoEnable": False,
+            "AutoEnableStandards": "NONE",
+        }
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_no_org_admin(self, operation_name, api_params):
+    """Mock no organization admin configured."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {"AdminAccounts": []}
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {
+            "AutoEnable": False,
+            "AutoEnableStandards": "NONE",
+        }
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_securityhub_not_subscribed(self, operation_name, api_params):
+    """Simulate Security Hub not subscribed in the account (InvalidAccessException)."""
+    if operation_name == "DescribeHub":
+        raise botocore.exceptions.ClientError(
+            {
+                "Error": {
+                    "Code": "InvalidAccessException",
+                    "Message": "Account is not subscribed to AWS Security Hub",
+                }
+            },
+            operation_name,
+        )
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {"AdminAccounts": []}
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_admin_lookup_access_denied(self, operation_name, api_params):
+    """Hub is ACTIVE but ListOrganizationAdminAccounts is denied — lookup-failed path."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        raise botocore.exceptions.ClientError(
+            {
+                "Error": {
+                    "Code": "AccessDeniedException",
+                    "Message": "User is not authorized to perform: securityhub:ListOrganizationAdminAccounts",
+                }
+            },
+            operation_name,
+        )
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {"AutoEnable": True, "AutoEnableStandards": "DEFAULT"}
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_admin_lookup_unexpected(self, operation_name, api_params):
+    """ListOrganizationAdminAccounts raises a non-ClientError — bare Exception branch."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        raise RuntimeError("simulated transient error")
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {"AutoEnable": True, "AutoEnableStandards": "DEFAULT"}
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_describe_org_config_other_client_error(
+    self, operation_name, api_params
+):
+    """DescribeOrganizationConfiguration raises a non-access ClientError — else branch."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {
+            "AdminAccounts": [
+                {"AdminAccountId": "123456789012", "AdminStatus": "ENABLED"}
+            ]
+        }
+    if operation_name == "DescribeOrganizationConfiguration":
+        raise botocore.exceptions.ClientError(
+            {"Error": {"Code": "InternalServerError", "Message": "boom"}},
+            operation_name,
+        )
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_describe_org_config_unexpected(self, operation_name, api_params):
+    """DescribeOrganizationConfiguration raises a non-ClientError — bare Exception branch."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {
+            "AdminAccounts": [
+                {"AdminAccountId": "123456789012", "AdminStatus": "ENABLED"}
+            ]
+        }
+    if operation_name == "DescribeOrganizationConfiguration":
+        raise RuntimeError("simulated transient error")
+    return orig(self, operation_name, api_params)
+
+
+class Test_securityhub_delegated_admin_enabled_all_regions:
+    def teardown_method(self):
+        """Evict cached securityhub modules so legacy mock.patch-based tests
+        in the same session see a fresh import path."""
+        import sys
+
+        for mod in (
+            "prowler.providers.aws.services.securityhub.securityhub_client",
+            "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions",
+        ):
+            sys.modules.pop(mod, None)
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_securityhub_not_subscribed,
+    )
+    @mock_aws
+    def test_no_securityhub(self):
+        """Test when Security Hub is not subscribed in any region."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            # Should have findings for each region (with NOT_AVAILABLE hubs)
+            assert len(result) > 0
+            # All should fail since hub is not enabled
+            for finding in result:
+                assert finding.status == "FAIL"
+                assert "Security Hub not enabled" in finding.status_extended
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_no_org_admin,
+    )
+    @mock_aws
+    def test_securityhub_enabled_no_delegated_admin(self):
+        """Test when Security Hub is enabled but no delegated admin is configured."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            eu_west_1_result = None
+            for finding in result:
+                if finding.region == AWS_REGION_EU_WEST_1:
+                    eu_west_1_result = finding
+                    break
+
+            assert eu_west_1_result is not None
+            assert eu_west_1_result.status == "FAIL"
+            assert (
+                "no delegated administrator configured"
+                in eu_west_1_result.status_extended
+            )
+            assert eu_west_1_result.resource_arn == HUB_ARN
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_org_admin_no_auto_enable,
+    )
+    @mock_aws
+    def test_securityhub_enabled_with_admin_no_auto_enable(self):
+        """Test when Security Hub is enabled with delegated admin but auto-enable is off."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            eu_west_1_result = None
+            for finding in result:
+                if finding.region == AWS_REGION_EU_WEST_1:
+                    eu_west_1_result = finding
+                    break
+
+            assert eu_west_1_result is not None
+            assert eu_west_1_result.status == "FAIL"
+            assert (
+                "organization auto-enable not configured"
+                in eu_west_1_result.status_extended
+            )
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_org_admin_and_config,
+    )
+    @mock_aws
+    def test_securityhub_enabled_with_admin_and_auto_enable(self):
+        """Test when Security Hub is enabled with delegated admin and auto-enable on (PASS)."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            eu_west_1_result = None
+            for finding in result:
+                if finding.region == AWS_REGION_EU_WEST_1:
+                    eu_west_1_result = finding
+                    break
+
+            assert eu_west_1_result is not None
+            assert eu_west_1_result.status == "PASS"
+            assert "delegated admin configured" in eu_west_1_result.status_extended
+            assert "auto-enable" in eu_west_1_result.status_extended
+            assert eu_west_1_result.resource_arn == HUB_ARN
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_admin_lookup_access_denied,
+    )
+    @mock_aws
+    def test_admin_lookup_access_denied(self):
+        """AccessDenied on ListOrganizationAdminAccounts must FAIL with unknown-admin message."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            eu_west_1_result = None
+            for finding in result:
+                if finding.region == AWS_REGION_EU_WEST_1:
+                    eu_west_1_result = finding
+                    break
+
+            assert eu_west_1_result is not None
+            assert eu_west_1_result.status == "FAIL"
+            assert (
+                "delegated administrator status could not be determined"
+                in eu_west_1_result.status_extended
+            )
+            assert (
+                "no delegated administrator configured"
+                not in eu_west_1_result.status_extended
+            )
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_admin_lookup_unexpected,
+    )
+    @mock_aws
+    def test_admin_lookup_unexpected_exception(self):
+        """Non-ClientError raised from ListOrganizationAdminAccounts still sets lookup_failed."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        service = SecurityHub(aws_provider)
+        assert service.organization_admin_lookup_failed is True
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=service,
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            result = securityhub_delegated_admin_enabled_all_regions().execute()
+            assert result and result[0].status == "FAIL"
+            assert (
+                "delegated administrator status could not be determined"
+                in result[0].status_extended
+            )
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_describe_org_config_other_client_error,
+    )
+    @mock_aws
+    def test_describe_org_config_other_client_error(self):
+        """Non-access ClientError on DescribeOrganizationConfiguration is logged at error level."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        service = SecurityHub(aws_provider)
+        # organization_config_available stays False, so the auto-enable issue is suppressed
+        assert service.securityhubs[0].organization_config_available is False
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=service,
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            result = securityhub_delegated_admin_enabled_all_regions().execute()
+            # Admin is configured and hub is active; with org config unavailable the
+            # check should PASS because there are no other detectable issues.
+            assert result and result[0].status == "PASS"
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_describe_org_config_unexpected,
+    )
+    @mock_aws
+    def test_describe_org_config_unexpected_exception(self):
+        """Non-ClientError on DescribeOrganizationConfiguration is caught by bare except."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        service = SecurityHub(aws_provider)
+        assert service.securityhubs[0].organization_config_available is False
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=service,
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            result = securityhub_delegated_admin_enabled_all_regions().execute()
+            assert result and result[0].status == "PASS"
diff --git a/tests/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled_test.py b/tests/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled_test.py
new file mode 100644
index 0000000000..b7c2ac3bd9
--- /dev/null
+++ b/tests/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled_test.py
@@ -0,0 +1,99 @@
+from unittest import mock
+
+import pytest
+
+from prowler.providers.azure.services.aks.aks_service import Cluster
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+def build_cluster(auto_upgrade_channel):
+    return Cluster(
+        id="/sub/rg/cluster1",
+        name="test-cluster",
+        public_fqdn="test.azmk8s.io",
+        private_fqdn=None,
+        network_policy=None,
+        agent_pool_profiles=[],
+        rbac_enabled=True,
+        location="eastus",
+        auto_upgrade_channel=auto_upgrade_channel,
+    )
+
+
+class Test_aks_cluster_auto_upgrade_enabled:
+    def test_no_subscriptions(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled.aks_client",
+                new=aks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled import (
+                aks_cluster_auto_upgrade_enabled,
+            )
+
+            aks_client.clusters = {}
+
+            check = aks_cluster_auto_upgrade_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled.aks_client",
+                new=aks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled import (
+                aks_cluster_auto_upgrade_enabled,
+            )
+
+            cluster = build_cluster(auto_upgrade_channel="stable")
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_auto_upgrade_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    @pytest.mark.parametrize("auto_upgrade_channel", [None, "", "none", "None"])
+    def test_fail(self, auto_upgrade_channel):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled.aks_client",
+                new=aks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled import (
+                aks_cluster_auto_upgrade_enabled,
+            )
+
+            cluster = build_cluster(auto_upgrade_channel=auto_upgrade_channel)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_auto_upgrade_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
diff --git a/tests/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled_test.py b/tests/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled_test.py
new file mode 100644
index 0000000000..0575b67a4a
--- /dev/null
+++ b/tests/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled_test.py
@@ -0,0 +1,122 @@
+from importlib import import_module
+from unittest import mock
+from uuid import uuid4
+
+import pytest
+
+from prowler.providers.azure.services.aks.aks_service import Cluster
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+CHECK_MODULE = (
+    "prowler.providers.azure.services.aks.aks_cluster_defender_enabled."
+    "aks_cluster_defender_enabled"
+)
+CHECK_CLIENT_PATCH = f"{CHECK_MODULE}.aks_client"
+
+
+def get_check_class():
+    return import_module(CHECK_MODULE).aks_cluster_defender_enabled
+
+
+def build_cluster(defender_enabled):
+    return Cluster(
+        id=str(uuid4()),
+        name="test-cluster",
+        public_fqdn="test.azmk8s.io",
+        private_fqdn=None,
+        network_policy=None,
+        agent_pool_profiles=[],
+        rbac_enabled=True,
+        location="eastus",
+        defender_enabled=defender_enabled,
+    )
+
+
+class Test_aks_cluster_defender_enabled:
+    def test_no_subscriptions(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_defender_enabled = get_check_class()
+
+            aks_client.clusters = {}
+
+            check = aks_cluster_defender_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_defender_enabled = get_check_class()
+
+            cluster = build_cluster(defender_enabled=True)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_defender_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Cluster 'test-cluster' has Defender for Containers enabled."
+            )
+            assert result[0].resource_name == "test-cluster"
+            assert result[0].resource_id == cluster.id
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "eastus"
+
+    @pytest.mark.parametrize("defender_enabled", [False, None, "true"])
+    def test_fail(self, defender_enabled):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_defender_enabled = get_check_class()
+
+            cluster = build_cluster(defender_enabled=defender_enabled)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_defender_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Cluster 'test-cluster' does not have Defender for "
+                "Containers enabled."
+            )
+            assert result[0].resource_name == "test-cluster"
+            assert result[0].resource_id == cluster.id
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "eastus"
diff --git a/tests/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled_test.py b/tests/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled_test.py
new file mode 100644
index 0000000000..8b4330d64c
--- /dev/null
+++ b/tests/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled_test.py
@@ -0,0 +1,115 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+class Test_cosmosdb_account_automatic_failover_enabled:
+    def test_no_subscriptions(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled import (
+                cosmosdb_account_automatic_failover_enabled,
+            )
+
+            cosmosdb_client.accounts = {}
+
+            check = cosmosdb_account_automatic_failover_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled import (
+                cosmosdb_account_automatic_failover_enabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        enable_automatic_failover=True,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_automatic_failover_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_fail(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled import (
+                cosmosdb_account_automatic_failover_enabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        enable_automatic_failover=False,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_automatic_failover_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
diff --git a/tests/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous_test.py b/tests/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous_test.py
new file mode 100644
index 0000000000..0cc282485b
--- /dev/null
+++ b/tests/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous_test.py
@@ -0,0 +1,157 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+class Test_cosmosdb_account_backup_policy_continuous:
+    def test_no_subscriptions(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous import (
+                cosmosdb_account_backup_policy_continuous,
+            )
+
+            cosmosdb_client.accounts = {}
+
+            check = cosmosdb_account_backup_policy_continuous()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous import (
+                cosmosdb_account_backup_policy_continuous,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        backup_policy_type="Continuous",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_backup_policy_continuous()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_fail_periodic(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous import (
+                cosmosdb_account_backup_policy_continuous,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        backup_policy_type="Periodic",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_backup_policy_continuous()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+
+    def test_fail_no_backup_policy(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous import (
+                cosmosdb_account_backup_policy_continuous,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        backup_policy_type=None,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_backup_policy_continuous()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
diff --git a/tests/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version_test.py b/tests/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version_test.py
new file mode 100644
index 0000000000..b14c08f697
--- /dev/null
+++ b/tests/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version_test.py
@@ -0,0 +1,209 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+class Test_cosmosdb_account_minimum_tls_version:
+    def test_no_subscriptions(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+
+            cosmosdb_client.accounts = {}
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass_tls12(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        minimal_tls_version="Tls12",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                f"CosmosDB account test-account from subscription "
+                f"{AZURE_SUBSCRIPTION_ID} enforces TLS 1.2 or higher."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+
+    def test_pass_tls13(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        minimal_tls_version="Tls13",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_fail_tls11(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        minimal_tls_version="Tls11",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                f"CosmosDB account test-account from subscription "
+                f"{AZURE_SUBSCRIPTION_ID} does not enforce TLS 1.2 or higher."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+
+    def test_fail_no_tls_version(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        minimal_tls_version=None,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
diff --git a/tests/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled_test.py b/tests/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled_test.py
new file mode 100644
index 0000000000..60297d6138
--- /dev/null
+++ b/tests/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled_test.py
@@ -0,0 +1,210 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+class Test_cosmosdb_account_public_network_access_disabled:
+    def test_no_subscriptions(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+
+            cosmosdb_client.accounts = {}
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass_disabled(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        public_network_access="Disabled",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                f"CosmosDB account test-account from subscription "
+                f"{AZURE_SUBSCRIPTION_ID} has public network access disabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+
+    def test_pass_secured_by_perimeter(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        public_network_access="SecuredByPerimeter",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_fail_enabled(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        public_network_access="Enabled",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                f"CosmosDB account test-account from subscription "
+                f"{AZURE_SUBSCRIPTION_ID} does not have public network access "
+                f"disabled (current value: 'Enabled')."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+
+    def test_fail_no_public_network_access(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        public_network_access=None,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
diff --git a/tests/providers/azure/services/databricks/databricks_service_test.py b/tests/providers/azure/services/databricks/databricks_service_test.py
index 69651f2235..f663d81fe2 100644
--- a/tests/providers/azure/services/databricks/databricks_service_test.py
+++ b/tests/providers/azure/services/databricks/databricks_service_test.py
@@ -18,6 +18,8 @@ def mock_databricks_get_workspaces(_):
                 id="test-workspace-id",
                 name="test-workspace",
                 location="eastus",
+                public_network_access="Disabled",
+                no_public_ip_enabled=True,
                 custom_managed_vnet_id="test-vnet-id",
                 managed_disk_encryption=ManagedDiskEncryption(
                     key_name="test-key",
@@ -53,6 +55,8 @@ class Test_Databricks_Service:
         assert workspace.id == "test-workspace-id"
         assert workspace.name == "test-workspace"
         assert workspace.location == "eastus"
+        assert workspace.public_network_access == "Disabled"
+        assert workspace.no_public_ip_enabled is True
         assert workspace.custom_managed_vnet_id == "test-vnet-id"
         assert (
             workspace.managed_disk_encryption.__class__.__name__
diff --git a/tests/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled_test.py b/tests/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled_test.py
new file mode 100644
index 0000000000..a7903770c6
--- /dev/null
+++ b/tests/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled_test.py
@@ -0,0 +1,174 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.databricks.databricks_service import (
+    DatabricksWorkspace,
+)
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_databricks_workspace_no_public_ip_enabled:
+    def test_databricks_no_workspaces(self):
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled import (
+                databricks_workspace_no_public_ip_enabled,
+            )
+
+            check = databricks_workspace_no_public_ip_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_databricks_workspace_no_public_ip_disabled(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    no_public_ip_enabled=False,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled import (
+                databricks_workspace_no_public_ip_enabled,
+            )
+
+            check = databricks_workspace_no_public_ip_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have secure cluster connectivity (no public IP) enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"
+
+    def test_databricks_workspace_no_public_ip_enabled(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    no_public_ip_enabled=True,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled import (
+                databricks_workspace_no_public_ip_enabled,
+            )
+
+            check = databricks_workspace_no_public_ip_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has secure cluster connectivity (no public IP) enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"
+
+    def test_databricks_workspace_no_public_ip_not_reported(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    no_public_ip_enabled=None,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled import (
+                databricks_workspace_no_public_ip_enabled,
+            )
+
+            check = databricks_workspace_no_public_ip_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "MANUAL"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not expose secure cluster connectivity (no public IP) settings (for example, serverless workspaces have no public-IP cluster nodes); verify the network configuration manually."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"
diff --git a/tests/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled_test.py b/tests/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled_test.py
new file mode 100644
index 0000000000..7d39d38760
--- /dev/null
+++ b/tests/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled_test.py
@@ -0,0 +1,170 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.databricks.databricks_service import (
+    DatabricksWorkspace,
+)
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_databricks_workspace_public_network_access_disabled:
+    def test_databricks_no_workspaces(self):
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled import (
+                databricks_workspace_public_network_access_disabled,
+            )
+
+            check = databricks_workspace_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_databricks_workspace_public_network_access_enabled(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    public_network_access="Enabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled import (
+                databricks_workspace_public_network_access_disabled,
+            )
+
+            check = databricks_workspace_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"
+
+    def test_databricks_workspace_public_network_access_not_set(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    public_network_access=None,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled import (
+                databricks_workspace_public_network_access_disabled,
+            )
+
+            check = databricks_workspace_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access enabled."
+            )
+
+    def test_databricks_workspace_public_network_access_disabled(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    public_network_access="Disabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled import (
+                databricks_workspace_public_network_access_disabled,
+            )
+
+            check = databricks_workspace_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access disabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on_test.py
new file mode 100644
index 0000000000..b81d10d31d
--- /dev/null
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on_test.py
@@ -0,0 +1,117 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.defender.defender_service import Pricing
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_defender_ensure_defender_cspm_is_on:
+    def test_defender_no_cspm(self):
+        defender_client = mock.MagicMock
+        defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        defender_client.pricings = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on import (
+                defender_ensure_defender_cspm_is_on,
+            )
+
+            check = defender_ensure_defender_cspm_is_on()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_defender_cspm_pricing_tier_not_standard(self):
+        resource_id = str(uuid4())
+        defender_client = mock.MagicMock
+        defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        defender_client.pricings = {
+            AZURE_SUBSCRIPTION_ID: {
+                "CloudPosture": Pricing(
+                    resource_id=resource_id,
+                    resource_name="Defender plan CSPM",
+                    pricing_tier="Free",
+                    free_trial_remaining_time=0,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on import (
+                defender_ensure_defender_cspm_is_on,
+            )
+
+            check = defender_ensure_defender_cspm_is_on()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Defender plan CSPM from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == "Defender plan CSPM"
+            assert result[0].resource_id == resource_id
+
+    def test_defender_cspm_pricing_tier_standard(self):
+        resource_id = str(uuid4())
+        defender_client = mock.MagicMock
+        defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        defender_client.pricings = {
+            AZURE_SUBSCRIPTION_ID: {
+                "CloudPosture": Pricing(
+                    resource_id=resource_id,
+                    resource_name="Defender plan CSPM",
+                    pricing_tier="Standard",
+                    free_trial_remaining_time=0,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on import (
+                defender_ensure_defender_cspm_is_on,
+            )
+
+            check = defender_ensure_defender_cspm_is_on()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Defender plan CSPM from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == "Defender plan CSPM"
+            assert result[0].resource_id == resource_id
diff --git a/tests/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled_test.py b/tests/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled_test.py
new file mode 100644
index 0000000000..c5e1f27de2
--- /dev/null
+++ b/tests/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled_test.py
@@ -0,0 +1,125 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.mysql.mysql_service import FlexibleServer
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_mysql_flexible_server_geo_redundant_backup_enabled:
+    def test_mysql_no_subscriptions(self):
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled import (
+                mysql_flexible_server_geo_redundant_backup_enabled,
+            )
+
+            check = mysql_flexible_server_geo_redundant_backup_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_mysql_geo_redundant_backup_disabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    geo_redundant_backup="Disabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled import (
+                mysql_flexible_server_geo_redundant_backup_enabled,
+            )
+
+            check = mysql_flexible_server_geo_redundant_backup_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Geo-redundant backup is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
+
+    def test_mysql_geo_redundant_backup_enabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    geo_redundant_backup="Enabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled import (
+                mysql_flexible_server_geo_redundant_backup_enabled,
+            )
+
+            check = mysql_flexible_server_geo_redundant_backup_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Geo-redundant backup is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
diff --git a/tests/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled_test.py b/tests/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled_test.py
new file mode 100644
index 0000000000..c1084ec47b
--- /dev/null
+++ b/tests/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled_test.py
@@ -0,0 +1,166 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.mysql.mysql_service import FlexibleServer
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_mysql_flexible_server_high_availability_enabled:
+    def test_mysql_no_subscriptions(self):
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_mysql_high_availability_disabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    high_availability_mode="Disabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"High availability is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
+
+    def test_mysql_high_availability_not_set(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    high_availability_mode=None,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"High availability is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+
+    def test_mysql_high_availability_enabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    high_availability_mode="ZoneRedundant",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"High availability is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
diff --git a/tests/providers/external/__init__.py b/tests/providers/external/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/external/test_dynamic_provider_loading.py b/tests/providers/external/test_dynamic_provider_loading.py
new file mode 100644
index 0000000000..78e308597d
--- /dev/null
+++ b/tests/providers/external/test_dynamic_provider_loading.py
@@ -0,0 +1,2766 @@
+"""
+Tests for dynamic provider loading via entry points.
+
+Covers: provider discovery, check discovery, check execution,
+CLI argument registration, compliance frameworks, parser integration,
+and all dispatch fallbacks for external providers.
+"""
+
+from argparse import Namespace
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from prowler.providers.common.provider import Provider
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _make_entry_point(name, value, group):
+    """Create a mock entry point."""
+    ep = MagicMock()
+    ep.name = name
+    ep.value = value
+    ep.group = group
+    return ep
+
+
+class FakeExternalProvider(Provider):
+    """Minimal Provider subclass for testing the dynamic contract."""
+
+    _type = "fakeexternal"
+    _cli_help_text = "Fake External Provider"
+
+    def __init__(self):
+        Provider.set_global_provider(self)
+
+    @property
+    def type(self):
+        return self._type
+
+    @property
+    def identity(self):
+        return MagicMock(host_id="fake-host-1")
+
+    @property
+    def session(self):
+        return MagicMock()
+
+    @property
+    def audit_config(self):
+        return {}
+
+    def setup_session(self):
+        return MagicMock()
+
+    def print_credentials(self):
+        pass
+
+    @classmethod
+    def from_cli_args(cls, _arguments, _fixer_config):
+        cls()
+
+    def get_output_options(self, _arguments, _bulk_checks_metadata):
+        return MagicMock(output_directory="/tmp", output_filename="fake")
+
+    def get_stdout_detail(self, finding):
+        return "fake-detail"
+
+    def get_finding_sort_key(self):
+        return "region"
+
+    def get_summary_entity(self):
+        return ("Fake Host", "fake-host-1")
+
+    def get_finding_output_data(self, check_output):
+        return {
+            "auth_method": "fake",
+            "account_uid": "fake-account",
+            "account_name": "fake",
+            "resource_name": "fake-resource",
+            "resource_uid": "fake-uid",
+            "region": "local",
+        }
+
+    def get_mutelist_finding_args(self):
+        return {"host_id": self.identity.host_id}
+
+    def display_compliance_table(
+        self,
+        findings,
+        _bulk_checks_metadata,
+        _compliance_framework,
+        _output_filename,
+        output_directory,  # referenced via name elsewhere in tests
+        _compliance_overview,
+    ):
+        return True
+
+    def get_html_assessment_summary(self):
+        return "<div>Fake Assessment</div>"
+
+    def generate_compliance_output(
+        self,
+        findings,
+        _bulk_compliance_frameworks,
+        _input_compliance_frameworks,
+        output_options,
+        generated_outputs,
+    ):
+        generated_outputs["compliance"].append("fake-compliance-output")
+
+    @classmethod
+    def init_parser(cls, parser_instance):
+        pass
+
+
+class FakeToolWrapperProvider(Provider):
+    """External provider that declares itself a tool wrapper."""
+
+    _type = "faketoolwrapper"
+    is_external_tool_provider = True
+
+    @property
+    def type(self):
+        return self._type
+
+    @property
+    def identity(self):
+        return MagicMock()
+
+    @property
+    def session(self):
+        return MagicMock()
+
+    @property
+    def audit_config(self):
+        return {}
+
+    def setup_session(self):
+        return MagicMock()
+
+    def print_credentials(self):
+        pass
+
+
+class FakePureContractProvider(Provider):
+    """External provider that honors the from_cli_args type hint literally:
+    returns an instance without calling Provider.set_global_provider() from
+    __init__. Used to verify the call site wires the returned instance."""
+
+    _type = "fakepure"
+
+    @property
+    def type(self):
+        return self._type
+
+    @property
+    def identity(self):
+        return MagicMock(host_id="fake-pure-1")
+
+    @property
+    def session(self):
+        return MagicMock()
+
+    @property
+    def audit_config(self):
+        return {}
+
+    def setup_session(self):
+        return MagicMock()
+
+    def print_credentials(self):
+        pass
+
+    @classmethod
+    def from_cli_args(cls, _arguments, _fixer_config):
+        # Literal contract: return the instance, no side-effect in __init__.
+        return cls()
+
+
+class FakeProviderNoHelpText(Provider):
+    """Provider without _cli_help_text."""
+
+    _type = "nohelptext"
+
+    @property
+    def type(self):
+        return self._type
+
+    @property
+    def identity(self):
+        return MagicMock()
+
+    @property
+    def session(self):
+        return MagicMock()
+
+    @property
+    def audit_config(self):
+        return {}
+
+    def setup_session(self):
+        return MagicMock()
+
+    def print_credentials(self):
+        pass
+
+
+# ---------------------------------------------------------------------------
+# Fixtures
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture(autouse=True)
+def _clear_ep_cache():
+    """Clear the entry point provider cache before each test."""
+    Provider._ep_providers = {}
+    yield
+    Provider._ep_providers = {}
+
+
+@pytest.fixture
+def fake_provider():
+    """Create and register a FakeExternalProvider."""
+    p = FakeExternalProvider()
+    yield p
+    Provider._global = None
+
+
+# ===========================================================================
+# 1. Provider Discovery & Loading
+# ===========================================================================
+
+
+class TestProviderDiscovery:
+    """Tests 1-7: get_available_providers, _load_ep_provider, get_providers_help_text."""
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_get_available_providers_merges_builtin_and_entrypoint(self, mock_ep):
+        """Test 1: get_available_providers returns both built-in and entry point providers."""
+        mock_ep.return_value = [
+            _make_entry_point("fakeexternal", "pkg.provider:Cls", "prowler.providers"),
+        ]
+
+        providers = Provider.get_available_providers()
+
+        # Built-in providers from actual prowler package
+        assert "aws" in providers
+        # External provider from entry point
+        assert "fakeexternal" in providers
+        assert "common" not in providers
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_get_available_providers_deduplicates(self, mock_ep):
+        """Test 2: Same provider name in built-in and entry point appears once."""
+        # "aws" exists as built-in AND as entry point
+        mock_ep.return_value = [
+            _make_entry_point("aws", "pkg.provider:Cls", "prowler.providers"),
+        ]
+
+        providers = Provider.get_available_providers()
+
+        assert providers.count("aws") == 1
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_load_ep_provider_loads_class(self, mock_ep):
+        """Test 3: _load_ep_provider loads the class from entry point."""
+        mock_ep.return_value = [
+            _make_entry_point(
+                "fakeexternal", "pkg:FakeExternalProvider", "prowler.providers"
+            ),
+        ]
+        mock_ep.return_value[0].load.return_value = FakeExternalProvider
+
+        cls = Provider._load_ep_provider("fakeexternal")
+
+        assert cls is FakeExternalProvider
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_load_ep_provider_returns_none_for_unknown(self, mock_ep):
+        """Test 4: _load_ep_provider returns None for unknown provider."""
+        mock_ep.return_value = []
+
+        cls = Provider._load_ep_provider("nonexistent")
+
+        assert cls is None
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_load_ep_provider_caches_result(self, mock_ep):
+        """Test 5: _load_ep_provider caches the loaded class."""
+        mock_ep.return_value = [
+            _make_entry_point("fakeexternal", "pkg:Cls", "prowler.providers"),
+        ]
+        mock_ep.return_value[0].load.return_value = FakeExternalProvider
+
+        cls1 = Provider._load_ep_provider("fakeexternal")
+        cls2 = Provider._load_ep_provider("fakeexternal")
+
+        assert cls1 is cls2
+        # load() should only be called once due to caching
+        mock_ep.return_value[0].load.assert_called_once()
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_load_ep_provider_caches_misses(self, mock_ep):
+        """A miss (unknown provider) must also be cached so repeated lookups
+        do not re-iterate entry_points(). Aligns with tool_wrapper._ep_class_cache,
+        which already caches None on miss."""
+        mock_ep.return_value = []
+
+        first = Provider._load_ep_provider("nonexistent")
+        second = Provider._load_ep_provider("nonexistent")
+
+        assert first is None
+        assert second is None
+        # entry_points() should only be called once across the two lookups
+        mock_ep.assert_called_once()
+
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.Provider.get_available_providers")
+    def test_get_providers_help_text_reads_cli_help_text(
+        self, mock_providers, mock_load
+    ):
+        """Test 6: get_providers_help_text reads _cli_help_text from entry point provider."""
+        mock_providers.return_value = ["fakeexternal"]
+        mock_load.return_value = FakeExternalProvider
+
+        help_text = Provider.get_providers_help_text()
+
+        assert help_text["fakeexternal"] == "Fake External Provider"
+
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.Provider.get_available_providers")
+    def test_get_providers_help_text_empty_without_cli_help_text(
+        self, mock_providers, mock_load
+    ):
+        """Test 7: get_providers_help_text returns empty string without _cli_help_text."""
+        mock_providers.return_value = ["nohelptext"]
+        mock_load.return_value = FakeProviderNoHelpText
+
+        help_text = Provider.get_providers_help_text()
+
+        assert help_text["nohelptext"] == ""
+
+
+class TestIsToolWrapperProvider:
+    """Tests for Provider.is_tool_wrapper_provider — the helper that combines the
+    built-in EXTERNAL_TOOL_PROVIDERS frozenset with the is_external_tool_provider
+    class attribute of entry-point providers."""
+
+    def test_returns_true_for_builtin_tool_wrappers(self):
+        # iac/llm/image are in the EXTERNAL_TOOL_PROVIDERS frozenset (fast path)
+        assert Provider.is_tool_wrapper_provider("iac") is True
+        assert Provider.is_tool_wrapper_provider("llm") is True
+        assert Provider.is_tool_wrapper_provider("image") is True
+
+    def test_returns_false_for_regular_builtin_providers(self):
+        # Regular built-ins must not be classified as tool wrappers
+        assert Provider.is_tool_wrapper_provider("aws") is False
+        assert Provider.is_tool_wrapper_provider("gcp") is False
+        assert Provider.is_tool_wrapper_provider("github") is False
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_returns_true_for_external_provider_declaring_flag(self, mock_ep):
+        # External plugin explicitly declares is_external_tool_provider = True
+        mock_ep.return_value = [
+            _make_entry_point("faketoolwrapper", "pkg:Cls", "prowler.providers"),
+        ]
+        mock_ep.return_value[0].load.return_value = FakeToolWrapperProvider
+
+        assert Provider.is_tool_wrapper_provider("faketoolwrapper") is True
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_returns_false_for_external_provider_without_flag(self, mock_ep):
+        # External plugin without the flag (default False) is treated as regular
+        mock_ep.return_value = [
+            _make_entry_point("fakeexternal", "pkg:Cls", "prowler.providers"),
+        ]
+        mock_ep.return_value[0].load.return_value = FakeExternalProvider
+
+        assert Provider.is_tool_wrapper_provider("fakeexternal") is False
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_returns_false_for_unknown_provider(self, mock_ep):
+        mock_ep.return_value = []
+
+        assert Provider.is_tool_wrapper_provider("does-not-exist") is False
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_returns_false_for_none_provider(self, mock_ep):
+        # Pydantic validators may pass None when values.get("Provider") is missing
+        mock_ep.return_value = []
+
+        assert Provider.is_tool_wrapper_provider(None) is False
+
+
+class TestIsBuiltinProvider:
+    """Tests for Provider.is_builtin — the helper that discriminates built-in
+    providers from external ones before attempting the import, so transitive
+    dependency failures in built-ins don't get silently re-routed to entry points."""
+
+    def test_returns_true_for_builtin_provider(self):
+        assert Provider.is_builtin("aws") is True
+        assert Provider.is_builtin("github") is True
+
+    def test_returns_false_for_unknown_provider(self):
+        assert Provider.is_builtin("nonexistent_xyz") is False
+
+    @patch("prowler.providers.common.provider.importlib.util.find_spec")
+    def test_returns_false_when_find_spec_raises(self, mock_find_spec):
+        # Certain namespace package edge cases raise ValueError/ImportError —
+        # helper should swallow and return False rather than propagate.
+        mock_find_spec.side_effect = ValueError("namespace package edge case")
+
+        assert Provider.is_builtin("some_provider") is False
+
+
+class TestInitProvidersParserBuiltinDependencyFailure:
+    """Selective fail-loud: init captures failures silently, enforce emits
+    warning for non-invoked and exits for the invoked broken provider."""
+
+    @patch("sys.argv", ["prowler", "aws"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_builtin_with_missing_transitive_dep_fails_loudly(
+        self, mock_import, mock_is_builtin
+    ):
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = ImportError("No module named 'boto3'")
+
+        parser = MagicMock()
+        parser._providers = ["aws"]
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws"],
+        ):
+            init_providers_parser(parser)
+            assert "aws" in parser._builtin_load_failures
+            with pytest.raises(SystemExit):
+                enforce_invoked_provider_loaded(parser)
+
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.Provider._load_ep_provider")
+    def test_external_provider_does_not_touch_builtin_path(
+        self, mock_load_ep, mock_is_builtin
+    ):
+        from prowler.providers.common.arguments import init_providers_parser
+
+        mock_is_builtin.return_value = False
+        ext_cls = MagicMock()
+        ext_cls.init_parser = MagicMock()
+        mock_load_ep.return_value = ext_cls
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["fakeexternal"],
+        ):
+            init_providers_parser(parser)
+
+        ext_cls.init_parser.assert_called_once_with(parser)
+
+    @patch("sys.argv", ["prowler", "aws"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_unrelated_builtin_failure_does_not_abort_when_other_provider_invoked(
+        self, mock_import, mock_is_builtin
+    ):
+        """Broken stackit + invoked aws → warning, no abort."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        aws_module = MagicMock()
+
+        def import_side_effect(module_path):
+            if "stackit" in module_path:
+                raise ImportError("No module named 'stackit.objectstorage'")
+            return aws_module
+
+        mock_import.side_effect = import_side_effect
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws", "stackit"],
+        ):
+            init_providers_parser(parser)
+            assert "stackit" in parser._builtin_load_failures
+            enforce_invoked_provider_loaded(parser)
+
+        aws_module.init_parser.assert_called_once_with(parser)
+
+    @patch("sys.argv", ["prowler", "-h"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_no_provider_invoked_failure_does_not_abort(
+        self, mock_import, mock_is_builtin
+    ):
+        """`prowler -h` + broken built-in → warning, help still renders."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = ImportError("No module named 'stackit.objectstorage'")
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["stackit"],
+        ):
+            init_providers_parser(parser)
+            enforce_invoked_provider_loaded(parser)
+
+    @patch("sys.argv", ["prowler", "microsoft365"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_invoked_microsoft365_alias_still_triggers_fail_loud(
+        self, mock_import, mock_is_builtin
+    ):
+        """Alias `microsoft365 → m365` must be normalised before matching."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = ImportError("No module named 'msgraph'")
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["m365"],
+        ):
+            init_providers_parser(parser)
+            with pytest.raises(SystemExit):
+                enforce_invoked_provider_loaded(parser)
+
+    @patch("sys.argv", ["prowler", "oci"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_invoked_oci_alias_still_triggers_fail_loud(
+        self, mock_import, mock_is_builtin
+    ):
+        """Alias `oci → oraclecloud` must be normalised before matching."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = ImportError("No module named 'oci'")
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["oraclecloud"],
+        ):
+            init_providers_parser(parser)
+            with pytest.raises(SystemExit):
+                enforce_invoked_provider_loaded(parser)
+
+    @patch("sys.argv", ["prowler", "--output-directory", "stackit"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_flag_value_matching_provider_name_not_treated_as_invoked(
+        self, mock_import, mock_is_builtin
+    ):
+        """Flag-first invocation → invoked is 'aws' (default), not the flag's value."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        aws_module = MagicMock()
+
+        def import_side_effect(module_path):
+            if "stackit" in module_path:
+                raise ImportError("No module named 'stackit.objectstorage'")
+            return aws_module
+
+        mock_import.side_effect = import_side_effect
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws", "stackit"],
+        ):
+            init_providers_parser(parser)
+            enforce_invoked_provider_loaded(parser)
+
+        aws_module.init_parser.assert_called_once_with(parser)
+
+    @patch("sys.argv", ["prowler", "aws"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_invoked_builtin_non_import_error_fails_loudly(
+        self, mock_import, mock_is_builtin
+    ):
+        """Non-ImportError in invoked provider → still fail-loud."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = RuntimeError("Unexpected error in aws init_parser")
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws"],
+        ):
+            init_providers_parser(parser)
+            with pytest.raises(SystemExit):
+                enforce_invoked_provider_loaded(parser)
+
+    @patch("sys.argv", ["prowler", "aws"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_unrelated_builtin_non_import_error_does_not_abort(
+        self, mock_import, mock_is_builtin
+    ):
+        """Non-ImportError in unrelated provider → warning, no abort."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        aws_module = MagicMock()
+
+        def import_side_effect(module_path):
+            if "stackit" in module_path:
+                raise RuntimeError("Unexpected error in stackit init_parser")
+            return aws_module
+
+        mock_import.side_effect = import_side_effect
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws", "stackit"],
+        ):
+            init_providers_parser(parser)
+            enforce_invoked_provider_loaded(parser)
+
+        aws_module.init_parser.assert_called_once_with(parser)
+
+
+class TestParseArgsOverrideAlignment:
+    """Regression: `parse(args=...)` overrides sys.argv AFTER __init__ ran;
+    the selective fail-loud must read argv at enforce time, not init time."""
+
+    def test_enforce_reads_current_sys_argv_not_init_time_sys_argv(self):
+        """Init with argv=['prowler','-h'] (no provider) captures stackit
+        failure silently. Enforce with argv=['prowler','stackit'] must
+        fail-loud — proving alignment under parse(args=...)."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        def import_side_effect(path):
+            if "stackit" in path:
+                raise ImportError("No module named 'stackit.objectstorage'")
+            return MagicMock()
+
+        parser = MagicMock()
+
+        with (
+            patch(
+                "prowler.providers.common.arguments.Provider.is_builtin",
+                return_value=True,
+            ),
+            patch(
+                "prowler.providers.common.arguments.Provider.get_available_providers",
+                return_value=["aws", "stackit"],
+            ),
+            patch(
+                "prowler.providers.common.arguments.import_module",
+                side_effect=import_side_effect,
+            ),
+        ):
+            # Phase 1: __init__ with ambient argv = ['prowler', '-h']
+            with patch("sys.argv", ["prowler", "-h"]):
+                init_providers_parser(parser)
+            # Failure captured silently — no SystemExit during init
+            assert "stackit" in parser._builtin_load_failures
+
+            # Phase 2: parse(args=...) overrode sys.argv → stackit invoked
+            with patch("sys.argv", ["prowler", "stackit"]):
+                with pytest.raises(SystemExit):
+                    enforce_invoked_provider_loaded(parser)
+
+    def test_enforce_reads_current_sys_argv_for_no_invocation(self):
+        """Inverse: init's argv invokes stackit, but parse(args=['prowler',
+        '-h']) overrides. Enforce must NOT fail-loud."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        def import_side_effect(path):
+            if "stackit" in path:
+                raise ImportError("No module named 'stackit.objectstorage'")
+            return MagicMock()
+
+        parser = MagicMock()
+
+        with (
+            patch(
+                "prowler.providers.common.arguments.Provider.is_builtin",
+                return_value=True,
+            ),
+            patch(
+                "prowler.providers.common.arguments.Provider.get_available_providers",
+                return_value=["aws", "stackit"],
+            ),
+            patch(
+                "prowler.providers.common.arguments.import_module",
+                side_effect=import_side_effect,
+            ),
+        ):
+            # Phase 1: __init__ with ambient argv pretending stackit invoked
+            with patch("sys.argv", ["prowler", "stackit"]):
+                init_providers_parser(parser)
+            assert "stackit" in parser._builtin_load_failures
+
+            # Phase 2: parse(args=['prowler', '-h']) overrode sys.argv →
+            # no provider invoked anymore → enforce must NOT exit
+            with patch("sys.argv", ["prowler", "-h"]):
+                enforce_invoked_provider_loaded(parser)
+
+
+class TestInitGlobalProviderBuiltinDependencyFailure:
+    """Same contract as TestInitProvidersParserBuiltinDependencyFailure but
+    for the provider class import path in init_global_provider."""
+
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    @patch("prowler.providers.common.provider.import_module")
+    def test_builtin_with_missing_transitive_dep_fails_loudly(
+        self, mock_import, mock_is_builtin
+    ):
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = ImportError("No module named 'boto3'")
+
+        args = Namespace(
+            provider="aws",
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+        )
+
+        Provider._global = None
+        with pytest.raises(SystemExit):
+            Provider.init_global_provider(args)
+        Provider._global = None
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    def test_load_ep_provider_handles_load_exception(self, mock_ep):
+        """_load_ep_provider returns None when ep.load() raises."""
+        ep = _make_entry_point("broken", "pkg:Cls", "prowler.providers")
+        ep.load.side_effect = Exception("Import failed")
+        mock_ep.return_value = [ep]
+
+        cls = Provider._load_ep_provider("broken")
+
+        assert cls is None
+
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    @patch("prowler.providers.common.provider.Provider.get_available_providers")
+    def test_get_providers_help_text_builtin_path(
+        self, mock_providers, mock_is_builtin, mock_import
+    ):
+        """get_providers_help_text reads _cli_help_text from a built-in provider module."""
+        import types
+
+        mock_providers.return_value = ["fakebuiltin"]
+        mock_is_builtin.return_value = True
+
+        mock_cls = type(
+            "FakebuiltinProvider", (Provider,), {"_cli_help_text": "Built-in Help"}
+        )
+        mock_module = types.ModuleType("fake_module")
+        mock_module.FakebuiltinProvider = mock_cls
+        mock_import.return_value = mock_module
+
+        help_text = Provider.get_providers_help_text()
+
+        assert help_text["fakebuiltin"] == "Built-in Help"
+
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.get_available_providers")
+    def test_get_providers_help_text_generic_exception(
+        self, mock_providers, mock_import
+    ):
+        """get_providers_help_text handles generic exceptions with empty string."""
+        mock_providers.return_value = ["broken"]
+        mock_import.side_effect = RuntimeError("Unexpected error")
+
+        help_text = Provider.get_providers_help_text()
+
+        assert help_text["broken"] == ""
+
+
+# ===========================================================================
+# 2. Provider Initialization
+# ===========================================================================
+
+
+class TestProviderInitialization:
+    """Tests 8-9: init_global_provider fallback to entry point."""
+
+    @patch("prowler.providers.common.provider.load_and_validate_config_file")
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.import_module")
+    def test_init_global_provider_fallback_to_entry_point(
+        self, mock_import, mock_load_ep, mock_config
+    ):
+        """Test 8: init_global_provider falls back to entry point when built-in fails."""
+        mock_import.side_effect = ImportError("No built-in")
+        mock_load_ep.return_value = FakeExternalProvider
+        mock_config.return_value = {}
+
+        args = Namespace(
+            provider="fakeexternal",
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+        )
+
+        Provider._global = None
+        Provider.init_global_provider(args)
+
+        assert isinstance(Provider._global, FakeExternalProvider)
+        Provider._global = None
+
+    @patch("prowler.providers.common.provider.load_and_validate_config_file")
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.import_module")
+    def test_init_global_provider_exits_for_unknown_provider(
+        self, mock_import, mock_load_ep, mock_config
+    ):
+        """Test 9: init_global_provider exits when provider not found anywhere."""
+        mock_import.side_effect = ImportError("No built-in")
+        mock_load_ep.return_value = None
+        mock_config.return_value = {}
+
+        args = Namespace(
+            provider="nonexistent",
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+        )
+
+        with pytest.raises(SystemExit):
+            Provider.init_global_provider(args)
+
+    @patch("prowler.providers.common.provider.load_and_validate_config_file")
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.import_module")
+    def test_init_global_provider_wires_instance_returned_by_from_cli_args(
+        self, mock_import, mock_load_ep, mock_config
+    ):
+        """A provider that implements from_cli_args as a pure function (returns
+        the instance without calling set_global_provider from __init__) is
+        correctly wired as the global provider by init_global_provider."""
+        mock_import.side_effect = ImportError("No built-in")
+        mock_load_ep.return_value = FakePureContractProvider
+        mock_config.return_value = {}
+
+        args = Namespace(
+            provider="fakepure",
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+        )
+
+        Provider._global = None
+        Provider.init_global_provider(args)
+
+        assert isinstance(Provider._global, FakePureContractProvider)
+        Provider._global = None
+
+    @pytest.mark.parametrize(
+        "plugin_name",
+        [
+            "awsx",
+            "aws_lite",
+            "azure_gov",
+            "gcp_org",
+            "github_enterprise",
+            "iac_v2",
+        ],
+    )
+    @patch("prowler.providers.common.provider.load_and_validate_config_file")
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.import_module")
+    def test_init_global_provider_external_with_builtin_substring_uses_from_cli_args(
+        self, mock_import, mock_load_ep, mock_config, plugin_name
+    ):
+        """Regression guard for the substring footgun in the dispatch chain.
+
+        An external plug-in whose name contains a built-in substring
+        (e.g. `awsx`, `aws_lite`, `azure_gov`, `gcp_org`, `github_enterprise`,
+        `iac_v2`) MUST be routed to the dynamic else and instantiated via
+        `from_cli_args` — not silently captured by the built-in branch whose
+        name happens to be a substring of the plug-in name. See PR #10700
+        review.
+        """
+        mock_import.side_effect = ImportError("No built-in")
+        mock_load_ep.return_value = FakeExternalProvider
+        mock_config.return_value = {}
+
+        # Namespace deliberately omits the kwargs of any built-in branch
+        # (no `aws_retries_max_attempts`, `az_cli_auth`, `personal_access_token`,
+        # etc.). If equality dispatch is broken and the plug-in is misrouted to
+        # a built-in branch, attribute access will raise and the global never
+        # gets wired.
+        args = Namespace(
+            provider=plugin_name,
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+        )
+
+        Provider._global = None
+        Provider.init_global_provider(args)
+
+        assert isinstance(Provider._global, FakeExternalProvider)
+        Provider._global = None
+
+    @patch("prowler.providers.common.provider.logger")
+    @patch("prowler.providers.common.provider.load_and_validate_config_file")
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_init_global_provider_warns_when_plugin_shadowed_by_builtin(
+        self, mock_is_builtin, mock_import, mock_entry_points, mock_config, mock_logger
+    ):
+        """Regression guard: when a plug-in registers a provider name that
+        collides with a built-in, the BUILT-IN wins and a warning is emitted
+        naming the shadowed plug-in. Shadow detection matches by entry-point
+        name only — the plug-in is never `ep.load()`-ed just to warn, so its
+        module code cannot run during a built-in run. See PR #10700 review
+        (HugoPBrito, Alan-TheGentleman).
+        """
+        # Simulate a built-in `aws` that exists, AND a plug-in registered
+        # under the same `aws` name via entry points.
+        mock_is_builtin.return_value = True
+        shadow_ep = MagicMock()
+        shadow_ep.name = "aws"  # plug-in shadowing the built-in name
+        mock_entry_points.return_value = [shadow_ep]
+        mock_import.return_value = MagicMock(
+            AwsProvider=MagicMock(side_effect=lambda **_kw: None)
+        )
+        mock_config.return_value = {}
+
+        args = Namespace(
+            provider="aws",
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+            aws_retries_max_attempts=3,
+            role=None,
+            session_duration=None,
+            external_id=None,
+            role_session_name=None,
+            mfa=None,
+            profile=None,
+            region=None,
+            excluded_region=None,
+            organizations_role=None,
+            scan_unused_services=False,
+            resource_tag=None,
+            resource_arn=None,
+            mutelist_file=None,
+        )
+
+        Provider._global = None
+        try:
+            Provider.init_global_provider(args)
+        except BaseException:
+            # The AwsProvider mock is fake and the dispatch may sys.exit on
+            # the simulated failure; we only care about the warning emitted
+            # before the dispatch happens.
+            pass
+        finally:
+            Provider._global = None
+
+        # Warning was emitted naming the shadowed plug-in
+        warning_msgs = [
+            call.args[0]
+            for call in mock_logger.warning.call_args_list
+            if call.args and "Plug-in provider 'aws'" in call.args[0]
+        ]
+        assert warning_msgs, "expected a warning about the shadowed plug-in 'aws'"
+        assert "IGNORED" in warning_msgs[0]
+        # Shadow detected by name only — plug-in code never executed to warn
+        shadow_ep.load.assert_not_called()
+
+
+# ===========================================================================
+# 3. Check Discovery
+# ===========================================================================
+
+
+class TestCheckDiscovery:
+    """Tests 10-14: _recover_ep_checks, recover_checks_from_provider."""
+
+    @patch("prowler.lib.check.utils.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_ep_checks_discovers_checks(self, mock_spec, mock_ep):
+        """Test 10: _recover_ep_checks discovers checks from entry points."""
+        from prowler.lib.check.utils import _recover_ep_checks
+
+        mock_ep.return_value = [
+            _make_entry_point("my_check", "pkg.checks.my_check", "prowler.checks.fake"),
+        ]
+        mock_spec_obj = MagicMock()
+        mock_spec_obj.origin = "/path/to/pkg/checks/my_check.py"
+        mock_spec.return_value = mock_spec_obj
+
+        checks = _recover_ep_checks("fake")
+
+        assert len(checks) == 1
+        assert checks[0][0] == "my_check"
+        assert checks[0][1] == "/path/to/pkg/checks"
+
+    @patch("prowler.lib.check.utils.importlib.metadata.entry_points")
+    def test_recover_ep_checks_empty_without_entry_points(self, mock_ep):
+        """Test 11: _recover_ep_checks returns empty list with no entry points."""
+        from prowler.lib.check.utils import _recover_ep_checks
+
+        mock_ep.return_value = []
+
+        checks = _recover_ep_checks("fake")
+
+        assert checks == []
+
+    @patch("prowler.lib.check.utils.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_ep_checks_handles_broken_entry_point(self, mock_spec, mock_ep):
+        """Test 12: _recover_ep_checks handles failed entry points gracefully."""
+        from prowler.lib.check.utils import _recover_ep_checks
+
+        mock_ep.return_value = [
+            _make_entry_point("broken_check", "pkg.broken", "prowler.checks.fake"),
+        ]
+        mock_spec.side_effect = Exception("Module not found")
+
+        checks = _recover_ep_checks("fake")
+
+        assert checks == []
+
+    @patch("prowler.lib.check.utils._recover_ep_checks")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_checks_handles_external_provider_without_services(
+        self, mock_find_spec, mock_ep_checks
+    ):
+        """Test 13: recover_checks_from_provider doesn't crash for external providers.
+
+        With find_spec returning None (built-in package doesn't exist), discovery
+        falls through to entry points cleanly — no ModuleNotFoundError catch
+        needed.
+        """
+        from prowler.lib.check.utils import recover_checks_from_provider
+
+        mock_find_spec.return_value = None  # not a built-in
+        mock_ep_checks.return_value = [("ext_check", "/path/to/check")]
+
+        checks = recover_checks_from_provider("fakeexternal")
+
+        assert len(checks) == 1
+        assert checks[0][0] == "ext_check"
+
+    @patch("prowler.lib.check.utils._recover_ep_checks")
+    @patch("prowler.lib.check.utils.list_modules")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_checks_combines_builtin_and_entry_points(
+        self, mock_find_spec, mock_list_modules, mock_ep_checks
+    ):
+        """Test 14: recover_checks_from_provider combines built-in and entry point checks."""
+        from prowler.lib.check.utils import recover_checks_from_provider
+
+        mock_find_spec.return_value = MagicMock()  # built-in package exists
+
+        # Simulate a built-in module
+        builtin_module = MagicMock()
+        builtin_module.name = "prowler.providers.aws.services.ec2.check_a.check_a"
+        builtin_module.module_finder.path = "/builtin/path"
+        mock_list_modules.return_value = [builtin_module]
+
+        mock_ep_checks.return_value = [("check_b", "/external/path")]
+
+        checks = recover_checks_from_provider("aws")
+
+        check_names = [c[0] for c in checks]
+        assert "check_a" in check_names
+        assert "check_b" in check_names
+
+    @patch("prowler.lib.check.utils.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_ep_checks_filters_by_service(self, mock_spec, mock_ep):
+        """Service filter keeps only entry points whose dotted path includes
+        `.services.{service}.` — mirroring the built-in package filter."""
+        from prowler.lib.check.utils import _recover_ep_checks
+
+        mock_ep.return_value = [
+            _make_entry_point(
+                "container_has_no_root_user",
+                "prowler_artifacts_dockerdesktop.services.container.container_has_no_root_user.container_has_no_root_user",
+                "prowler.checks.dockerdesktop",
+            ),
+            _make_entry_point(
+                "image_is_signed",
+                "prowler_artifacts_dockerdesktop.services.image.image_is_signed.image_is_signed",
+                "prowler.checks.dockerdesktop",
+            ),
+        ]
+        mock_spec_obj = MagicMock()
+        mock_spec_obj.origin = "/some/path/check.py"
+        mock_spec.return_value = mock_spec_obj
+
+        checks = _recover_ep_checks("dockerdesktop", service="container")
+
+        assert len(checks) == 1
+        assert checks[0][0] == "container_has_no_root_user"
+
+    @patch("prowler.lib.check.utils.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_ep_checks_without_service_returns_all(self, mock_spec, mock_ep):
+        """Without a service filter, all entry points for the provider are returned."""
+        from prowler.lib.check.utils import _recover_ep_checks
+
+        mock_ep.return_value = [
+            _make_entry_point(
+                "container_has_no_root_user",
+                "prowler_artifacts_dockerdesktop.services.container.container_has_no_root_user.container_has_no_root_user",
+                "prowler.checks.dockerdesktop",
+            ),
+            _make_entry_point(
+                "image_is_signed",
+                "prowler_artifacts_dockerdesktop.services.image.image_is_signed.image_is_signed",
+                "prowler.checks.dockerdesktop",
+            ),
+        ]
+        mock_spec_obj = MagicMock()
+        mock_spec_obj.origin = "/some/path/check.py"
+        mock_spec.return_value = mock_spec_obj
+
+        checks = _recover_ep_checks("dockerdesktop")
+
+        assert len(checks) == 2
+
+    @patch("prowler.lib.check.utils._recover_ep_checks")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_checks_external_provider_with_service(
+        self, mock_find_spec, mock_ep_checks
+    ):
+        """External provider with --service: built-in package doesn't exist,
+        but entry points are still consulted and return the requested service's
+        checks. No premature sys.exit."""
+        from prowler.lib.check.utils import recover_checks_from_provider
+
+        mock_find_spec.return_value = None  # not a built-in
+        mock_ep_checks.return_value = [("container_check", "/ext/path")]
+
+        checks = recover_checks_from_provider("dockerdesktop", service="container")
+
+        assert len(checks) == 1
+        assert checks[0][0] == "container_check"
+        mock_ep_checks.assert_called_once_with("dockerdesktop", "container")
+
+    @patch("prowler.lib.check.utils._recover_ep_checks")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_checks_unknown_service_fails_cleanly(
+        self, mock_find_spec, mock_ep_checks
+    ):
+        """A typo or unknown service (not in built-ins nor in entry points)
+        fails with a clear error message, not a silent empty result."""
+        from prowler.lib.check.utils import recover_checks_from_provider
+
+        mock_find_spec.return_value = None
+        mock_ep_checks.return_value = []
+
+        with pytest.raises(SystemExit):
+            recover_checks_from_provider("aws", service="typo_service")
+
+    @patch("prowler.lib.check.utils._recover_ep_checks")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_checks_builtin_with_new_external_service(
+        self, mock_find_spec, mock_ep_checks
+    ):
+        """Built-in provider with a new service added via entry points:
+        the built-in package for that specific service doesn't exist (find_spec
+        returns None), but entry points pick it up. The gate `if not service:`
+        that previously skipped entry points when --service was passed is removed."""
+        from prowler.lib.check.utils import recover_checks_from_provider
+
+        mock_find_spec.return_value = None  # built-in for new_aws_service doesn't exist
+        mock_ep_checks.return_value = [("new_check", "/ext/path")]
+
+        checks = recover_checks_from_provider("aws", service="new_aws_service")
+
+        assert len(checks) == 1
+        assert checks[0][0] == "new_check"
+        mock_ep_checks.assert_called_once_with("aws", "new_aws_service")
+
+    @patch("prowler.lib.check.utils._recover_ep_checks")
+    @patch("prowler.lib.check.utils.list_modules")
+    @patch("prowler.lib.check.utils.importlib.util.find_spec")
+    def test_recover_checks_surfaces_error_when_builtin_service_import_fails(
+        self, mock_find_spec, mock_list_modules, mock_ep_checks
+    ):
+        """Regression guard: when a built-in service's package exists but one
+        of its modules fails to import (e.g. a broken transitive dependency),
+        the error must surface via the global exception handler — not be
+        silently swallowed and replaced by an entry-point plug-in that happens
+        to share a name. See PR #10700 review (HugoPBrito)."""
+        from prowler.lib.check.utils import recover_checks_from_provider
+
+        mock_find_spec.return_value = MagicMock()  # built-in service exists
+        mock_list_modules.side_effect = ImportError("missing transitive dep: foo")
+
+        # Even if a plug-in registers checks for the same service, it must NOT
+        # silently take over — the import error wins.
+        mock_ep_checks.return_value = [("evil_check", "/evil/path")]
+
+        with pytest.raises(SystemExit):
+            recover_checks_from_provider("aws", service="ec2")
+
+
+# ===========================================================================
+# 4. Check Execution
+# ===========================================================================
+
+
+class TestCheckExecution:
+    """Tests 15-17: _resolve_check_module."""
+
+    @patch("prowler.lib.check.check.importlib.util.find_spec")
+    @patch("prowler.lib.check.check.import_check")
+    def test_resolve_check_module_builtin_first(self, mock_import, mock_find_spec):
+        """Test 15: _resolve_check_module resolves built-in checks first."""
+        from prowler.lib.check.check import _resolve_check_module
+
+        mock_module = MagicMock()
+        mock_import.return_value = mock_module
+        mock_find_spec.return_value = MagicMock()  # built-in package exists
+
+        result = _resolve_check_module("aws", "ec2", "my_check")
+
+        assert result is mock_module
+        mock_import.assert_called_once_with(
+            "prowler.providers.aws.services.ec2.my_check.my_check"
+        )
+
+    @patch("prowler.lib.check.check.importlib.util.find_spec")
+    @patch("prowler.lib.check.check.import_check")
+    def test_resolve_check_module_fallback_to_entry_point(
+        self, mock_import_check, mock_find_spec
+    ):
+        """Test 16: _resolve_check_module falls back to entry point when built-in is absent."""
+        from prowler.lib.check.check import _resolve_check_module
+
+        mock_find_spec.return_value = None  # built-in does not exist
+
+        mock_ext_module = MagicMock()
+        ep = _make_entry_point(
+            "my_check", "ext_pkg.checks.my_check", "prowler.checks.fake"
+        )
+
+        with (
+            patch("importlib.metadata.entry_points", return_value=[ep]),
+            patch("importlib.import_module", return_value=mock_ext_module) as mock_imp,
+        ):
+            result = _resolve_check_module("fake", "svc", "my_check")
+
+        assert result is mock_ext_module
+        mock_imp.assert_called_with("ext_pkg.checks.my_check")
+        mock_import_check.assert_not_called()
+
+    @patch("prowler.lib.check.check.importlib.util.find_spec")
+    @patch("prowler.lib.check.check.import_check")
+    def test_resolve_check_module_builtin_wins_over_entry_point(
+        self, mock_import_check, mock_find_spec
+    ):
+        """Regression guard: when both a built-in and an entry-point check
+        exist with the same CheckID, the BUILT-IN wins. Plug-ins extend
+        Prowler with new checks but cannot silently override existing
+        built-ins — a security tool prefers fail-loud predictability over
+        permissive overrides. CheckMetadata.get_bulk applies the same
+        precedence (first-write-wins) and emits a warning. See PR #10700
+        review (HugoPBrito)."""
+        from prowler.lib.check.check import _resolve_check_module
+
+        mock_find_spec.return_value = MagicMock()  # built-in exists
+        builtin_module = MagicMock()
+        mock_import_check.return_value = builtin_module
+
+        # Plug-in registers same CheckID — must NOT take precedence
+        ep = _make_entry_point(
+            "ec2_instance_public_ip",
+            "plug_pkg.checks.ec2_instance_public_ip",
+            "prowler.checks.aws",
+        )
+
+        with (
+            patch("importlib.metadata.entry_points", return_value=[ep]),
+            patch("importlib.import_module") as mock_imp,
+        ):
+            result = _resolve_check_module("aws", "ec2", "ec2_instance_public_ip")
+
+        assert result is builtin_module
+        mock_import_check.assert_called_once_with(
+            "prowler.providers.aws.services.ec2.ec2_instance_public_ip.ec2_instance_public_ip"
+        )
+        # Plug-in must NOT be loaded when a built-in with the same CheckID exists
+        mock_imp.assert_not_called()
+
+    @patch("prowler.lib.check.check.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.check.importlib.util.find_spec")
+    def test_resolve_check_module_raises_when_not_found(self, mock_find_spec, mock_ep):
+        """Test 17: _resolve_check_module raises ModuleNotFoundError when both fail."""
+        from prowler.lib.check.check import _resolve_check_module
+
+        mock_find_spec.return_value = None
+        mock_ep.return_value = []
+
+        with pytest.raises(ModuleNotFoundError, match="not found"):
+            _resolve_check_module("fake", "svc", "nonexistent_check")
+
+    @patch("prowler.lib.check.check.importlib.util.find_spec")
+    @patch("prowler.lib.check.check.import_check")
+    def test_resolve_check_module_surfaces_error_when_builtin_import_fails(
+        self, mock_import_check, mock_find_spec
+    ):
+        """Regression guard: when no plug-in entry-point overrides the
+        check, a built-in whose module exists but fails to import (e.g.
+        broken transitive dependency) MUST surface the real error instead
+        of being silently treated as 'not found'. See PR #10700 review
+        (HugoPBrito)."""
+        from prowler.lib.check.check import _resolve_check_module
+
+        mock_find_spec.return_value = MagicMock()  # built-in module exists
+        mock_import_check.side_effect = ImportError("missing transitive dep: foo")
+
+        # No plug-in override — the built-in's import failure must propagate
+        with patch("importlib.metadata.entry_points", return_value=[]):
+            with pytest.raises(ImportError, match="missing transitive dep"):
+                _resolve_check_module("aws", "ec2", "ec2_instance_public_ip")
+
+
+# ===========================================================================
+# 5. CLI Arguments
+# ===========================================================================
+
+
+class TestCLIArguments:
+    """Tests 18-19: init_providers_parser fallback."""
+
+    @patch("prowler.providers.common.arguments.Provider._load_ep_provider")
+    @patch("prowler.providers.common.arguments.Provider.get_available_providers")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_init_providers_parser_fallback_to_init_parser(
+        self, mock_import, mock_providers, mock_load_ep
+    ):
+        """Test 18: init_providers_parser falls back to cls.init_parser for external providers."""
+        from prowler.providers.common.arguments import init_providers_parser
+
+        mock_providers.return_value = ["fakeexternal"]
+        mock_import.side_effect = ImportError("No built-in arguments module")
+        mock_load_ep.return_value = FakeExternalProvider
+
+        parser_instance = MagicMock()
+
+        # Should not raise
+        init_providers_parser(parser_instance)
+
+    @patch("prowler.providers.common.arguments.Provider._load_ep_provider")
+    @patch("prowler.providers.common.arguments.Provider.get_available_providers")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_init_providers_parser_no_crash_without_init_parser(
+        self, mock_import, mock_providers, mock_load_ep
+    ):
+        """Test 19: init_providers_parser doesn't crash if provider has no init_parser."""
+        from prowler.providers.common.arguments import init_providers_parser
+
+        mock_providers.return_value = ["nohelptext"]
+        mock_import.side_effect = ImportError("No built-in")
+        # FakeProviderNoHelpText has no init_parser
+        mock_load_ep.return_value = FakeProviderNoHelpText
+
+        parser_instance = MagicMock()
+
+        # Should not raise
+        init_providers_parser(parser_instance)
+
+    @patch("prowler.providers.common.arguments.Provider._load_ep_provider")
+    @patch("prowler.providers.common.arguments.Provider.get_available_providers")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_init_providers_parser_handles_init_parser_exception(
+        self, mock_import, mock_providers, mock_load_ep
+    ):
+        """init_providers_parser handles exception when init_parser raises."""
+        from prowler.providers.common.arguments import init_providers_parser
+
+        mock_providers.return_value = ["fakeexternal"]
+        mock_import.side_effect = ImportError("No built-in")
+
+        broken_cls = MagicMock()
+        broken_cls.init_parser.side_effect = RuntimeError("Parser init failed")
+        mock_load_ep.return_value = broken_cls
+
+        parser_instance = MagicMock()
+
+        # Should not raise
+        init_providers_parser(parser_instance)
+
+
+# ===========================================================================
+# 6. Compliance
+# ===========================================================================
+
+
+class TestCompliance:
+    """Tests 20-23: compliance discovery and loading."""
+
+    @patch("prowler.config.config.importlib.metadata.entry_points")
+    def test_get_ep_compliance_dirs_discovers_dirs(self, mock_ep):
+        """Test 20: _get_ep_compliance_dirs discovers compliance directories."""
+        from prowler.config.config import _get_ep_compliance_dirs
+
+        mock_module = MagicMock()
+        mock_module.__path__ = ["/path/to/compliance"]
+        ep = _make_entry_point("fakeexternal", "pkg.compliance", "prowler.compliance")
+        ep.load.return_value = mock_module
+        mock_ep.return_value = [ep]
+
+        dirs = _get_ep_compliance_dirs()
+
+        assert dirs["fakeexternal"] == "/path/to/compliance"
+
+    @patch("prowler.config.config.importlib.metadata.entry_points")
+    def test_get_ep_compliance_dirs_file_fallback(self, mock_ep):
+        """_get_ep_compliance_dirs uses __file__ when module has no __path__."""
+        from prowler.config.config import _get_ep_compliance_dirs
+
+        mock_module = MagicMock(spec=[])
+        mock_module.__file__ = "/path/to/compliance/__init__.py"
+        del mock_module.__path__
+        ep = _make_entry_point("ext", "pkg.compliance", "prowler.compliance")
+        ep.load.return_value = mock_module
+        mock_ep.return_value = [ep]
+
+        dirs = _get_ep_compliance_dirs()
+
+        assert dirs["ext"] == "/path/to/compliance"
+
+    @patch("prowler.config.config.importlib.metadata.entry_points")
+    def test_get_ep_compliance_dirs_handles_load_exception(self, mock_ep):
+        """_get_ep_compliance_dirs handles ep.load() exception gracefully."""
+        from prowler.config.config import _get_ep_compliance_dirs
+
+        ep = _make_entry_point("broken", "pkg.compliance", "prowler.compliance")
+        ep.load.side_effect = Exception("Load failed")
+        mock_ep.return_value = [ep]
+
+        dirs = _get_ep_compliance_dirs()
+
+        assert dirs == {}
+
+    @patch("prowler.config.config._get_ep_compliance_dirs")
+    def test_get_available_compliance_includes_external(self, mock_dirs):
+        """Test 21: get_available_compliance_frameworks includes external compliance."""
+        import json
+        import os
+        import tempfile
+
+        from prowler.config.config import get_available_compliance_frameworks
+
+        # Create a temp dir with a compliance JSON
+        with tempfile.TemporaryDirectory() as tmpdir:
+            json_path = os.path.join(tmpdir, "custom_1.0_ext.json")
+            with open(json_path, "w") as f:
+                json.dump({"Framework": "Custom", "Provider": "ext"}, f)
+
+            mock_dirs.return_value = {"ext": tmpdir}
+
+            frameworks = get_available_compliance_frameworks("ext")
+
+            assert "custom_1.0_ext" in frameworks
+
+    @patch("prowler.config.config.importlib.metadata.entry_points")
+    def test_get_available_compliance_includes_external_universal(self, mock_ep):
+        """External universal frameworks under prowler.compliance.universal are
+        listed, for a provider and for the provider=None case that feeds
+        --compliance choices."""
+        import json
+        import os
+        import tempfile
+
+        from prowler.config.config import get_available_compliance_frameworks
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            framework = {
+                "framework": "CustomUniversal",
+                "name": "Custom Universal",
+                "version": "1.0",
+                "description": "Multi-provider",
+                "requirements": [
+                    {
+                        "id": "1",
+                        "name": "r",
+                        "description": "d",
+                        "checks": {"aws": ["c"]},
+                    }
+                ],
+            }
+            with open(os.path.join(tmpdir, "customuniversal_1.0.json"), "w") as f:
+                json.dump(framework, f)
+
+            module = MagicMock()
+            module.__path__ = [tmpdir]
+            ep = _make_entry_point(
+                "anyname", "pkg.compliance", "prowler.compliance.universal"
+            )
+            ep.load.return_value = module
+            mock_ep.side_effect = lambda group: (
+                [ep] if group == "prowler.compliance.universal" else []
+            )
+
+            assert "customuniversal_1.0" in get_available_compliance_frameworks("aws")
+            assert "customuniversal_1.0" in get_available_compliance_frameworks(None)
+
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_compliance_get_bulk_loads_external(self, mock_list_modules, mock_ep):
+        """Test 22: Compliance.get_bulk loads external compliance JSON."""
+        import json
+        import os
+        import tempfile
+
+        from prowler.lib.check.compliance_models import Compliance
+
+        mock_list_modules.return_value = []
+
+        # Create a valid compliance JSON
+        with tempfile.TemporaryDirectory() as tmpdir:
+            json_data = {
+                "Framework": "Custom",
+                "Name": "Custom Framework",
+                "Version": "1.0",
+                "Provider": "fakeexternal",
+                "Description": "Test framework",
+                "Requirements": [],
+            }
+            json_path = os.path.join(tmpdir, "custom_1.0_fakeexternal.json")
+            with open(json_path, "w") as f:
+                json.dump(json_data, f)
+
+            mock_module = MagicMock()
+            mock_module.__path__ = [tmpdir]
+            ep = _make_entry_point(
+                "fakeexternal", "pkg.compliance", "prowler.compliance"
+            )
+            ep.load.return_value = mock_module
+            mock_ep.return_value = [ep]
+
+            bulk = Compliance.get_bulk("fakeexternal")
+
+            assert "custom_1.0_fakeexternal" in bulk
+            assert bulk["custom_1.0_fakeexternal"].Framework == "Custom"
+
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_compliance_get_bulk_skips_non_legacy_external_json(
+        self, mock_list_modules, mock_ep
+    ):
+        """A universal-schema JSON registered under prowler.compliance is skipped,
+        not aborting the run via sys.exit."""
+        import json
+        import os
+        import tempfile
+
+        from prowler.lib.check.compliance_models import Compliance
+
+        mock_list_modules.return_value = []
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            json_data = {
+                "framework": "Universal",
+                "name": "Universal Framework",
+                "version": "1.0",
+                "description": "Multi-provider",
+                "requirements": [
+                    {
+                        "id": "1",
+                        "name": "r",
+                        "description": "d",
+                        "checks": {"aws": ["c"]},
+                    }
+                ],
+            }
+            with open(os.path.join(tmpdir, "universal_1.0.json"), "w") as f:
+                json.dump(json_data, f)
+
+            mock_module = MagicMock()
+            mock_module.__path__ = [tmpdir]
+            ep = _make_entry_point("aws", "pkg.compliance", "prowler.compliance")
+            ep.load.return_value = mock_module
+            mock_ep.return_value = [ep]
+
+            bulk = Compliance.get_bulk("aws")
+
+        assert "universal_1.0" not in bulk
+
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_compliance_get_bulk_file_fallback(self, mock_list_modules, mock_ep):
+        """Compliance.get_bulk uses __file__ when external module has no __path__."""
+        import json
+        import os
+        import tempfile
+
+        from prowler.lib.check.compliance_models import Compliance
+
+        mock_list_modules.return_value = []
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            json_data = {
+                "Framework": "Custom",
+                "Name": "Custom File Fallback",
+                "Version": "1.0",
+                "Provider": "fakeexternal",
+                "Description": "Test",
+                "Requirements": [],
+            }
+            json_path = os.path.join(tmpdir, "custom_file_fakeexternal.json")
+            with open(json_path, "w") as f:
+                json.dump(json_data, f)
+
+            mock_module = MagicMock(spec=[])
+            mock_module.__file__ = os.path.join(tmpdir, "__init__.py")
+            del mock_module.__path__
+            ep = _make_entry_point(
+                "fakeexternal", "pkg.compliance", "prowler.compliance"
+            )
+            ep.load.return_value = mock_module
+            mock_ep.return_value = [ep]
+
+            bulk = Compliance.get_bulk("fakeexternal")
+
+            assert "custom_file_fakeexternal" in bulk
+
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_compliance_get_bulk_handles_external_exception(
+        self, mock_list_modules, mock_ep
+    ):
+        """Compliance.get_bulk handles exception when loading external compliance."""
+        from prowler.lib.check.compliance_models import Compliance
+
+        mock_list_modules.return_value = []
+
+        ep = _make_entry_point("fakeexternal", "pkg.compliance", "prowler.compliance")
+        ep.load.side_effect = Exception("Load failed")
+        mock_ep.return_value = [ep]
+
+        bulk = Compliance.get_bulk("fakeexternal")
+
+        assert bulk == {}
+
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_compliance_get_bulk_builtin_wins_on_duplicate(
+        self, mock_list_modules, mock_ep
+    ):
+        """Test 23: Compliance.get_bulk built-in wins on duplicate framework names."""
+        import json
+        import os
+        import tempfile
+
+        from prowler.lib.check.compliance_models import Compliance
+
+        mock_list_modules.return_value = []
+        mock_ep.return_value = []
+
+        # If both exist with same key, built-in (loaded first) should win
+        # Since we have no built-in modules mocked, just verify external loads
+        # The actual dedup logic: `if name not in bulk_compliance_frameworks`
+        with tempfile.TemporaryDirectory() as tmpdir:
+            json_data = {
+                "Framework": "CIS",
+                "Name": "CIS Test",
+                "Version": "1.0",
+                "Provider": "fakeexternal",
+                "Description": "Test",
+                "Requirements": [],
+            }
+            with open(os.path.join(tmpdir, "dup_framework.json"), "w") as f:
+                json.dump(json_data, f)
+
+            mock_module = MagicMock()
+            mock_module.__path__ = [tmpdir]
+            ep = _make_entry_point(
+                "fakeexternal", "pkg.compliance", "prowler.compliance"
+            )
+            ep.load.return_value = mock_module
+            mock_ep.return_value = [ep]
+
+            bulk = Compliance.get_bulk("fakeexternal")
+
+            assert "dup_framework" in bulk
+
+    @pytest.mark.parametrize(
+        "provider, framework_segments",
+        [
+            # `cloud` is a substring of THREE built-in modules at once.
+            ("cloud", ["alibabacloud", "cloudflare", "oraclecloud"]),
+            ("git", ["github"]),
+            ("work", ["googleworkspace"]),
+            ("open", ["openstack"]),
+        ],
+    )
+    @patch("prowler.lib.check.compliance_models.importlib.metadata.entry_points")
+    @patch("prowler.lib.check.compliance_models.list_compliance_modules")
+    def test_compliance_get_bulk_matches_provider_segment_exactly(
+        self, mock_list_modules, mock_ep, provider, framework_segments
+    ):
+        """Regression: a provider whose name is a substring of one or more
+        framework modules must NOT load them. The old `provider in name`
+        check captured overlapping built-ins (e.g. `cloud` matched
+        alibabacloud, cloudflare and oraclecloud). See PR #10700 review
+        (Alan-TheGentleman).
+        """
+        import json
+        import os
+        import tempfile
+
+        from prowler.lib.check.compliance_models import Compliance
+
+        mock_ep.return_value = []
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            # The substring path the old code would have read from.
+            os.mkdir(os.path.join(tmpdir, provider))
+            json_data = {
+                "Framework": "Custom",
+                "Name": f"Should not load for '{provider}'",
+                "Version": "1.0",
+                "Provider": provider,
+                "Description": "Test",
+                "Requirements": [],
+            }
+            with open(os.path.join(tmpdir, provider, "wrong.json"), "w") as f:
+                json.dump(json_data, f)
+
+            modules = []
+            for segment in framework_segments:
+                module = MagicMock()
+                module.name = f"prowler.compliance.{segment}"
+                module.module_finder.path = tmpdir
+                modules.append(module)
+            mock_list_modules.return_value = modules
+
+            bulk = Compliance.get_bulk(provider)
+
+            # Exact-segment match: the provider is not any of these modules.
+            assert "wrong" not in bulk
+            assert bulk == {}
+
+
+# ===========================================================================
+# 7. Parser
+# ===========================================================================
+
+
+class TestParser:
+    """Tests 24-27: parser dynamic discovery."""
+
+    @patch("prowler.lib.cli.parser.Provider.get_providers_help_text")
+    @patch("prowler.lib.cli.parser.Provider.get_available_providers")
+    def test_parser_discovers_new_providers(self, mock_providers, mock_help):
+        """Test 24: Parser discovers providers not in known_providers."""
+        from prowler.lib.cli.parser import ProwlerArgumentParser
+
+        mock_providers.return_value = [
+            "aws",
+            "azure",
+            "gcp",
+            "kubernetes",
+            "m365",
+            "github",
+            "googleworkspace",
+            "cloudflare",
+            "oraclecloud",
+            "openstack",
+            "alibabacloud",
+            "iac",
+            "llm",
+            "image",
+            "nhn",
+            "mongodbatlas",
+            "fakeexternal",
+        ]
+        mock_help.return_value = {"fakeexternal": "Fake External Provider"}
+
+        parser = ProwlerArgumentParser()
+
+        assert "fakeexternal" in parser.parser.format_usage()
+
+    @patch("prowler.lib.cli.parser.Provider.get_providers_help_text")
+    @patch("prowler.lib.cli.parser.Provider.get_available_providers")
+    def test_parser_appends_to_epilog_with_help_text(self, mock_providers, mock_help):
+        """Test 25: Parser appends new providers to epilog with _cli_help_text."""
+        from prowler.lib.cli.parser import ProwlerArgumentParser
+
+        mock_providers.return_value = [
+            "aws",
+            "azure",
+            "gcp",
+            "kubernetes",
+            "m365",
+            "github",
+            "googleworkspace",
+            "cloudflare",
+            "oraclecloud",
+            "openstack",
+            "alibabacloud",
+            "iac",
+            "llm",
+            "image",
+            "nhn",
+            "mongodbatlas",
+            "fakeexternal",
+        ]
+        mock_help.return_value = {"fakeexternal": "Fake External Provider"}
+
+        parser = ProwlerArgumentParser()
+        epilog = parser.parser.epilog
+
+        assert "fakeexternal" in epilog
+        assert "Fake External Provider" in epilog
+
+    @patch("prowler.lib.cli.parser.Provider.get_providers_help_text")
+    @patch("prowler.lib.cli.parser.Provider.get_available_providers")
+    def test_parser_skips_epilog_entry_without_help_text(
+        self, mock_providers, mock_help
+    ):
+        """Test 26: Parser doesn't add epilog entry if _cli_help_text is empty."""
+        from prowler.lib.cli.parser import ProwlerArgumentParser
+
+        mock_providers.return_value = [
+            "aws",
+            "azure",
+            "gcp",
+            "kubernetes",
+            "m365",
+            "github",
+            "googleworkspace",
+            "cloudflare",
+            "oraclecloud",
+            "openstack",
+            "alibabacloud",
+            "iac",
+            "llm",
+            "image",
+            "nhn",
+            "mongodbatlas",
+            "nohelptext",
+        ]
+        mock_help.return_value = {"nohelptext": ""}
+
+        parser = ProwlerArgumentParser()
+        epilog = parser.parser.epilog
+
+        # Should appear in usage/csv but NOT in the descriptive epilog listing
+        assert "nohelptext" in parser.parser.format_usage()
+        # No line with "nohelptext    Something" in epilog
+        epilog_lines = [
+            line.strip() for line in epilog.splitlines() if "nohelptext" in line
+        ]
+        assert len(epilog_lines) == 0 or all(
+            "nohelptext" in line and line.strip() == "nohelptext" or "{" in line
+            for line in epilog_lines
+        )
+
+    @patch("prowler.lib.cli.parser.Provider.get_providers_help_text")
+    @patch("prowler.lib.cli.parser.Provider.get_available_providers")
+    def test_parser_does_not_duplicate_known_providers(self, mock_providers, mock_help):
+        """Test 27: Parser doesn't duplicate providers already in the known list."""
+        from prowler.lib.cli.parser import ProwlerArgumentParser
+
+        # No new providers
+        mock_providers.return_value = [
+            "aws",
+            "azure",
+            "gcp",
+            "kubernetes",
+            "m365",
+            "github",
+            "googleworkspace",
+            "cloudflare",
+            "oraclecloud",
+            "openstack",
+            "alibabacloud",
+            "iac",
+            "llm",
+            "image",
+            "nhn",
+            "mongodbatlas",
+        ]
+        mock_help.return_value = {}
+
+        parser = ProwlerArgumentParser()
+        usage = parser.parser.format_usage()
+
+        # aws should appear exactly once in usage
+        assert usage.count("aws") == 1
+
+
+# ===========================================================================
+# 8. Dispatch Fallbacks
+# ===========================================================================
+
+
+class TestDispatchFallbacks:
+    """Tests 28-34: all else clause fallbacks for external providers."""
+
+    def test_stdout_report_calls_get_stdout_detail(self, fake_provider):
+        """Test 28: stdout_report else clause calls provider.get_stdout_detail."""
+        from prowler.lib.outputs.outputs import stdout_report
+
+        finding = MagicMock()
+        finding.check_metadata.Provider = "fakeexternal"
+        finding.status = "FAIL"
+        finding.muted = False
+        finding.status_extended = "test"
+
+        with patch("builtins.print") as mock_print:
+            stdout_report(
+                finding, "\033[31m", True, ["FAIL"], False, provider=fake_provider
+            )
+
+        mock_print.assert_called_once()
+        printed = mock_print.call_args[0][0]
+        assert "fake-detail" in printed
+
+    def test_stdout_report_resolves_provider_when_none(self, fake_provider):
+        """stdout_report resolves provider via get_global_provider when not passed."""
+        from prowler.lib.outputs.outputs import stdout_report
+
+        finding = MagicMock()
+        finding.check_metadata.Provider = "fakeexternal"
+        finding.status = "FAIL"
+        finding.muted = False
+        finding.status_extended = "test"
+
+        with patch("builtins.print") as mock_print:
+            stdout_report(finding, "\033[31m", True, ["FAIL"], False)
+
+        mock_print.assert_called_once()
+        printed = mock_print.call_args[0][0]
+        assert "fake-detail" in printed
+
+    def test_report_propagates_provider_to_stdout_report(self):
+        """Regression guard: report() must pass its local `provider` through to
+        stdout_report so the dynamic else does not fall back to the global
+        singleton. With Provider._global cleared, the call chain still has to
+        work for an external provider — proving the argument is being used
+        instead of `Provider.get_global_provider()`. See PR #10700 review
+        (HugoPBrito)."""
+        from prowler.lib.outputs.outputs import report
+        from prowler.providers.common.provider import Provider
+
+        local_provider = FakeExternalProvider.__new__(FakeExternalProvider)
+
+        finding = MagicMock()
+        finding.status = "PASS"
+        finding.muted = False
+        finding.region = "x"
+        finding.check_metadata.Provider = "fakeexternal"
+        finding.status_extended = "test"
+
+        output_options = MagicMock()
+        output_options.verbose = True
+        output_options.status = []
+        output_options.fixer = False
+
+        # Clear the global singleton so any unintended fallback would crash.
+        previous_global = Provider._global
+        Provider._global = None
+        try:
+            with patch("builtins.print") as mock_print:
+                report([finding], local_provider, output_options)
+
+            # report() prints the finding line plus an empty separator when
+            # verbose is set; we only care that the finding was rendered using
+            # the local provider's `get_stdout_detail` ("fake-detail").
+            printed = "".join(
+                call.args[0] for call in mock_print.call_args_list if call.args
+            )
+            assert "fake-detail" in printed
+        finally:
+            Provider._global = previous_global
+
+    def test_report_sort_calls_get_finding_sort_key(self, fake_provider):
+        """Test 29: report else clause calls provider.get_finding_sort_key."""
+        from prowler.lib.outputs.outputs import report
+
+        finding1 = MagicMock()
+        finding1.status = "PASS"
+        finding1.muted = False
+        finding1.region = "b-region"
+        finding1.check_metadata.Provider = "fakeexternal"
+        finding1.status_extended = "test1"
+
+        finding2 = MagicMock()
+        finding2.status = "PASS"
+        finding2.muted = False
+        finding2.region = "a-region"
+        finding2.check_metadata.Provider = "fakeexternal"
+        finding2.status_extended = "test2"
+
+        output_options = MagicMock()
+        output_options.verbose = False
+        output_options.status = []
+
+        findings = [finding1, finding2]
+        report(findings, fake_provider, output_options)
+
+        # Should be sorted by region (get_finding_sort_key returns "region")
+        assert findings[0].region == "a-region"
+        assert findings[1].region == "b-region"
+
+    def test_display_summary_table_calls_get_summary_entity(self, fake_provider):
+        """Test 30: display_summary_table else clause calls provider.get_summary_entity."""
+        from prowler.lib.outputs.summary_table import display_summary_table
+
+        finding = MagicMock()
+        finding.status = "FAIL"
+        finding.muted = False
+        finding.check_metadata.ServiceName = "test_service"
+        finding.check_metadata.Provider = "fakeexternal"
+        finding.check_metadata.Severity = "high"
+
+        output_options = MagicMock()
+        output_options.output_directory = "/tmp"
+        output_options.output_filename = "test"
+        output_options.output_modes = []
+
+        with patch("builtins.print") as mock_print:
+            display_summary_table([finding], fake_provider, output_options)
+
+        printed_text = " ".join(str(c) for c in mock_print.call_args_list)
+        assert "Fake Host" in printed_text or "fake-host-1" in printed_text
+
+    def test_generate_output_calls_get_finding_output_data(self, fake_provider):
+        """Test 31: finding.generate_output else clause calls provider.get_finding_output_data."""
+        from prowler.lib.check.models import (
+            CheckMetadata,
+            Code,
+            Recommendation,
+            Remediation,
+        )
+        from prowler.lib.outputs.finding import Finding
+
+        metadata = CheckMetadata(
+            Provider="fakeexternal",
+            CheckID="test_check",
+            CheckTitle="Test check title",
+            CheckType=[],
+            ServiceName="test",
+            SubServiceName="",
+            ResourceIdTemplate="",
+            Severity="high",
+            ResourceType="Test",
+            ResourceGroup="",
+            Description="Test description",
+            Risk="Test risk",
+            RelatedUrl="",
+            Remediation=Remediation(
+                Code=Code(CLI="", NativeIaC="", Other="", Terraform=""),
+                Recommendation=Recommendation(
+                    Text="Fix it", Url="https://hub.prowler.com/check/test_check"
+                ),
+            ),
+            Categories=[],
+            DependsOn=[],
+            RelatedTo=[],
+            Notes="",
+        )
+
+        check_output = MagicMock()
+        check_output.check_metadata = metadata
+        check_output.status = "FAIL"
+        check_output.status_extended = "test failed"
+        check_output.muted = False
+        check_output.resource = {}
+        check_output.resource_details = ""
+        check_output.resource_tags = {}
+        check_output.compliance = {}
+
+        output_options = MagicMock()
+        output_options.unix_timestamp = False
+        output_options.bulk_checks_metadata = {}
+
+        finding = Finding.generate_output(fake_provider, check_output, output_options)
+
+        assert finding.auth_method == "fake"
+        assert finding.account_uid == "fake-account"
+        assert finding.resource_name == "fake-resource"
+        assert finding.region == "local"
+
+    def test_output_options_calls_get_output_options(self, fake_provider):
+        """Test 32: __main__.py else clause calls provider.get_output_options."""
+        result = fake_provider.get_output_options(MagicMock(), {})
+
+        assert result is not None
+        assert hasattr(result, "output_directory")
+
+    def test_html_assessment_calls_get_html_assessment_summary(self, fake_provider):
+        """Test 33: html.py fallback calls provider.get_html_assessment_summary."""
+        from prowler.lib.outputs.html.html import HTML
+
+        result = HTML.get_assessment_summary(fake_provider)
+
+        assert "<div>Fake Assessment</div>" in result
+
+    def test_compliance_output_calls_generate_compliance_output(self, fake_provider):
+        """Test 34: __main__.py else clause calls provider.generate_compliance_output."""
+        generated_outputs = {"compliance": []}
+
+        fake_provider.generate_compliance_output(
+            [],
+            {},
+            set(),
+            MagicMock(),
+            generated_outputs,
+        )
+
+        assert "fake-compliance-output" in generated_outputs["compliance"]
+
+
+# ===========================================================================
+# 9. Base Contract Defaults
+# ===========================================================================
+
+
+class TestBaseContractDefaults:
+    """Tests for Provider base class default implementations."""
+
+    def test_from_cli_args_raises_not_implemented(self):
+        """Base Provider.from_cli_args raises NotImplementedError."""
+        with pytest.raises(NotImplementedError):
+            FakeProviderNoHelpText.from_cli_args(MagicMock(), {})
+
+    def test_get_output_options_raises_not_implemented(self):
+        """Base Provider.get_output_options raises NotImplementedError; the
+        generic default is applied at the call site via default_output_options."""
+        provider = FakeProviderNoHelpText()
+        with pytest.raises(NotImplementedError):
+            provider.get_output_options(MagicMock(), {})
+
+    def test_default_output_options_builds_generic_default(self):
+        """default_output_options returns a generic ProviderOutputOptions so an
+        external provider without get_output_options still produces output
+        instead of aborting the run."""
+        from prowler.config.config import output_file_timestamp
+        from prowler.providers.common.models import (
+            ProviderOutputOptions,
+            default_output_options,
+        )
+
+        provider = FakeProviderNoHelpText()
+        arguments = Namespace(
+            status=None,
+            output_formats=None,
+            output_directory=None,
+            output_filename=None,
+            verbose=None,
+            only_logs=None,
+            unix_timestamp=None,
+            shodan=None,
+            fixer=None,
+        )
+
+        output_options = default_output_options(provider, arguments, {})
+
+        assert isinstance(output_options, ProviderOutputOptions)
+        assert (
+            output_options.output_filename
+            == f"prowler-output-{provider.type}-{output_file_timestamp}"
+        )
+
+    def test_default_output_options_honors_explicit_filename(self):
+        """A user-supplied output_filename is preserved by default_output_options."""
+        from prowler.providers.common.models import default_output_options
+
+        provider = FakeProviderNoHelpText()
+        arguments = Namespace(
+            status=None,
+            output_formats=None,
+            output_directory=None,
+            output_filename="custom-name",
+            verbose=None,
+            only_logs=None,
+            unix_timestamp=None,
+            shodan=None,
+            fixer=None,
+        )
+
+        output_options = default_output_options(provider, arguments, {})
+
+        assert output_options.output_filename == "custom-name"
+
+    def test_get_stdout_detail_raises_not_implemented(self):
+        """Base Provider.get_stdout_detail raises NotImplementedError."""
+        provider = FakeProviderNoHelpText()
+        with pytest.raises(NotImplementedError):
+            provider.get_stdout_detail(MagicMock())
+
+    def test_get_finding_sort_key_returns_none(self):
+        """Base Provider.get_finding_sort_key returns None."""
+        provider = FakeProviderNoHelpText()
+        assert provider.get_finding_sort_key() is None
+
+    def test_get_summary_entity_returns_type_and_account_default(self):
+        """Base Provider.get_summary_entity returns (type, account_id) so the
+        summary table is not silently dropped for providers that don't override
+        it."""
+        from types import SimpleNamespace
+        from unittest.mock import PropertyMock
+
+        provider = FakeProviderNoHelpText()
+        with patch.object(
+            type(provider),
+            "identity",
+            new_callable=PropertyMock,
+            return_value=SimpleNamespace(account_id="acc-123"),
+        ):
+            entity_type, audited_entities = provider.get_summary_entity()
+
+        assert entity_type == provider.type
+        assert audited_entities == "acc-123"
+
+    def test_get_summary_entity_defaults_account_to_empty_string(self):
+        """When the identity has no account_id, audited_entities falls back to ''."""
+        from types import SimpleNamespace
+        from unittest.mock import PropertyMock
+
+        provider = FakeProviderNoHelpText()
+        with patch.object(
+            type(provider),
+            "identity",
+            new_callable=PropertyMock,
+            return_value=SimpleNamespace(),
+        ):
+            entity_type, audited_entities = provider.get_summary_entity()
+
+        assert entity_type == provider.type
+        assert audited_entities == ""
+
+    def test_get_finding_output_data_raises_not_implemented(self):
+        """Base Provider.get_finding_output_data raises NotImplementedError."""
+        provider = FakeProviderNoHelpText()
+        with pytest.raises(NotImplementedError):
+            provider.get_finding_output_data(MagicMock())
+
+    def test_get_html_assessment_summary_raises_not_implemented(self):
+        """Base Provider.get_html_assessment_summary raises NotImplementedError."""
+        provider = FakeProviderNoHelpText()
+        with pytest.raises(NotImplementedError):
+            provider.get_html_assessment_summary()
+
+    def test_generate_compliance_output_raises_not_implemented(self):
+        """Base Provider.generate_compliance_output raises NotImplementedError."""
+        provider = FakeProviderNoHelpText()
+        with pytest.raises(NotImplementedError):
+            provider.generate_compliance_output([], {}, set(), MagicMock(), {})
+
+    def test_get_mutelist_finding_args_raises_not_implemented(self):
+        """Base Provider.get_mutelist_finding_args raises NotImplementedError."""
+        provider = FakeProviderNoHelpText()
+        with pytest.raises(NotImplementedError):
+            provider.get_mutelist_finding_args()
+
+    def test_display_compliance_table_raises_not_implemented(self):
+        """Base Provider.display_compliance_table raises NotImplementedError."""
+        provider = FakeProviderNoHelpText()
+        with pytest.raises(NotImplementedError):
+            provider.display_compliance_table([], {}, "fw", "out", "/tmp", False)
+
+    def test_is_external_tool_provider_defaults_to_false(self):
+        """Base Provider.is_external_tool_provider returns False."""
+        provider = FakeProviderNoHelpText()
+        assert provider.is_external_tool_provider is False
+
+
+# ===========================================================================
+# 10. Mutelist Dispatch for External Providers
+# ===========================================================================
+
+
+class TestMutelistDispatch:
+    """Tests for mutelist integration with external providers."""
+
+    def test_get_mutelist_finding_args_returns_identity(self, fake_provider):
+        """External provider returns identity kwargs for mutelist."""
+        args = fake_provider.get_mutelist_finding_args()
+
+        assert args == {"host_id": "fake-host-1"}
+
+    def test_mutelist_dispatch_calls_external_provider(self, fake_provider):
+        """execute() uses get_mutelist_finding_args for unknown provider types."""
+        from prowler.lib.check.check import execute
+
+        # Create a mock check that returns one finding
+        finding = MagicMock()
+        finding.status = "FAIL"
+        finding.muted = False
+        finding.check_metadata.Provider = "fakeexternal"
+
+        check = MagicMock()
+        check.execute.return_value = [finding]
+        check.CheckID = "fake_check"
+        check.ServiceName = "fake_service"
+        check.Severity.value = "high"
+
+        # Setup mutelist on the provider
+        fake_provider.mutelist = MagicMock()
+        fake_provider.mutelist.mutelist = {"Accounts": {}}
+        fake_provider.mutelist.is_finding_muted.return_value = True
+
+        output_options = MagicMock()
+        output_options.status = []
+        output_options.unix_timestamp = False
+
+        execute(check, fake_provider, None, output_options)
+
+        # is_finding_muted should have been called with host_id + finding
+        fake_provider.mutelist.is_finding_muted.assert_called_once_with(
+            host_id="fake-host-1", finding=finding
+        )
+
+
+# ===========================================================================
+# 11. Compliance Table Dispatch for External Providers
+# ===========================================================================
+
+
+class TestComplianceTableDispatch:
+    """Tests for compliance table display with external providers."""
+
+    def test_display_compliance_table_delegates_to_provider(self, fake_provider):
+        """display_compliance_table uses provider method for unknown frameworks."""
+        from prowler.lib.outputs.compliance.compliance import (
+            display_compliance_table,
+        )
+
+        fake_provider.display_compliance_table = MagicMock(return_value=True)
+
+        display_compliance_table(
+            [], {}, "custom_1.0_fakeexternal", "out", "/tmp", False
+        )
+
+        fake_provider.display_compliance_table.assert_called_once_with(
+            [],
+            {},
+            "custom_1.0_fakeexternal",
+            "out",
+            "/tmp",
+            False,
+        )
+
+    def test_display_compliance_table_falls_back_to_generic(self, fake_provider):
+        """display_compliance_table falls back to generic when provider returns False."""
+        from prowler.lib.outputs.compliance.compliance import (
+            display_compliance_table,
+        )
+
+        fake_provider.display_compliance_table = MagicMock(return_value=False)
+
+        with patch(
+            "prowler.lib.outputs.compliance.compliance.get_generic_compliance_table"
+        ) as mock_generic:
+            display_compliance_table(
+                [], {}, "custom_1.0_fakeexternal", "out", "/tmp", False
+            )
+
+        mock_generic.assert_called_once()
+
+    def test_display_compliance_table_falls_back_on_not_implemented(self):
+        """display_compliance_table falls back to generic when NotImplementedError."""
+        # Use a provider that doesn't implement display_compliance_table
+        provider = FakeProviderNoHelpText()
+        Provider.set_global_provider(provider)
+
+        with patch(
+            "prowler.lib.outputs.compliance.compliance.get_generic_compliance_table"
+        ) as mock_generic:
+            from prowler.lib.outputs.compliance.compliance import (
+                display_compliance_table,
+            )
+
+            display_compliance_table(
+                [], {}, "unknown_1.0_nohelptext", "out", "/tmp", False
+            )
+
+        mock_generic.assert_called_once()
+        Provider._global = None
+
+
+# ===========================================================================
+# 12. Provider.get_class — Public side-effect-free class resolver
+# ===========================================================================
+
+
+class TestGetClass:
+    """Tests for Provider.get_class(provider) — the public, side-effect-free
+    class resolver that unblocks the Django API and other callers that need
+    a provider class without triggering CLI side-effects (sys.exit, global
+    provider mutation)."""
+
+    # -----------------------------------------------------------------------
+    # T1: Built-in provider resolves to correct class
+    # -----------------------------------------------------------------------
+
+    def test_get_class_builtin_returns_correct_class(self):
+        """get_class('aws') returns AwsProvider — identity check."""
+        from prowler.providers.aws.aws_provider import AwsProvider
+
+        cls = Provider.get_class("aws")
+
+        assert cls is AwsProvider
+
+    # -----------------------------------------------------------------------
+    # T2: External entry-point provider resolves
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_external_ep_returns_class(self, mock_is_builtin, mock_ep):
+        """get_class resolves an external entry-point provider and returns that class."""
+        mock_is_builtin.return_value = False
+        mock_ep.return_value = [
+            _make_entry_point(
+                "fakeexternal", "pkg:FakeExternalProvider", "prowler.providers"
+            ),
+        ]
+        mock_ep.return_value[0].load.return_value = FakeExternalProvider
+
+        cls = Provider.get_class("fakeexternal")
+
+        assert cls is FakeExternalProvider
+
+    # -----------------------------------------------------------------------
+    # T3: Unknown provider raises, does NOT call sys.exit
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_unknown_raises_and_does_not_sys_exit(
+        self, mock_is_builtin, mock_ep
+    ):
+        """get_class raises for an unknown provider and never calls sys.exit."""
+        mock_is_builtin.return_value = False
+        mock_ep.return_value = []
+
+        # Assert ImportError specifically to enforce the public API contract
+        # (not a broad Exception). SystemExit belongs in init_global_provider's
+        # wrapper, not in the pure resolver.
+        with pytest.raises(ImportError):
+            Provider.get_class("totally_unknown_xyz_provider")
+
+    # -----------------------------------------------------------------------
+    # T4: get_class is PURE for built-ins — no collision warning, no EP call
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.logger")
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_builtin_with_ep_shadow_is_pure(
+        self, mock_is_builtin, mock_import, mock_load_ep, mock_logger
+    ):
+        """get_class for a built-in with a same-named EP is PURE:
+        - returns the built-in class
+        - does NOT emit a collision warning
+        - does NOT call _load_ep_provider (so _ep_providers cache stays empty for
+          this key, proving no side-effect)
+        """
+        import types
+
+        mock_is_builtin.return_value = True
+        mock_load_ep.return_value = FakeExternalProvider  # plug-in shadow present
+
+        fake_module = types.ModuleType("fake_builtin_module")
+        fake_builtin_cls = type("AwsProvider", (Provider,), {"_type": "aws"})
+        fake_module.AwsProvider = fake_builtin_cls
+        mock_import.return_value = fake_module
+
+        cls = Provider.get_class("aws")
+
+        # Built-in class returned
+        assert cls is fake_builtin_cls
+        # No collision warning emitted — that is now init_global_provider's job
+        warning_msgs = [
+            call.args[0]
+            for call in mock_logger.warning.call_args_list
+            if call.args and "IGNORED" in call.args[0]
+        ]
+        assert not warning_msgs, (
+            "get_class must NOT emit a collision warning; "
+            "init_global_provider owns that responsibility"
+        )
+        # _load_ep_provider must NOT have been called for the built-in path
+        mock_load_ep.assert_not_called()
+        # _ep_providers cache must not contain 'aws' (no side-effect)
+        assert "aws" not in Provider._ep_providers
+
+    # -----------------------------------------------------------------------
+    # T4b: Built-in module missing its expected class raises ImportError
+    #      and does NOT fall back to a same-named entry point
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_builtin_missing_class_raises_importerror(
+        self, mock_is_builtin, mock_import, mock_load_ep
+    ):
+        """When is_builtin is True but the module does not define the expected
+        provider class, get_class raises ImportError and does NOT fall back to a
+        same-named entry point — falling back would contradict is_builtin and
+        silently return a foreign class."""
+        import types
+
+        mock_is_builtin.return_value = True
+        # Module imports fine but lacks the expected `<Name>Provider` attribute.
+        empty_module = types.ModuleType("empty_builtin_module")
+        mock_import.return_value = empty_module
+
+        with pytest.raises(ImportError):
+            Provider.get_class("aws")
+
+        # Must NOT fall back to entry points for a (broken) built-in.
+        mock_load_ep.assert_not_called()
+
+    # -----------------------------------------------------------------------
+    # T4c: Entry point resolving to a non-Provider class raises ImportError
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_external_ep_not_provider_subclass_raises_importerror(
+        self, mock_is_builtin, mock_ep
+    ):
+        """When an entry point resolves to an object that is not a Provider
+        subclass, get_class raises ImportError instead of returning it, so the
+        public contract (a Provider subclass) is enforced rather than trusted."""
+
+        class NotAProvider:
+            pass
+
+        mock_is_builtin.return_value = False
+        mock_ep.return_value = [
+            _make_entry_point("rogue", "pkg:NotAProvider", "prowler.providers"),
+        ]
+        mock_ep.return_value[0].load.return_value = NotAProvider
+
+        with pytest.raises(ImportError):
+            Provider.get_class("rogue")
+
+    # -----------------------------------------------------------------------
+    # T4d: Contract — every built-in provider stays resolvable via get_class
+    # -----------------------------------------------------------------------
+
+    @pytest.mark.parametrize(
+        "provider",
+        [
+            name
+            for name in Provider.get_available_providers()
+            if Provider.is_builtin(name)
+        ],
+    )
+    def test_get_class_resolves_every_builtin_provider(self, provider):
+        """Contract test over all built-in providers: each one must remain
+        resolvable through get_class and return a Provider subclass whose name
+        follows the `{Capitalized}Provider` convention. This pins the naming
+        convention as the built-in resolution contract, so a future provider
+        that breaks it fails here instead of silently at runtime in a caller
+        (e.g. the API)."""
+        cls = Provider.get_class(provider)
+
+        assert isinstance(cls, type) and issubclass(cls, Provider)
+        assert cls.__name__ == f"{provider.capitalize()}Provider"
+
+    # -----------------------------------------------------------------------
+    # T5: Regression — init_global_provider still resolves external correctly
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.load_and_validate_config_file")
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    def test_init_global_provider_still_resolves_external_via_get_class(
+        self, mock_load_ep, mock_config
+    ):
+        """Regression: init_global_provider continues to work for external providers
+        after the class-resolution block is delegated to get_class.
+
+        'fakepure' is not a built-in, so is_builtin() returns False and get_class
+        takes the entry-point path. This verifies the FakePureContractProvider path
+        (pure from_cli_args returning an instance) still works — i.e.,
+        init_global_provider correctly wires the returned instance as global provider.
+        """
+        mock_load_ep.return_value = FakePureContractProvider
+        mock_config.return_value = {}
+
+        args = Namespace(
+            provider="fakepure",
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+        )
+
+        Provider._global = None
+        Provider.init_global_provider(args)
+
+        assert isinstance(Provider._global, FakePureContractProvider)
+        Provider._global = None
+
+    # -----------------------------------------------------------------------
+    # T6: Regression — get_providers_help_text returns same text after refactor
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.Provider.get_available_providers")
+    def test_get_providers_help_text_identical_after_refactor_external(
+        self, mock_providers, mock_load_ep
+    ):
+        """get_providers_help_text returns identical _cli_help_text for an external
+        provider both before and after the refactor to use get_class internally."""
+        mock_providers.return_value = ["fakeexternal"]
+        mock_load_ep.return_value = FakeExternalProvider
+
+        help_text = Provider.get_providers_help_text()
+
+        # Must match the known _cli_help_text on FakeExternalProvider
+        assert help_text["fakeexternal"] == "Fake External Provider"
+
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    @patch("prowler.providers.common.provider.Provider.get_available_providers")
+    def test_get_providers_help_text_identical_after_refactor_builtin(
+        self, mock_providers, mock_is_builtin, mock_import
+    ):
+        """get_providers_help_text returns identical _cli_help_text for a built-in
+        provider both before and after the refactor to use get_class internally.
+        is_builtin is mocked to True so get_class takes the built-in import path."""
+        import types
+
+        mock_providers.return_value = ["fakebuiltin"]
+        mock_is_builtin.return_value = True
+        mock_cls = type(
+            "FakebuiltinProvider", (Provider,), {"_cli_help_text": "Built-in Help"}
+        )
+        mock_module = types.ModuleType("fake_module")
+        mock_module.FakebuiltinProvider = mock_cls
+        mock_import.return_value = mock_module
+
+        help_text = Provider.get_providers_help_text()
+
+        assert help_text["fakebuiltin"] == "Built-in Help"
+
+    # -----------------------------------------------------------------------
+    # T7: init_global_provider emits collision warning (not get_class)
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.load_and_validate_config_file")
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_init_global_provider_emits_collision_warning_for_builtin_ep_shadow(
+        self, mock_is_builtin, mock_import, mock_entry_points, mock_config, caplog
+    ):
+        """init_global_provider (not get_class) emits the collision warning
+        when a built-in provider has a same-named entry-point plug-in registered.
+
+        This is the counterpart to test_get_class_builtin_with_ep_shadow_is_pure:
+        the warning responsibility moved OUT of get_class and INTO
+        init_global_provider, so users still see the message on CLI invocation
+        but prowler --help and API calls (which never hit init_global_provider)
+        do not spuriously emit it. The shadow is detected by entry-point name
+        only — the plug-in is never loaded to warn.
+        """
+        import logging
+        import types
+
+        mock_is_builtin.return_value = True
+        shadow_ep = MagicMock()
+        shadow_ep.name = "aws"  # plug-in shadowing the built-in name
+        mock_entry_points.return_value = [shadow_ep]
+
+        fake_module = types.ModuleType("fake_builtin_module")
+        fake_module.AwsProvider = MagicMock(side_effect=lambda **_kw: None)
+        mock_import.return_value = fake_module
+        mock_config.return_value = {}
+
+        args = Namespace(
+            provider="aws",
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+            aws_retries_max_attempts=3,
+            role=None,
+            session_duration=None,
+            external_id=None,
+            role_session_name=None,
+            mfa=None,
+            profile=None,
+            region=None,
+            excluded_region=None,
+            organizations_role=None,
+            scan_unused_services=False,
+            resource_tag=None,
+            resource_arn=None,
+            mutelist_file=None,
+        )
+
+        Provider._global = None
+        with caplog.at_level(logging.WARNING, logger="prowler"):
+            try:
+                Provider.init_global_provider(args)
+            except BaseException:
+                # AwsProvider mock is fake; dispatch may fail — only the
+                # warning emitted BEFORE dispatch matters here.
+                pass
+        Provider._global = None
+
+        collision_warnings = [
+            r.message
+            for r in caplog.records
+            if "Plug-in provider 'aws'" in r.message and "IGNORED" in r.message
+        ]
+        assert collision_warnings, (
+            "init_global_provider must emit the collision warning when a "
+            "same-named EP plug-in exists for a built-in provider"
+        )
+        # Shadow detected by name only — the plug-in is never loaded to warn.
+        shadow_ep.load.assert_not_called()
diff --git a/tests/providers/gcp/gcp_fixtures.py b/tests/providers/gcp/gcp_fixtures.py
index ba6480ee22..1abcaf5bf0 100644
--- a/tests/providers/gcp/gcp_fixtures.py
+++ b/tests/providers/gcp/gcp_fixtures.py
@@ -722,6 +722,7 @@ def mock_api_instances_calls(client: MagicMock, service: str):
                         },
                         "backupConfiguration": {"enabled": True},
                         "databaseFlags": [],
+                        "availabilityType": "REGIONAL",
                     },
                 },
                 {
@@ -737,6 +738,7 @@ def mock_api_instances_calls(client: MagicMock, service: str):
                         },
                         "backupConfiguration": {"enabled": False},
                         "databaseFlags": [],
+                        "availabilityType": "ZONAL",
                     },
                 },
             ]
diff --git a/tests/providers/gcp/gcp_provider_test.py b/tests/providers/gcp/gcp_provider_test.py
index 7d2bea9f88..7b30b828da 100644
--- a/tests/providers/gcp/gcp_provider_test.py
+++ b/tests/providers/gcp/gcp_provider_test.py
@@ -13,6 +13,7 @@ from prowler.config.config import (
 )
 from prowler.providers.common.models import Connection
 from prowler.providers.gcp.exceptions.exceptions import (
+    GCPGetOrganizationProjectsError,
     GCPInvalidProviderIdError,
     GCPNoAccesibleProjectsError,
     GCPTestConnectionError,
@@ -1077,3 +1078,66 @@ class TestGCPProvider:
 
             assert gcp_provider.skip_api_check is True
             mocked_is_api_active.assert_not_called()
+
+    def test_get_projects_organization_id_permission_denied_raises(self):
+        """When --organization-id is set and the Cloud Asset API returns a 403,
+        get_projects must raise GCPGetOrganizationProjectsError instead of
+        silently falling back to the service account's home project.
+
+        Regression test for https://github.com/prowler-cloud/prowler/issues/11250.
+        """
+        from googleapiclient.errors import HttpError
+
+        forbidden_response = MagicMock(status=403, reason="Forbidden")
+        http_error = HttpError(
+            resp=forbidden_response,
+            content=b'{"error": {"code": 403, "message": "Permission denied on resource organization"}}',
+            uri="https://cloudasset.googleapis.com/v1/organizations/123:listAssets",
+        )
+
+        asset_service = MagicMock()
+        asset_service.assets.return_value.list.return_value.execute.side_effect = (
+            http_error
+        )
+
+        with patch(
+            "prowler.providers.gcp.gcp_provider.discovery.build",
+            return_value=asset_service,
+        ):
+            with pytest.raises(GCPGetOrganizationProjectsError):
+                GcpProvider.get_projects(
+                    credentials=MagicMock(),
+                    organization_id="test-organization-id",
+                    credentials_file="test_credentials_file",
+                )
+
+    def test_get_projects_organization_id_cloud_asset_api_disabled_raises(self):
+        """When --organization-id is set and the Cloud Asset API is disabled,
+        get_projects must raise GCPGetOrganizationProjectsError with the
+        enable-API remediation rather than swallowing the error."""
+        from googleapiclient.errors import HttpError
+
+        disabled_response = MagicMock(status=403, reason="Forbidden")
+        http_error = HttpError(
+            resp=disabled_response,
+            content=b'{"error": {"message": "Cloud Asset API has not been used in project 123 before or it is disabled."}}',
+            uri="https://cloudasset.googleapis.com/v1/organizations/123:listAssets",
+        )
+
+        asset_service = MagicMock()
+        asset_service.assets.return_value.list.return_value.execute.side_effect = (
+            http_error
+        )
+
+        with patch(
+            "prowler.providers.gcp.gcp_provider.discovery.build",
+            return_value=asset_service,
+        ):
+            with pytest.raises(GCPGetOrganizationProjectsError) as exc_info:
+                GcpProvider.get_projects(
+                    credentials=MagicMock(),
+                    organization_id="test-organization-id",
+                    credentials_file="test_credentials_file",
+                )
+
+        assert "Cloud Asset API" in str(exc_info.value)
diff --git a/tests/providers/gcp/services/cloudfunction/__init__.py b/tests/providers/gcp/services/cloudfunction/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py
new file mode 100644
index 0000000000..b764760538
--- /dev/null
+++ b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py
@@ -0,0 +1,197 @@
+from unittest import mock
+
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_PROJECT_ID,
+    GCP_US_CENTER1_LOCATION,
+    set_mocked_gcp_provider,
+)
+
+_CHECK_PATH = (
+    "prowler.providers.gcp.services.cloudfunction."
+    "cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc"
+)
+_CLIENT_PATH = f"{_CHECK_PATH}.cloudfunction_client"
+
+
+class Test_cloudfunction_function_inside_vpc:
+    def test_no_functions(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+
+            cloudfunction_client.functions = []
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_function_with_vpc_connector(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            connector = (
+                f"projects/{GCP_PROJECT_ID}/locations/{GCP_US_CENTER1_LOCATION}"
+                f"/connectors/my-connector"
+            )
+            cloudfunction_client.functions = [
+                Function(
+                    name="fn-vpc",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    vpc_connector=connector,
+                )
+            ]
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Cloud Function fn-vpc is connected to a VPC via connector: {connector}."
+            )
+            assert result[0].resource_id == "fn-vpc"
+            assert result[0].resource_name == "fn-vpc"
+            assert result[0].location == GCP_US_CENTER1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_function_without_vpc_connector(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    name="fn-public",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    vpc_connector=None,
+                )
+            ]
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Cloud Function fn-public is not connected to any VPC network."
+            )
+            assert result[0].resource_id == "fn-public"
+            assert result[0].resource_name == "fn-public"
+            assert result[0].location == GCP_US_CENTER1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_function_with_empty_vpc_connector(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    name="fn-empty",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    vpc_connector="",
+                )
+            ]
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+
+    def test_inactive_function_skipped(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    name="fn-deploy",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="DEPLOYING",
+                    vpc_connector=None,
+                )
+            ]
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 0
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
new file mode 100644
index 0000000000..82f77a939f
--- /dev/null
+++ b/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
@@ -0,0 +1,102 @@
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+    CloudFunction,
+)
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_PROJECT_ID,
+    mock_is_api_active,
+    set_mocked_gcp_provider,
+)
+
+_LOCATION_ID = "us-central1"
+_FUNCTION_NAME = "my-function"
+_CONNECTOR = (
+    f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/connectors/my-connector"
+)
+
+
+def _make_cloudfunction_client(functions_list):
+    """Return a mock GCP API client for the Cloud Functions v2 service."""
+    client = MagicMock()
+
+    client.projects().locations().list().execute.return_value = {
+        "locations": [{"locationId": _LOCATION_ID}]
+    }
+    client.projects().locations().list_next.return_value = None
+
+    client.projects().locations().functions().list().execute.return_value = {
+        "functions": functions_list
+    }
+    client.projects().locations().functions().list_next.return_value = None
+
+    return client
+
+
+class TestCloudFunctionService:
+    def test_get_functions_with_vpc_connector(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_cloudfunction_client(
+                functions_list=[
+                    {
+                        "name": f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/functions/{_FUNCTION_NAME}",
+                        "state": "ACTIVE",
+                        "serviceConfig": {
+                            "vpcConnector": _CONNECTOR,
+                        },
+                    }
+                ]
+            )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+        ):
+            cf_client = CloudFunction(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(cf_client.functions) == 1
+            fn = cf_client.functions[0]
+            assert fn.name == _FUNCTION_NAME
+            assert fn.project_id == GCP_PROJECT_ID
+            assert fn.location == _LOCATION_ID
+            assert fn.state == "ACTIVE"
+            assert fn.vpc_connector == _CONNECTOR
+
+    def test_get_functions_without_vpc_connector(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_cloudfunction_client(
+                functions_list=[
+                    {
+                        "name": f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/functions/no-vpc-func",
+                        "state": "ACTIVE",
+                        "serviceConfig": {},
+                    }
+                ]
+            )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+        ):
+            cf_client = CloudFunction(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(cf_client.functions) == 1
+            fn = cf_client.functions[0]
+            assert fn.name == "no-vpc-func"
+            assert fn.vpc_connector is None
diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_cmek_encryption_enabled/__init__.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_cmek_encryption_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled_test.py
new file mode 100644
index 0000000000..82c49fb89e
--- /dev/null
+++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled_test.py
@@ -0,0 +1,205 @@
+from unittest import mock
+
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_EU1_LOCATION,
+    GCP_PROJECT_ID,
+    set_mocked_gcp_provider,
+)
+
+
+class Test_cloudsql_instance_high_availability_enabled:
+    """Tests for the cloudsql_instance_high_availability_enabled check."""
+
+    def test_no_instances(self):
+        """No Cloud SQL instances → no findings."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+
+            cloudsql_client.instances = []
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_instance_ha_enabled(self):
+        """A REGIONAL primary instance → PASS."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+            from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
+                Instance,
+            )
+
+            cloudsql_client.instances = [
+                Instance(
+                    name="db-ha",
+                    version="POSTGRES_15",
+                    ip_addresses=[],
+                    region=GCP_EU1_LOCATION,
+                    public_ip=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
+                    automated_backups=True,
+                    authorized_networks=[],
+                    flags=[],
+                    project_id=GCP_PROJECT_ID,
+                    availability_type="REGIONAL",
+                )
+            ]
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "db-ha"
+            assert result[0].location == GCP_EU1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_instance_ha_disabled(self):
+        """A ZONAL primary instance → FAIL with current availability in status_extended."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+            from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
+                Instance,
+            )
+
+            cloudsql_client.instances = [
+                Instance(
+                    name="db-zonal",
+                    version="POSTGRES_15",
+                    ip_addresses=[],
+                    region=GCP_EU1_LOCATION,
+                    public_ip=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
+                    automated_backups=True,
+                    authorized_networks=[],
+                    flags=[],
+                    project_id=GCP_PROJECT_ID,
+                    availability_type="ZONAL",
+                )
+            ]
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "ZONAL" in result[0].status_extended
+            assert result[0].resource_id == "db-zonal"
+            assert result[0].location == GCP_EU1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_read_replica_skipped(self):
+        """Read replicas (instance_type != CLOUD_SQL_INSTANCE) are skipped."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+            from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
+                Instance,
+            )
+
+            cloudsql_client.instances = [
+                Instance(
+                    name="db-replica",
+                    version="POSTGRES_15",
+                    ip_addresses=[],
+                    region=GCP_EU1_LOCATION,
+                    public_ip=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
+                    automated_backups=True,
+                    authorized_networks=[],
+                    flags=[],
+                    project_id=GCP_PROJECT_ID,
+                    availability_type="ZONAL",
+                    instance_type="READ_REPLICA_INSTANCE",
+                )
+            ]
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_instance_default_availability_type_fails(self):
+        """An instance missing availabilityType defaults to ZONAL (service layer) and must FAIL."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+            from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
+                Instance,
+            )
+
+            cloudsql_client.instances = [
+                Instance(
+                    name="db-default",
+                    version="POSTGRES_15",
+                    ip_addresses=[],
+                    region=GCP_EU1_LOCATION,
+                    public_ip=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
+                    automated_backups=True,
+                    authorized_networks=[],
+                    flags=[],
+                    project_id=GCP_PROJECT_ID,
+                    # availability_type omitted → model default "ZONAL"
+                )
+            ]
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "ZONAL" in result[0].status_extended
diff --git a/tests/providers/gcp/services/iam/iam_service_account_unused/iam_service_account_unused_test.py b/tests/providers/gcp/services/iam/iam_service_account_unused/iam_service_account_unused_test.py
index d76200734d..79c0eb23c3 100644
--- a/tests/providers/gcp/services/iam/iam_service_account_unused/iam_service_account_unused_test.py
+++ b/tests/providers/gcp/services/iam/iam_service_account_unused/iam_service_account_unused_test.py
@@ -179,3 +179,60 @@ class Test_iam_service_account_unused:
             assert result[1].project_id == GCP_PROJECT_ID
             assert result[1].location == GCP_US_CENTER1_LOCATION
             assert result[1].resource == iam_client.service_accounts[1]
+
+    def test_iam_service_account_disabled(self):
+        iam_client = mock.MagicMock()
+        monitoring_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.iam.iam_service_account_unused.iam_service_account_unused.iam_client",
+                new=iam_client,
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.iam.iam_service_account_unused.iam_service_account_unused.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.iam.iam_service import ServiceAccount
+            from prowler.providers.gcp.services.iam.iam_service_account_unused.iam_service_account_unused import (
+                iam_service_account_unused,
+            )
+
+            iam_client.project_ids = [GCP_PROJECT_ID]
+            iam_client.region = GCP_US_CENTER1_LOCATION
+
+            iam_client.service_accounts = [
+                ServiceAccount(
+                    name="projects/my-project/serviceAccounts/disabled-sa@my-project.iam.gserviceaccount.com",
+                    email="disabled-sa@my-project.iam.gserviceaccount.com",
+                    display_name="Disabled service account",
+                    keys=[],
+                    project_id=GCP_PROJECT_ID,
+                    uniqueId="999888877776666",
+                    disabled=True,
+                )
+            ]
+
+            # The account is absent from the usage metrics, so a non-disabled
+            # account here would FAIL. Being disabled must take precedence and
+            # PASS, since a disabled account cannot authenticate or be used.
+            monitoring_client.sa_api_metrics = set()
+            monitoring_client.audit_config = {"max_unused_account_days": 30}
+
+            check = iam_service_account_unused()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Service Account {iam_client.service_accounts[0].email} is disabled and cannot be used."
+            )
+            assert result[0].resource_id == iam_client.service_accounts[0].email
+            assert result[0].project_id == GCP_PROJECT_ID
+            assert result[0].location == GCP_US_CENTER1_LOCATION
+            assert result[0].resource == iam_client.service_accounts[0]
diff --git a/tests/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled_test.py b/tests/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled_test.py
index 5776c858f5..6600921c9f 100644
--- a/tests/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled_test.py
+++ b/tests/providers/gcp/services/kms/kms_key_rotation_enabled/kms_key_rotation_enabled_test.py
@@ -1,4 +1,3 @@
-import datetime
 from unittest import mock
 
 from tests.providers.gcp.gcp_fixtures import (
@@ -34,7 +33,7 @@ class Test_kms_key_rotation_enabled:
             result = check.execute()
             assert len(result) == 0
 
-    def test_kms_key_no_next_rotation_time_and_no_rotation_period(self):
+    def test_kms_key_without_rotation_period(self):
         kms_client = mock.MagicMock()
 
         with (
@@ -86,14 +85,14 @@ class Test_kms_key_rotation_enabled:
             assert result[0].status == "FAIL"
             assert (
                 result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
+                == f"Key {kms_client.crypto_keys[0].name} does not have automatic rotation enabled."
             )
             assert result[0].resource_id == kms_client.crypto_keys[0].id
             assert result[0].resource_name == kms_client.crypto_keys[0].name
             assert result[0].location == kms_client.crypto_keys[0].location
             assert result[0].project_id == kms_client.crypto_keys[0].project_id
 
-    def test_kms_key_no_next_rotation_time_and_big_rotation_period(self):
+    def test_kms_key_with_long_rotation_period(self):
         kms_client = mock.MagicMock()
 
         with (
@@ -135,471 +134,26 @@ class Test_kms_key_rotation_enabled:
                     project_id=GCP_PROJECT_ID,
                     key_ring=keyring.name,
                     location=keylocation.name,
+                    # Rotation period greater than 90 days still counts as enabled
                     rotation_period="8776000s",
                     members=["user:jane@example.com"],
                 )
             ]
 
-            check = kms_key_rotation_enabled()
-            result = check.execute()
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert (
-                result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
-            )
-            assert result[0].resource_id == kms_client.crypto_keys[0].id
-            assert result[0].resource_name == kms_client.crypto_keys[0].name
-            assert result[0].location == kms_client.crypto_keys[0].location
-            assert result[0].project_id == kms_client.crypto_keys[0].project_id
-
-    def test_kms_key_no_next_rotation_time_and_appropriate_rotation_period(self):
-        kms_client = mock.MagicMock()
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=set_mocked_gcp_provider(),
-            ),
-            mock.patch(
-                "prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled.kms_client",
-                new=kms_client,
-            ),
-        ):
-            from prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled import (
-                kms_key_rotation_enabled,
-            )
-            from prowler.providers.gcp.services.kms.kms_service import (
-                CriptoKey,
-                KeyLocation,
-                KeyRing,
-            )
-
-            kms_client.project_ids = [GCP_PROJECT_ID]
-            kms_client.region = GCP_US_CENTER1_LOCATION
-
-            keyring = KeyRing(
-                name="projects/123/locations/us-central1/keyRings/keyring1",
-                project_id=GCP_PROJECT_ID,
-            )
-
-            keylocation = KeyLocation(
-                name=GCP_US_CENTER1_LOCATION,
-                project_id=GCP_PROJECT_ID,
-            )
-
-            kms_client.crypto_keys = [
-                CriptoKey(
-                    name="key1",
-                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
-                    project_id=GCP_PROJECT_ID,
-                    key_ring=keyring.name,
-                    location=keylocation.name,
-                    rotation_period="7776000s",
-                    members=["user:jane@example.com"],
-                )
-            ]
-
-            check = kms_key_rotation_enabled()
-            result = check.execute()
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert (
-                result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is rotated every 90 days or less but the next rotation time is in more than 90 days."
-            )
-            assert result[0].resource_id == kms_client.crypto_keys[0].id
-            assert result[0].resource_name == kms_client.crypto_keys[0].name
-            assert result[0].location == kms_client.crypto_keys[0].location
-            assert result[0].project_id == kms_client.crypto_keys[0].project_id
-
-    def test_kms_key_no_rotation_period_and_big_next_rotation_time(self):
-        kms_client = mock.MagicMock()
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=set_mocked_gcp_provider(),
-            ),
-            mock.patch(
-                "prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled.kms_client",
-                new=kms_client,
-            ),
-        ):
-            from prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled import (
-                kms_key_rotation_enabled,
-            )
-            from prowler.providers.gcp.services.kms.kms_service import (
-                CriptoKey,
-                KeyLocation,
-                KeyRing,
-            )
-
-            kms_client.project_ids = [GCP_PROJECT_ID]
-            kms_client.region = GCP_US_CENTER1_LOCATION
-
-            keyring = KeyRing(
-                name="projects/123/locations/us-central1/keyRings/keyring1",
-                project_id=GCP_PROJECT_ID,
-            )
-
-            keylocation = KeyLocation(
-                name=GCP_US_CENTER1_LOCATION,
-                project_id=GCP_PROJECT_ID,
-            )
-
-            kms_client.crypto_keys = [
-                CriptoKey(
-                    name="key1",
-                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
-                    project_id=GCP_PROJECT_ID,
-                    key_ring=keyring.name,
-                    location=keylocation.name,
-                    # Next rotation time of now + 100 days
-                    next_rotation_time=(
-                        datetime.datetime.now() - datetime.timedelta(days=+100)
-                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
-                    members=["user:jane@example.com"],
-                )
-            ]
-
-            check = kms_key_rotation_enabled()
-            result = check.execute()
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert (
-                result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
-            )
-            assert result[0].resource_id == kms_client.crypto_keys[0].id
-            assert result[0].resource_name == kms_client.crypto_keys[0].name
-            assert result[0].location == kms_client.crypto_keys[0].location
-            assert result[0].project_id == kms_client.crypto_keys[0].project_id
-
-    def test_kms_key_no_rotation_period_and_appropriate_next_rotation_time(self):
-        kms_client = mock.MagicMock()
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=set_mocked_gcp_provider(),
-            ),
-            mock.patch(
-                "prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled.kms_client",
-                new=kms_client,
-            ),
-        ):
-            from prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled import (
-                kms_key_rotation_enabled,
-            )
-            from prowler.providers.gcp.services.kms.kms_service import (
-                CriptoKey,
-                KeyLocation,
-                KeyRing,
-            )
-
-            kms_client.project_ids = [GCP_PROJECT_ID]
-            kms_client.region = GCP_US_CENTER1_LOCATION
-
-            keyring = KeyRing(
-                name="projects/123/locations/us-central1/keyRings/keyring1",
-                project_id=GCP_PROJECT_ID,
-            )
-
-            keylocation = KeyLocation(
-                name=GCP_US_CENTER1_LOCATION,
-                project_id=GCP_PROJECT_ID,
-            )
-
-            kms_client.crypto_keys = [
-                CriptoKey(
-                    name="key1",
-                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
-                    project_id=GCP_PROJECT_ID,
-                    key_ring=keyring.name,
-                    location=keylocation.name,
-                    # Next rotation time of now + 30 days
-                    next_rotation_time=(
-                        datetime.datetime.now() - datetime.timedelta(days=+30)
-                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
-                    members=["user:jane@example.com"],
-                )
-            ]
-
-            check = kms_key_rotation_enabled()
-            result = check.execute()
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert (
-                result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less but the next rotation time is in less than 90 days."
-            )
-            assert result[0].resource_id == kms_client.crypto_keys[0].id
-            assert result[0].resource_name == kms_client.crypto_keys[0].name
-            assert result[0].location == kms_client.crypto_keys[0].location
-            assert result[0].project_id == kms_client.crypto_keys[0].project_id
-
-    def test_kms_key_rotation_period_greater_90_days_and_big_next_rotation_time(self):
-        kms_client = mock.MagicMock()
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=set_mocked_gcp_provider(),
-            ),
-            mock.patch(
-                "prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled.kms_client",
-                new=kms_client,
-            ),
-        ):
-            from prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled import (
-                kms_key_rotation_enabled,
-            )
-            from prowler.providers.gcp.services.kms.kms_service import (
-                CriptoKey,
-                KeyLocation,
-                KeyRing,
-            )
-
-            kms_client.project_ids = [GCP_PROJECT_ID]
-            kms_client.region = GCP_US_CENTER1_LOCATION
-
-            keyring = KeyRing(
-                name="projects/123/locations/us-central1/keyRings/keyring1",
-                project_id=GCP_PROJECT_ID,
-            )
-
-            keylocation = KeyLocation(
-                name=GCP_US_CENTER1_LOCATION,
-                project_id=GCP_PROJECT_ID,
-            )
-
-            kms_client.crypto_keys = [
-                CriptoKey(
-                    name="key1",
-                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
-                    project_id=GCP_PROJECT_ID,
-                    rotation_period="8776000s",
-                    # Next rotation time of now + 100 days
-                    next_rotation_time=(
-                        datetime.datetime.now() - datetime.timedelta(days=+100)
-                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
-                    key_ring=keyring.name,
-                    location=keylocation.name,
-                    members=["user:jane@example.com"],
-                )
-            ]
-
-            check = kms_key_rotation_enabled()
-            result = check.execute()
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert (
-                result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
-            )
-            assert result[0].resource_id == kms_client.crypto_keys[0].id
-            assert result[0].resource_name == kms_client.crypto_keys[0].name
-            assert result[0].location == kms_client.crypto_keys[0].location
-            assert result[0].project_id == kms_client.crypto_keys[0].project_id
-
-    def test_kms_key_rotation_period_greater_90_days_and_appropriate_next_rotation_time(
-        self,
-    ):
-        kms_client = mock.MagicMock()
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=set_mocked_gcp_provider(),
-            ),
-            mock.patch(
-                "prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled.kms_client",
-                new=kms_client,
-            ),
-        ):
-            from prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled import (
-                kms_key_rotation_enabled,
-            )
-            from prowler.providers.gcp.services.kms.kms_service import (
-                CriptoKey,
-                KeyLocation,
-                KeyRing,
-            )
-
-            kms_client.project_ids = [GCP_PROJECT_ID]
-            kms_client.region = GCP_US_CENTER1_LOCATION
-
-            keyring = KeyRing(
-                name="projects/123/locations/us-central1/keyRings/keyring1",
-                project_id=GCP_PROJECT_ID,
-            )
-
-            keylocation = KeyLocation(
-                name=GCP_US_CENTER1_LOCATION,
-                project_id=GCP_PROJECT_ID,
-            )
-
-            kms_client.crypto_keys = [
-                CriptoKey(
-                    name="key1",
-                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
-                    project_id=GCP_PROJECT_ID,
-                    rotation_period="8776000s",
-                    # Next rotation time of now + 30 days
-                    next_rotation_time=(
-                        datetime.datetime.now() - datetime.timedelta(days=+30)
-                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
-                    key_ring=keyring.name,
-                    location=keylocation.name,
-                    members=["user:jane@example.com"],
-                )
-            ]
-
-            check = kms_key_rotation_enabled()
-            result = check.execute()
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert (
-                result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less but the next rotation time is in less than 90 days."
-            )
-            assert result[0].resource_id == kms_client.crypto_keys[0].id
-            assert result[0].resource_name == kms_client.crypto_keys[0].name
-            assert result[0].location == kms_client.crypto_keys[0].location
-            assert result[0].project_id == kms_client.crypto_keys[0].project_id
-
-    def test_kms_key_rotation_period_less_90_days_and_big_next_rotation_time(self):
-        kms_client = mock.MagicMock()
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=set_mocked_gcp_provider(),
-            ),
-            mock.patch(
-                "prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled.kms_client",
-                new=kms_client,
-            ),
-        ):
-            from prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled import (
-                kms_key_rotation_enabled,
-            )
-            from prowler.providers.gcp.services.kms.kms_service import (
-                CriptoKey,
-                KeyLocation,
-                KeyRing,
-            )
-
-            kms_client.project_ids = [GCP_PROJECT_ID]
-            kms_client.region = GCP_US_CENTER1_LOCATION
-
-            keyring = KeyRing(
-                name="projects/123/locations/us-central1/keyRings/keyring1",
-                project_id=GCP_PROJECT_ID,
-            )
-
-            keylocation = KeyLocation(
-                name=GCP_US_CENTER1_LOCATION,
-                project_id=GCP_PROJECT_ID,
-            )
-
-            kms_client.crypto_keys = [
-                CriptoKey(
-                    name="key1",
-                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
-                    project_id=GCP_PROJECT_ID,
-                    rotation_period="7776000s",
-                    # Next rotation time of now + 100 days
-                    next_rotation_time=(
-                        datetime.datetime.now() - datetime.timedelta(days=+100)
-                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
-                    key_ring=keyring.name,
-                    location=keylocation.name,
-                    members=["user:jane@example.com"],
-                )
-            ]
-
-            check = kms_key_rotation_enabled()
-            result = check.execute()
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert (
-                result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is rotated every 90 days or less but the next rotation time is in more than 90 days."
-            )
-            assert result[0].resource_id == kms_client.crypto_keys[0].id
-            assert result[0].resource_name == kms_client.crypto_keys[0].name
-            assert result[0].location == kms_client.crypto_keys[0].location
-            assert result[0].project_id == kms_client.crypto_keys[0].project_id
-
-    def test_kms_key_rotation_period_less_90_days_and_appropriate_next_rotation_time(
-        self,
-    ):
-        kms_client = mock.MagicMock()
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=set_mocked_gcp_provider(),
-            ),
-            mock.patch(
-                "prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled.kms_client",
-                new=kms_client,
-            ),
-        ):
-            from prowler.providers.gcp.services.kms.kms_key_rotation_enabled.kms_key_rotation_enabled import (
-                kms_key_rotation_enabled,
-            )
-            from prowler.providers.gcp.services.kms.kms_service import (
-                CriptoKey,
-                KeyLocation,
-                KeyRing,
-            )
-
-            kms_client.project_ids = [GCP_PROJECT_ID]
-            kms_client.region = GCP_US_CENTER1_LOCATION
-
-            keyring = KeyRing(
-                name="projects/123/locations/us-central1/keyRings/keyring1",
-                project_id=GCP_PROJECT_ID,
-            )
-
-            keylocation = KeyLocation(
-                name=GCP_US_CENTER1_LOCATION,
-                project_id=GCP_PROJECT_ID,
-            )
-
-            kms_client.crypto_keys = [
-                CriptoKey(
-                    name="key1",
-                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
-                    project_id=GCP_PROJECT_ID,
-                    rotation_period="7776000s",
-                    # Next rotation time of now + 30 days
-                    next_rotation_time=(
-                        datetime.datetime.now() - datetime.timedelta(days=+30)
-                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
-                    key_ring=keyring.name,
-                    location=keylocation.name,
-                    members=["user:jane@example.com"],
-                )
-            ]
-
             check = kms_key_rotation_enabled()
             result = check.execute()
             assert len(result) == 1
             assert result[0].status == "PASS"
             assert (
                 result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is rotated every 90 days or less and the next rotation time is in less than 90 days."
+                == f"Key {kms_client.crypto_keys[0].name} has automatic rotation enabled."
             )
             assert result[0].resource_id == kms_client.crypto_keys[0].id
             assert result[0].resource_name == kms_client.crypto_keys[0].name
             assert result[0].location == kms_client.crypto_keys[0].location
             assert result[0].project_id == kms_client.crypto_keys[0].project_id
 
-    def test_kms_key_rotation_with_fractional_seconds(self):
+    def test_kms_key_with_short_rotation_period(self):
         kms_client = mock.MagicMock()
 
         with (
@@ -639,13 +193,9 @@ class Test_kms_key_rotation_enabled:
                     name="key1",
                     id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
                     project_id=GCP_PROJECT_ID,
-                    rotation_period="7776000s",
-                    # Next rotation time of now + 100 days
-                    next_rotation_time=(
-                        datetime.datetime.now() - datetime.timedelta(days=+100)
-                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
                     key_ring=keyring.name,
                     location=keylocation.name,
+                    rotation_period="7776000s",
                     members=["user:jane@example.com"],
                 )
             ]
@@ -653,10 +203,10 @@ class Test_kms_key_rotation_enabled:
             check = kms_key_rotation_enabled()
             result = check.execute()
             assert len(result) == 1
-            assert result[0].status == "FAIL"
+            assert result[0].status == "PASS"
             assert (
                 result[0].status_extended
-                == f"Key {kms_client.crypto_keys[0].name} is rotated every 90 days or less but the next rotation time is in more than 90 days."
+                == f"Key {kms_client.crypto_keys[0].name} has automatic rotation enabled."
             )
             assert result[0].resource_id == kms_client.crypto_keys[0].id
             assert result[0].resource_name == kms_client.crypto_keys[0].name
diff --git a/tests/providers/gcp/services/kms/kms_key_rotation_max_90_days/kms_key_rotation_max_90_days_test.py b/tests/providers/gcp/services/kms/kms_key_rotation_max_90_days/kms_key_rotation_max_90_days_test.py
new file mode 100644
index 0000000000..e200b9674d
--- /dev/null
+++ b/tests/providers/gcp/services/kms/kms_key_rotation_max_90_days/kms_key_rotation_max_90_days_test.py
@@ -0,0 +1,728 @@
+import datetime
+from unittest import mock
+
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_PROJECT_ID,
+    GCP_US_CENTER1_LOCATION,
+    set_mocked_gcp_provider,
+)
+
+
+class Test_kms_key_rotation_max_90_days:
+    def test_kms_no_key(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+            kms_client.crypto_keys = []
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_kms_key_no_next_rotation_time_and_no_rotation_period(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_no_next_rotation_time_and_big_rotation_period(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    rotation_period="8776000s",
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_no_next_rotation_time_and_appropriate_rotation_period(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    rotation_period="7776000s",
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is rotated every 90 days or less but the next rotation time is in more than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_no_rotation_period_and_big_next_rotation_time(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    # Next rotation time of now + 100 days
+                    next_rotation_time=(
+                        datetime.datetime.now() - datetime.timedelta(days=+100)
+                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_no_rotation_period_and_appropriate_next_rotation_time(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    # Next rotation time of now + 30 days
+                    next_rotation_time=(
+                        datetime.datetime.now() - datetime.timedelta(days=+30)
+                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less but the next rotation time is in less than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_rotation_period_greater_90_days_and_big_next_rotation_time(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    rotation_period="8776000s",
+                    # Next rotation time of now + 100 days
+                    next_rotation_time=(
+                        datetime.datetime.now() - datetime.timedelta(days=+100)
+                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less and the next rotation time is in more than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_rotation_period_greater_90_days_and_appropriate_next_rotation_time(
+        self,
+    ):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    rotation_period="8776000s",
+                    # Next rotation time of now + 30 days
+                    next_rotation_time=(
+                        datetime.datetime.now() - datetime.timedelta(days=+30)
+                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is not rotated every 90 days or less but the next rotation time is in less than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_rotation_period_less_90_days_and_big_next_rotation_time(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    rotation_period="7776000s",
+                    # Next rotation time of now + 100 days
+                    next_rotation_time=(
+                        datetime.datetime.now() - datetime.timedelta(days=+100)
+                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is rotated every 90 days or less but the next rotation time is in more than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_rotation_period_less_90_days_and_appropriate_next_rotation_time(
+        self,
+    ):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    rotation_period="7776000s",
+                    # Next rotation time of now + 30 days
+                    next_rotation_time=(
+                        datetime.datetime.now() - datetime.timedelta(days=+30)
+                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is rotated every 90 days or less and the next rotation time is in less than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_rotation_with_fractional_seconds(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    rotation_period="7776000s",
+                    # Next rotation time of now + 100 days
+                    next_rotation_time=(
+                        datetime.datetime.now() - datetime.timedelta(days=+100)
+                    ).strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is rotated every 90 days or less but the next rotation time is in more than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
+
+    def test_kms_key_next_rotation_time_without_fractional_seconds(self):
+        kms_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days.kms_client",
+                new=kms_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.kms.kms_key_rotation_max_90_days.kms_key_rotation_max_90_days import (
+                kms_key_rotation_max_90_days,
+            )
+            from prowler.providers.gcp.services.kms.kms_service import (
+                CriptoKey,
+                KeyLocation,
+                KeyRing,
+            )
+
+            kms_client.project_ids = [GCP_PROJECT_ID]
+            kms_client.region = GCP_US_CENTER1_LOCATION
+
+            keyring = KeyRing(
+                name="projects/123/locations/us-central1/keyRings/keyring1",
+                project_id=GCP_PROJECT_ID,
+            )
+
+            keylocation = KeyLocation(
+                name=GCP_US_CENTER1_LOCATION,
+                project_id=GCP_PROJECT_ID,
+            )
+
+            kms_client.crypto_keys = [
+                CriptoKey(
+                    name="key1",
+                    id="projects/123/locations/us-central1/keyRings/keyring1/cryptoKeys/key1",
+                    project_id=GCP_PROJECT_ID,
+                    rotation_period="7776000s",
+                    # Next rotation time without fractional seconds, within 90 days
+                    next_rotation_time=(
+                        datetime.datetime.now() - datetime.timedelta(days=30)
+                    ).strftime("%Y-%m-%dT%H:%M:%SZ"),
+                    key_ring=keyring.name,
+                    location=keylocation.name,
+                    members=["user:jane@example.com"],
+                )
+            ]
+
+            check = kms_key_rotation_max_90_days()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Key {kms_client.crypto_keys[0].name} is rotated every 90 days or less and the next rotation time is in less than 90 days."
+            )
+            assert result[0].resource_id == kms_client.crypto_keys[0].id
+            assert result[0].resource_name == kms_client.crypto_keys[0].name
+            assert result[0].location == kms_client.crypto_keys[0].location
+            assert result[0].project_id == kms_client.crypto_keys[0].project_id
diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled_test.py
index a38f97d81c..c0dc6b0a06 100644
--- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled_test.py
+++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled_test.py
@@ -259,3 +259,176 @@ class Test_logging_log_metric_filter_and_alert_for_audit_configuration_changes_e
             assert result[0].resource_name == "metric_name"
             assert result[0].project_id == GCP_PROJECT_ID
             assert result[0].location == GCP_EU1_LOCATION
+
+    def test_project_centrally_covered_via_org_aggregated_sink(self):
+        """A child project with NO local metric, but whose org has an aggregated
+        sink (includeChildren=True) routing its logs to a central bucket that has
+        a bucket-scoped metric + alert, should PASS (covered centrally) instead of
+        being falsely failed."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+            from prowler.providers.gcp.services.monitoring.monitoring_service import (
+                AlertPolicy,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            # Bucket-scoped central metric, in the scanned logging project.
+            logging_client.metrics = [
+                Metric(
+                    name="central-audit-config-metric",
+                    type="logging.googleapis.com/user/central-audit-config-metric",
+                    filter='protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:*',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            # Org-level aggregated sink routing the child's logs to that bucket.
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-audit-config-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+
+            check = (
+                logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            assert any(
+                r.project_id == GCP_PROJECT_ID
+                and r.status == "PASS"
+                and "aggregated sink" in r.status_extended
+                for r in result
+            ), [(r.project_id, r.status, r.status_extended) for r in result]
+
+    def test_aggregated_sink_metric_without_alert_still_fails(self):
+        """Guard: an org aggregated sink + a bucket-scoped metric matching the filter
+        but with NO alert must NOT credit the child project — it should still FAIL."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:*',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = []  # no alert -> must NOT credit
+
+            check = (
+                logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            child = [r for r in result if r.project_id == GCP_PROJECT_ID]
+            assert child and all(r.status == "FAIL" for r in child), [
+                (r.project_id, r.status) for r in result
+            ]
diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled_test.py
index e2b7b2d068..e9eeabf430 100644
--- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled_test.py
+++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled/logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled_test.py
@@ -397,3 +397,173 @@ class Test_logging_log_metric_filter_and_alert_for_bucket_permission_changes_ena
             assert result[0].resource_name == "GCP Project"
             assert result[0].project_id == GCP_PROJECT_ID
             assert result[0].location == GCP_EU1_LOCATION
+
+    def test_project_centrally_covered_via_org_aggregated_sink(self):
+        """A child project with NO local metric, but whose org has an aggregated
+        sink (includeChildren=True) routing its logs to a central bucket that has
+        a bucket-scoped metric + alert, should PASS (covered centrally)."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+            from prowler.providers.gcp.services.monitoring.monitoring_service import (
+                AlertPolicy,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="gcs_bucket" AND protoPayload.methodName="storage.setIamPermissions"',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+
+            check = (
+                logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled()
+            )
+            result = check.execute()
+
+            assert any(
+                r.project_id == GCP_PROJECT_ID
+                and r.status == "PASS"
+                and "aggregated sink" in r.status_extended
+                for r in result
+            ), [(r.project_id, r.status, r.status_extended) for r in result]
+
+    def test_aggregated_sink_metric_without_alert_still_fails(self):
+        """Guard: an org aggregated sink + a bucket-scoped metric matching the filter
+        but with NO alert must NOT credit the child project — it should still FAIL."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled.logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="gcs_bucket" AND protoPayload.methodName="storage.setIamPermissions"',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = []  # no alert -> must NOT credit
+
+            check = (
+                logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled()
+            )
+            result = check.execute()
+
+            child = [r for r in result if r.project_id == GCP_PROJECT_ID]
+            assert child and all(r.status == "FAIL" for r in child), [
+                (r.project_id, r.status) for r in result
+            ]
diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled_test.py
index 563b4e49ac..5347e3e42e 100644
--- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled_test.py
+++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled_test.py
@@ -346,3 +346,173 @@ class Test_logging_log_metric_filter_and_alert_for_compute_configuration_changes
             fail_result = [r for r in result if r.status == "FAIL"][0]
             assert fail_result.project_id == project_id_2
             assert "no log metric filters" in fail_result.status_extended
+
+    def test_project_centrally_covered_via_org_aggregated_sink(self):
+        """A child project with NO local metric, but whose org has an aggregated
+        sink (includeChildren=True) routing its logs to a central bucket that has
+        a bucket-scoped metric + alert, should PASS (covered centrally)."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+            from prowler.providers.gcp.services.monitoring.monitoring_service import (
+                AlertPolicy,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='protoPayload.serviceName="compute.googleapis.com"',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+
+            check = (
+                logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            assert any(
+                r.project_id == GCP_PROJECT_ID
+                and r.status == "PASS"
+                and "aggregated sink" in r.status_extended
+                for r in result
+            ), [(r.project_id, r.status, r.status_extended) for r in result]
+
+    def test_aggregated_sink_metric_without_alert_still_fails(self):
+        """Guard: an org aggregated sink + a bucket-scoped metric matching the filter
+        but with NO alert must NOT credit the child project — it should still FAIL."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='protoPayload.serviceName="compute.googleapis.com"',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = []  # no alert -> must NOT credit
+
+            check = (
+                logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            child = [r for r in result if r.project_id == GCP_PROJECT_ID]
+            assert child and all(r.status == "FAIL" for r in child), [
+                (r.project_id, r.status) for r in result
+            ]
diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled_test.py
index 4ec94be657..18d1807255 100644
--- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled_test.py
+++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled/logging_log_metric_filter_and_alert_for_custom_role_changes_enabled_test.py
@@ -259,3 +259,173 @@ class Test_logging_log_metric_filter_and_alert_for_custom_role_changes_enabled:
             assert result[0].resource_name == "metric_name"
             assert result[0].project_id == GCP_PROJECT_ID
             assert result[0].location == GCP_EU1_LOCATION
+
+    def test_project_centrally_covered_via_org_aggregated_sink(self):
+        """A child project with NO local metric, but whose org has an aggregated
+        sink (includeChildren=True) routing its logs to a central bucket that has
+        a bucket-scoped metric + alert, should PASS (covered centrally)."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_custom_role_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+            from prowler.providers.gcp.services.monitoring.monitoring_service import (
+                AlertPolicy,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="iam_role" AND (protoPayload.methodName="google.iam.admin.v1.CreateRole" OR protoPayload.methodName="google.iam.admin.v1.DeleteRole" OR protoPayload.methodName="google.iam.admin.v1.UpdateRole")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+
+            check = (
+                logging_log_metric_filter_and_alert_for_custom_role_changes_enabled()
+            )
+            result = check.execute()
+
+            assert any(
+                r.project_id == GCP_PROJECT_ID
+                and r.status == "PASS"
+                and "aggregated sink" in r.status_extended
+                for r in result
+            ), [(r.project_id, r.status, r.status_extended) for r in result]
+
+    def test_aggregated_sink_metric_without_alert_still_fails(self):
+        """Guard: an org aggregated sink + a bucket-scoped metric matching the filter
+        but with NO alert must NOT credit the child project — it should still FAIL."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled.logging_log_metric_filter_and_alert_for_custom_role_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_custom_role_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="iam_role" AND (protoPayload.methodName="google.iam.admin.v1.CreateRole" OR protoPayload.methodName="google.iam.admin.v1.DeleteRole" OR protoPayload.methodName="google.iam.admin.v1.UpdateRole")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = []  # no alert -> must NOT credit
+
+            check = (
+                logging_log_metric_filter_and_alert_for_custom_role_changes_enabled()
+            )
+            result = check.execute()
+
+            child = [r for r in result if r.project_id == GCP_PROJECT_ID]
+            assert child and all(r.status == "FAIL" for r in child), [
+                (r.project_id, r.status) for r in result
+            ]
diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled_test.py
index 0ea0798e03..3adb48e567 100644
--- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled_test.py
+++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled/logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled_test.py
@@ -392,3 +392,173 @@ class Test_logging_log_metric_filter_and_alert_for_project_ownership_changes_ena
             assert result[0].resource_name == "GCP Project"
             assert result[0].project_id == GCP_PROJECT_ID
             assert result[0].location == GCP_EU1_LOCATION
+
+    def test_project_centrally_covered_via_org_aggregated_sink(self):
+        """A child project with NO local metric, but whose org has an aggregated
+        sink (includeChildren=True) routing its logs to a central bucket that has
+        a bucket-scoped metric + alert, should PASS (covered centrally)."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+            from prowler.providers.gcp.services.monitoring.monitoring_service import (
+                AlertPolicy,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='(protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner") OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+
+            check = (
+                logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled()
+            )
+            result = check.execute()
+
+            assert any(
+                r.project_id == GCP_PROJECT_ID
+                and r.status == "PASS"
+                and "aggregated sink" in r.status_extended
+                for r in result
+            ), [(r.project_id, r.status, r.status_extended) for r in result]
+
+    def test_aggregated_sink_metric_without_alert_still_fails(self):
+        """Guard: an org aggregated sink + a bucket-scoped metric matching the filter
+        but with NO alert must NOT credit the child project — it should still FAIL."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled.logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='(protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner") OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = []  # no alert -> must NOT credit
+
+            check = (
+                logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled()
+            )
+            result = check.execute()
+
+            child = [r for r in result if r.project_id == GCP_PROJECT_ID]
+            assert child and all(r.status == "FAIL" for r in child), [
+                (r.project_id, r.status) for r in result
+            ]
diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled_test.py
index 1a8a1d0da3..9444f0cc61 100644
--- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled_test.py
+++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled_test.py
@@ -259,3 +259,173 @@ class Test_logging_log_metric_filter_and_alert_for_sql_instance_configuration_ch
             assert result[0].resource_name == "metric_name"
             assert result[0].project_id == GCP_PROJECT_ID
             assert result[0].location == GCP_EU1_LOCATION
+
+    def test_project_centrally_covered_via_org_aggregated_sink(self):
+        """A child project with NO local metric, but whose org has an aggregated
+        sink (includeChildren=True) routing its logs to a central bucket that has
+        a bucket-scoped metric + alert, should PASS (covered centrally)."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+            from prowler.providers.gcp.services.monitoring.monitoring_service import (
+                AlertPolicy,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='protoPayload.methodName="cloudsql.instances.update"',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+
+            check = (
+                logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            assert any(
+                r.project_id == GCP_PROJECT_ID
+                and r.status == "PASS"
+                and "aggregated sink" in r.status_extended
+                for r in result
+            ), [(r.project_id, r.status, r.status_extended) for r in result]
+
+    def test_aggregated_sink_metric_without_alert_still_fails(self):
+        """Guard: an org aggregated sink + a bucket-scoped metric matching the filter
+        but with NO alert must NOT credit the child project — it should still FAIL."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='protoPayload.methodName="cloudsql.instances.update"',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = []  # no alert -> must NOT credit
+
+            check = (
+                logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            child = [r for r in result if r.project_id == GCP_PROJECT_ID]
+            assert child and all(r.status == "FAIL" for r in child), [
+                (r.project_id, r.status) for r in result
+            ]
diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled_test.py
index a9460e6b46..3d34a3c295 100644
--- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled_test.py
+++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled_test.py
@@ -259,3 +259,173 @@ class Test_logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_ena
             assert result[0].resource_name == "metric_name"
             assert result[0].project_id == GCP_PROJECT_ID
             assert result[0].location == GCP_EU1_LOCATION
+
+    def test_project_centrally_covered_via_org_aggregated_sink(self):
+        """A child project with NO local metric, but whose org has an aggregated
+        sink (includeChildren=True) routing its logs to a central bucket that has
+        a bucket-scoped metric + alert, should PASS (covered centrally)."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+            from prowler.providers.gcp.services.monitoring.monitoring_service import (
+                AlertPolicy,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="gce_firewall_rule" AND (protoPayload.methodName:"compute.firewalls.patch" OR protoPayload.methodName:"compute.firewalls.insert" OR protoPayload.methodName:"compute.firewalls.delete")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+
+            check = (
+                logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled()
+            )
+            result = check.execute()
+
+            assert any(
+                r.project_id == GCP_PROJECT_ID
+                and r.status == "PASS"
+                and "aggregated sink" in r.status_extended
+                for r in result
+            ), [(r.project_id, r.status, r.status_extended) for r in result]
+
+    def test_aggregated_sink_metric_without_alert_still_fails(self):
+        """Guard: an org aggregated sink + a bucket-scoped metric matching the filter
+        but with NO alert must NOT credit the child project — it should still FAIL."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="gce_firewall_rule" AND (protoPayload.methodName:"compute.firewalls.patch" OR protoPayload.methodName:"compute.firewalls.insert" OR protoPayload.methodName:"compute.firewalls.delete")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = []  # no alert -> must NOT credit
+
+            check = (
+                logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled()
+            )
+            result = check.execute()
+
+            child = [r for r in result if r.project_id == GCP_PROJECT_ID]
+            assert child and all(r.status == "FAIL" for r in child), [
+                (r.project_id, r.status) for r in result
+            ]
diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled_test.py
index 9c59d56a81..a71a21ceb6 100644
--- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled_test.py
+++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled_test.py
@@ -259,3 +259,173 @@ class Test_logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled:
             assert result[0].resource_name == "metric_name"
             assert result[0].project_id == GCP_PROJECT_ID
             assert result[0].location == GCP_EU1_LOCATION
+
+    def test_project_centrally_covered_via_org_aggregated_sink(self):
+        """A child project with NO local metric, but whose org has an aggregated
+        sink (includeChildren=True) routing its logs to a central bucket that has
+        a bucket-scoped metric + alert, should PASS (covered centrally)."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+            from prowler.providers.gcp.services.monitoring.monitoring_service import (
+                AlertPolicy,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="gce_network" AND (protoPayload.methodName:"compute.networks.insert" OR protoPayload.methodName:"compute.networks.patch" OR protoPayload.methodName:"compute.networks.delete" OR protoPayload.methodName:"compute.networks.removePeering" OR protoPayload.methodName:"compute.networks.addPeering")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+
+            check = (
+                logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled()
+            )
+            result = check.execute()
+
+            assert any(
+                r.project_id == GCP_PROJECT_ID
+                and r.status == "PASS"
+                and "aggregated sink" in r.status_extended
+                for r in result
+            ), [(r.project_id, r.status, r.status_extended) for r in result]
+
+    def test_aggregated_sink_metric_without_alert_still_fails(self):
+        """Guard: an org aggregated sink + a bucket-scoped metric matching the filter
+        but with NO alert must NOT credit the child project — it should still FAIL."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="gce_network" AND (protoPayload.methodName:"compute.networks.insert" OR protoPayload.methodName:"compute.networks.patch" OR protoPayload.methodName:"compute.networks.delete" OR protoPayload.methodName:"compute.networks.removePeering" OR protoPayload.methodName:"compute.networks.addPeering")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = []  # no alert -> must NOT credit
+
+            check = (
+                logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled()
+            )
+            result = check.execute()
+
+            child = [r for r in result if r.project_id == GCP_PROJECT_ID]
+            assert child and all(r.status == "FAIL" for r in child), [
+                (r.project_id, r.status) for r in result
+            ]
diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled_test.py
index 254c41bb5f..3a7f41a485 100644
--- a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled_test.py
+++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled/logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled_test.py
@@ -259,3 +259,173 @@ class Test_logging_log_metric_filter_and_alert_for_vpc_network_route_changes_ena
             assert result[0].resource_name == "metric_name"
             assert result[0].project_id == GCP_PROJECT_ID
             assert result[0].location == GCP_EU1_LOCATION
+
+    def test_project_centrally_covered_via_org_aggregated_sink(self):
+        """A child project with NO local metric, but whose org has an aggregated
+        sink (includeChildren=True) routing its logs to a central bucket that has
+        a bucket-scoped metric + alert, should PASS (covered centrally)."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+            from prowler.providers.gcp.services.monitoring.monitoring_service import (
+                AlertPolicy,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="gce_route" AND (protoPayload.methodName:"compute.routes.delete" OR protoPayload.methodName:"compute.routes.insert")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+
+            check = (
+                logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled()
+            )
+            result = check.execute()
+
+            assert any(
+                r.project_id == GCP_PROJECT_ID
+                and r.status == "PASS"
+                and "aggregated sink" in r.status_extended
+                for r in result
+            ), [(r.project_id, r.status, r.status_extended) for r in result]
+
+    def test_aggregated_sink_metric_without_alert_still_fails(self):
+        """Guard: an org aggregated sink + a bucket-scoped metric matching the filter
+        but with NO alert must NOT credit the child project — it should still FAIL."""
+        logging_client = MagicMock()
+        monitoring_client = MagicMock()
+        org_id = "111222333"
+        central_bucket = (
+            "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.logging_client",
+                new=logging_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.monitoring_client",
+                new=monitoring_client,
+            ),
+        ):
+            from prowler.providers.gcp.models import GCPOrganization, GCPProject
+            from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled.logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled import (
+                logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled,
+            )
+            from prowler.providers.gcp.services.logging.logging_service import (
+                Metric,
+                Sink,
+            )
+
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.project_ids = [GCP_PROJECT_ID, "central-logging-project"]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="child",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+            logging_client.metrics = [
+                Metric(
+                    name="central-metric",
+                    type="logging.googleapis.com/user/central-metric",
+                    filter='resource.type="gce_route" AND (protoPayload.methodName:"compute.routes.delete" OR protoPayload.methodName:"compute.routes.insert")',
+                    project_id="central-logging-project",
+                    bucket_name=central_bucket,
+                )
+            ]
+            logging_client.sinks = [
+                Sink(
+                    name="org-aggregated-sink",
+                    destination=f"logging.googleapis.com/{central_bucket}",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            monitoring_client.alert_policies = []  # no alert -> must NOT credit
+
+            check = (
+                logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled()
+            )
+            result = check.execute()
+
+            child = [r for r in result if r.project_id == GCP_PROJECT_ID]
+            assert child and all(r.status == "FAIL" for r in child), [
+                (r.project_id, r.status) for r in result
+            ]
diff --git a/tests/providers/gcp/services/logging/logging_service_test.py b/tests/providers/gcp/services/logging/logging_service_test.py
index 0396130c2f..e466a17314 100644
--- a/tests/providers/gcp/services/logging/logging_service_test.py
+++ b/tests/providers/gcp/services/logging/logging_service_test.py
@@ -1,4 +1,6 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
+
+import pytest
 
 from prowler.providers.gcp.services.logging.logging_service import Logging
 from tests.providers.gcp.gcp_fixtures import (
@@ -66,3 +68,324 @@ class TestLoggingService:
                 == "resource.type=gae_app AND severity>=ERROR"
             )
             assert logging_client.metrics[1].project_id == GCP_PROJECT_ID
+
+    def test_org_sinks_fetched_when_project_has_organization(self):
+        """_get_org_sinks() appends org-level sinks when projects have an org."""
+        from prowler.providers.gcp.models import GCPOrganization, GCPProject
+
+        org_id = "999888777"
+        provider = set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+        provider.projects = {
+            GCP_PROJECT_ID: GCPProject(
+                id=GCP_PROJECT_ID,
+                number="123456789012",
+                name="test",
+                labels={},
+                lifecycle_state="ACTIVE",
+                organization=GCPOrganization(id=org_id, name=f"organizations/{org_id}"),
+            )
+        }
+
+        mock_client = MagicMock()
+        mock_client.sinks().list().execute.return_value = {
+            "sinks": [
+                {
+                    "name": "org-sink",
+                    "destination": "storage.googleapis.com/org-bucket",
+                    "filter": "all",
+                    "includeChildren": True,
+                }
+            ]
+        }
+        mock_client.sinks().list_next.return_value = None
+        mock_client.projects().metrics().list().execute.return_value = {"metrics": []}
+        mock_client.projects().metrics().list_next.return_value = None
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                return_value=mock_client,
+            ),
+        ):
+            logging_svc = Logging(provider)
+
+        org_sinks = [
+            s for s in logging_svc.sinks if s.project_id == f"organizations/{org_id}"
+        ]
+        assert len(org_sinks) == 1
+        assert org_sinks[0].name == "org-sink"
+        assert org_sinks[0].include_children is True
+        assert org_sinks[0].filter == "all"
+
+    def test_org_sinks_skipped_when_no_organization(self):
+        """_get_org_sinks() adds nothing when projects have no organization."""
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+        ):
+            logging_svc = Logging(set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID]))
+
+        org_sinks = [
+            s for s in logging_svc.sinks if s.project_id.startswith("organizations/")
+        ]
+        assert org_sinks == []
+
+    def test_get_metrics_populates_bucket_name(self):
+        """_get_metrics() captures a metric's bucketName (for aggregated-sink crediting)."""
+        bucket = "projects/central-logging-project/locations/eu/buckets/central-bucket"
+        mock_client = MagicMock()
+        mock_client.sinks().list().execute.return_value = {"sinks": []}
+        mock_client.sinks().list_next.return_value = None
+        mock_client.projects().metrics().list().execute.return_value = {
+            "metrics": [
+                {
+                    "name": "central-metric",
+                    "metricDescriptor": {
+                        "type": "logging.googleapis.com/user/central-metric"
+                    },
+                    "filter": "severity>=ERROR",
+                    "bucketName": bucket,
+                }
+            ]
+        }
+        mock_client.projects().metrics().list_next.return_value = None
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                return_value=mock_client,
+            ),
+        ):
+            logging_svc = Logging(set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID]))
+
+        metrics = [m for m in logging_svc.metrics if m.name == "central-metric"]
+        assert len(metrics) == 1
+        assert metrics[0].bucket_name == bucket
+
+
+class TestGetProjectsCoveredByAggregatedMetric:
+    """Unit tests for the aggregated-sink crediting helper: one positive case and the
+    guards that must NOT credit a project (so the metric-filter checks never false-pass).
+    """
+
+    FILTER = 'protoPayload.methodName="SetIamPolicy"'
+    ORG = "111222333"
+    BUCKET = "projects/central-logging-project/locations/eu/buckets/central-bucket"
+
+    def _clients(
+        self,
+        *,
+        include_children=True,
+        bucket_name=None,
+        sink_destination=None,
+        sink_filter="all",
+        with_alert=True,
+        project_org_id=None,
+    ):
+        from prowler.providers.gcp.models import GCPOrganization, GCPProject
+        from prowler.providers.gcp.services.logging.logging_service import Metric, Sink
+        from prowler.providers.gcp.services.monitoring.monitoring_service import (
+            AlertPolicy,
+        )
+
+        bucket_name = self.BUCKET if bucket_name is None else bucket_name
+        sink_destination = (
+            f"logging.googleapis.com/{self.BUCKET}"
+            if sink_destination is None
+            else sink_destination
+        )
+        project_org_id = self.ORG if project_org_id is None else project_org_id
+
+        logging_client = MagicMock()
+        logging_client.project_ids = [GCP_PROJECT_ID]
+        logging_client.projects = {
+            GCP_PROJECT_ID: GCPProject(
+                id=GCP_PROJECT_ID,
+                number="123456789012",
+                name="child",
+                labels={},
+                lifecycle_state="ACTIVE",
+                organization=GCPOrganization(
+                    id=project_org_id, name=f"organizations/{project_org_id}"
+                ),
+            )
+        }
+        logging_client.metrics = [
+            Metric(
+                name="central-metric",
+                type="logging.googleapis.com/user/central-metric",
+                filter=self.FILTER,
+                project_id="central-logging-project",
+                bucket_name=bucket_name,
+            )
+        ]
+        logging_client.sinks = [
+            Sink(
+                name="org-sink",
+                destination=sink_destination,
+                filter=sink_filter,
+                project_id=f"organizations/{self.ORG}",
+                include_children=include_children,
+            )
+        ]
+        monitoring_client = MagicMock()
+        monitoring_client.alert_policies = (
+            [
+                AlertPolicy(
+                    name="projects/central-logging-project/alertPolicies/ap",
+                    display_name="central-alert",
+                    enabled=True,
+                    filters=[
+                        'metric.type = "logging.googleapis.com/user/central-metric"'
+                    ],
+                    project_id="central-logging-project",
+                )
+            ]
+            if with_alert
+            else []
+        )
+        return logging_client, monitoring_client
+
+    def _run(self, logging_client, monitoring_client):
+        from prowler.providers.gcp.services.logging.logging_service import (
+            get_projects_covered_by_aggregated_metric,
+        )
+
+        return get_projects_covered_by_aggregated_metric(
+            logging_client, monitoring_client, self.FILTER
+        )
+
+    def test_covered_when_all_conditions_met(self):
+        logging_client, monitoring_client = self._clients()
+        assert self._run(logging_client, monitoring_client) == {
+            GCP_PROJECT_ID: "central-metric"
+        }
+
+    def test_not_covered_without_alert(self):
+        logging_client, monitoring_client = self._clients(with_alert=False)
+        assert self._run(logging_client, monitoring_client) == {}
+
+    def test_not_covered_when_metric_not_bucket_scoped(self):
+        logging_client, monitoring_client = self._clients(bucket_name="")
+        assert self._run(logging_client, monitoring_client) == {}
+
+    def test_not_covered_when_sink_not_include_children(self):
+        logging_client, monitoring_client = self._clients(include_children=False)
+        assert self._run(logging_client, monitoring_client) == {}
+
+    def test_not_covered_when_sink_filter_is_restrictive(self):
+        logging_client, monitoring_client = self._clients(
+            sink_filter='resource.type="gce_instance"'
+        )
+        assert self._run(logging_client, monitoring_client) == {}
+
+    def test_not_covered_when_sink_filter_omits_activity_stream(self):
+        """A sink that routes cloudaudit streams but NOT Admin Activity (here,
+        data_access only) does not deliver the entries the CIS metric filters
+        match, so it must not be credited — right service, wrong stream."""
+        logging_client, monitoring_client = self._clients(
+            sink_filter="logName: /logs/cloudaudit.googleapis.com%2Fdata_access"
+        )
+        assert self._run(logging_client, monitoring_client) == {}
+
+    def test_covered_when_sink_filter_carries_activity_stream_encoded(self):
+        """A sink filtered to the cloudaudit streams (URL-encoded logName form,
+        as returned by the Logging API) delivers every Admin Activity entry the
+        CIS metric filters can match, so it must be credited."""
+        logging_client, monitoring_client = self._clients(
+            sink_filter=(
+                "logName: /logs/cloudaudit.googleapis.com%2Factivity OR "
+                "logName: /logs/cloudaudit.googleapis.com%2Fdata_access"
+            )
+        )
+        assert self._run(logging_client, monitoring_client) == {
+            GCP_PROJECT_ID: "central-metric"
+        }
+
+    def test_covered_when_sink_filter_carries_activity_stream_plain(self):
+        logging_client, monitoring_client = self._clients(
+            sink_filter='logName="projects/p/logs/cloudaudit.googleapis.com/activity"'
+        )
+        assert self._run(logging_client, monitoring_client) == {
+            GCP_PROJECT_ID: "central-metric"
+        }
+
+    @pytest.mark.parametrize(
+        "sink_filter",
+        [
+            # --- Negation: the stream is named but excluded. ---
+            'NOT logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity"',
+            '-logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity"',
+            'NOT log_id("cloudaudit.googleapis.com/activity")',
+            # "!=" inequality (and its spaced form) excludes the stream.
+            'logName!="projects/p/logs/cloudaudit.googleapis.com%2Factivity"',
+            'logName != "projects/p/logs/cloudaudit.googleapis.com/activity"',
+            # Activity negated inside a compound filter.
+            'resource.type="gce_instance" AND '
+            'NOT logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity"',
+            # --- Restriction: the stream is named but AND-narrowed, so only a
+            # subset of Admin Activity entries reaches the bucket. ---
+            'logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity" '
+            'AND resource.type="gce_instance"',
+            'log_id("cloudaudit.googleapis.com/activity") '
+            'AND resource.type="gce_instance"',
+            'logName="projects/p/logs/cloudaudit.googleapis.com/activity" '
+            "AND severity>=ERROR",
+            'logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity" '
+            'AND protoPayload.methodName="SetIamPolicy"',
+            # --- OR-ed with a non-audit predicate: fail closed, since we credit
+            # only unions of provable Cloud Audit stream selectors. ---
+            'logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity" '
+            "OR severity>=ERROR",
+        ],
+    )
+    def test_not_covered_when_sink_filter_negated_or_restrictive(self, sink_filter):
+        """A filter that names the Admin Activity stream but negates, narrows, or
+        mixes in an unprovable predicate is not credited — we credit only filters
+        we can prove deliver every Admin Activity entry the CIS metrics match."""
+        logging_client, monitoring_client = self._clients(sink_filter=sink_filter)
+        assert self._run(logging_client, monitoring_client) == {}
+
+    def test_covered_when_activity_logname_has_hyphenated_path(self):
+        """A hyphen in the project path must not be mistaken for the ``-`` (NOT)
+        negation operator — the activity stream is still delivered."""
+        logging_client, monitoring_client = self._clients(
+            sink_filter='logName="projects/my-project/logs/cloudaudit.googleapis.com/activity"'
+        )
+        assert self._run(logging_client, monitoring_client) == {
+            GCP_PROJECT_ID: "central-metric"
+        }
+
+    def test_covered_when_sink_filter_uses_log_id_selector(self):
+        """The ``log_id()`` form is an equivalent positive full-coverage selector
+        of the Admin Activity stream and is credited like the ``logName`` form."""
+        logging_client, monitoring_client = self._clients(
+            sink_filter='log_id("cloudaudit.googleapis.com/activity")'
+        )
+        assert self._run(logging_client, monitoring_client) == {
+            GCP_PROJECT_ID: "central-metric"
+        }
+
+    def test_not_covered_when_sink_destination_bucket_differs(self):
+        logging_client, monitoring_client = self._clients(
+            sink_destination="logging.googleapis.com/projects/x/locations/eu/buckets/other"
+        )
+        assert self._run(logging_client, monitoring_client) == {}
+
+    def test_not_covered_when_project_org_differs(self):
+        logging_client, monitoring_client = self._clients(project_org_id="999999999")
+        assert self._run(logging_client, monitoring_client) == {}
diff --git a/tests/providers/gcp/services/logging/logging_sink_created/logging_sink_created_test.py b/tests/providers/gcp/services/logging/logging_sink_created/logging_sink_created_test.py
index b9c6481d22..6ced615f65 100644
--- a/tests/providers/gcp/services/logging/logging_sink_created/logging_sink_created_test.py
+++ b/tests/providers/gcp/services/logging/logging_sink_created/logging_sink_created_test.py
@@ -1,6 +1,6 @@
 from unittest.mock import MagicMock, patch
 
-from prowler.providers.gcp.models import GCPProject
+from prowler.providers.gcp.models import GCPOrganization, GCPProject
 from tests.providers.gcp.gcp_fixtures import (
     GCP_EU1_LOCATION,
     GCP_PROJECT_ID,
@@ -268,6 +268,7 @@ class Test_logging_sink_created:
             sink.name = None
             sink.filter = "all"
             sink.project_id = GCP_PROJECT_ID
+            sink.include_children = False
 
             logging_client.project_ids = [GCP_PROJECT_ID]
             logging_client.region = GCP_EU1_LOCATION
@@ -311,9 +312,10 @@ class Test_logging_sink_created:
             )
 
             # Create a MagicMock sink object without name attribute
-            sink = MagicMock(spec=["filter", "project_id"])
+            sink = MagicMock(spec=["filter", "project_id", "include_children"])
             sink.filter = "all"
             sink.project_id = GCP_PROJECT_ID
+            sink.include_children = False
 
             logging_client.project_ids = [GCP_PROJECT_ID]
             logging_client.region = GCP_EU1_LOCATION
@@ -336,3 +338,175 @@ class Test_logging_sink_created:
             assert result[0].resource_id == "unknown"
             assert result[0].project_id == GCP_PROJECT_ID
             assert result[0].location == GCP_EU1_LOCATION
+
+    def test_org_level_sink_with_include_children_passes(self):
+        """Projects covered by an org-level sink with includeChildren=True should PASS."""
+        logging_client = MagicMock()
+        org_id = "111222333"
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created.logging_client",
+                new=logging_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.logging.logging_service import Sink
+            from prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created import (
+                logging_sink_created,
+            )
+
+            logging_client.project_ids = [GCP_PROJECT_ID]
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.sinks = [
+                Sink(
+                    name="org-sink",
+                    destination="storage.googleapis.com/org-bucket",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                )
+            ]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="test",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+
+            check = logging_sink_created()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Sink org-sink at organization level is exporting copies of all the log entries in project {GCP_PROJECT_ID}."
+            )
+            assert result[0].resource_id == "org-sink"
+            assert result[0].project_id == GCP_PROJECT_ID
+            assert result[0].location == GCP_EU1_LOCATION
+
+    def test_org_level_sink_without_include_children_fails(self):
+        """Projects NOT covered by includeChildren should still FAIL if no direct project sink."""
+        logging_client = MagicMock()
+        org_id = "111222333"
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created.logging_client",
+                new=logging_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.logging.logging_service import Sink
+            from prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created import (
+                logging_sink_created,
+            )
+
+            logging_client.project_ids = [GCP_PROJECT_ID]
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.sinks = [
+                Sink(
+                    name="org-sink-no-children",
+                    destination="storage.googleapis.com/org-bucket",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=False,
+                )
+            ]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="test",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+
+            check = logging_sink_created()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"There are no logging sinks to export copies of all the log entries in project {GCP_PROJECT_ID}."
+            )
+            assert result[0].resource_id == GCP_PROJECT_ID
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_project_sink_takes_precedence_over_org_sink(self):
+        """A direct project sink should be reported even when an org-level sink also covers the project."""
+        logging_client = MagicMock()
+        org_id = "111222333"
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            patch(
+                "prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created.logging_client",
+                new=logging_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.logging.logging_service import Sink
+            from prowler.providers.gcp.services.logging.logging_sink_created.logging_sink_created import (
+                logging_sink_created,
+            )
+
+            logging_client.project_ids = [GCP_PROJECT_ID]
+            logging_client.region = GCP_EU1_LOCATION
+            logging_client.sinks = [
+                Sink(
+                    name="project-sink",
+                    destination="storage.googleapis.com/project-bucket",
+                    filter="all",
+                    project_id=GCP_PROJECT_ID,
+                ),
+                Sink(
+                    name="org-sink",
+                    destination="storage.googleapis.com/org-bucket",
+                    filter="all",
+                    project_id=f"organizations/{org_id}",
+                    include_children=True,
+                ),
+            ]
+            logging_client.projects = {
+                GCP_PROJECT_ID: GCPProject(
+                    id=GCP_PROJECT_ID,
+                    number="123456789012",
+                    name="test",
+                    labels={},
+                    lifecycle_state="ACTIVE",
+                    organization=GCPOrganization(
+                        id=org_id, name=f"organizations/{org_id}"
+                    ),
+                )
+            }
+
+            check = logging_sink_created()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Sink project-sink is enabled exporting copies of all the log entries in project {GCP_PROJECT_ID}."
+            )
+            assert result[0].resource_id == "project-sink"
+            assert result[0].project_id == GCP_PROJECT_ID
diff --git a/tests/providers/m365/services/admincenter/admincenter_service_test.py b/tests/providers/m365/services/admincenter/admincenter_service_test.py
index ce0a2a3050..4eedba05e1 100644
--- a/tests/providers/m365/services/admincenter/admincenter_service_test.py
+++ b/tests/providers/m365/services/admincenter/admincenter_service_test.py
@@ -252,3 +252,49 @@ def test_admincenter__get_groups_maps_group_types():
     assert groups["id-2"].group_types == []
     assert groups["id-3"].group_types == []
     assert groups["id-3"].visibility == "Public"
+
+
+def test_admincenter__get_groups_handles_pagination():
+    admincenter_service = AdminCenter.__new__(AdminCenter)
+
+    groups_response_page_one = SimpleNamespace(
+        value=[
+            SimpleNamespace(
+                id="id-1",
+                display_name="First Unified Group",
+                visibility="Private",
+                group_types=["Unified"],
+            )
+        ],
+        odata_next_link="next-link",
+    )
+    groups_response_page_two = SimpleNamespace(
+        value=[
+            SimpleNamespace(
+                id="id-2",
+                display_name="Second Unified Group",
+                visibility="Public",
+                group_types=["Unified"],
+            )
+        ],
+        odata_next_link=None,
+    )
+
+    groups_with_url_builder = SimpleNamespace(
+        get=AsyncMock(return_value=groups_response_page_two)
+    )
+    with_url_mock = MagicMock(return_value=groups_with_url_builder)
+    groups_builder = SimpleNamespace(
+        get=AsyncMock(return_value=groups_response_page_one),
+        with_url=with_url_mock,
+    )
+    admincenter_service.client = SimpleNamespace(groups=groups_builder)
+
+    groups = asyncio.run(admincenter_service._get_groups())
+
+    assert len(groups) == 2
+    assert groups_builder.get.await_count == 1
+    with_url_mock.assert_called_once_with("next-link")
+    assert groups["id-1"].name == "First Unified Group"
+    assert groups["id-2"].name == "Second Unified Group"
+    assert groups["id-2"].visibility == "Public"
diff --git a/tests/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references_test.py b/tests/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references_test.py
new file mode 100644
index 0000000000..6d3e7786cf
--- /dev/null
+++ b/tests/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references_test.py
@@ -0,0 +1,466 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.m365.services.entra.entra_service import (
+    ApplicationsConditions,
+    ConditionalAccessPolicy,
+    ConditionalAccessPolicyState,
+    Conditions,
+    GrantControlOperator,
+    GrantControls,
+    PersistentBrowser,
+    SessionControls,
+    SignInFrequency,
+    UsersConditions,
+)
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+def _make_policy(
+    *,
+    display_name="Test Policy",
+    state=ConditionalAccessPolicyState.ENABLED,
+    included_users=None,
+    excluded_users=None,
+    included_groups=None,
+    excluded_groups=None,
+    included_roles=None,
+    excluded_roles=None,
+):
+    """Build a ConditionalAccessPolicy with the minimum fields required by the model."""
+    policy_id = str(uuid4())
+    policy = ConditionalAccessPolicy(
+        id=policy_id,
+        display_name=display_name,
+        conditions=Conditions(
+            application_conditions=ApplicationsConditions(
+                included_applications=[],
+                excluded_applications=[],
+                included_user_actions=[],
+            ),
+            user_conditions=UsersConditions(
+                included_users=included_users or [],
+                excluded_users=excluded_users or [],
+                included_groups=included_groups or [],
+                excluded_groups=excluded_groups or [],
+                included_roles=included_roles or [],
+                excluded_roles=excluded_roles or [],
+            ),
+            client_app_types=[],
+        ),
+        grant_controls=GrantControls(
+            built_in_controls=[],
+            operator=GrantControlOperator.OR,
+            authentication_strength=None,
+        ),
+        session_controls=SessionControls(
+            persistent_browser=PersistentBrowser(is_enabled=False, mode=""),
+            sign_in_frequency=SignInFrequency(
+                is_enabled=False, frequency=None, type=None, interval=None
+            ),
+        ),
+        state=state,
+    )
+    return policy_id, policy
+
+
+def _entra_client_mock():
+    client = mock.MagicMock()
+    client.audited_tenant = "audited_tenant"
+    client.audited_domain = DOMAIN
+    # Default to clean resolution; individual tests override as needed.
+    client.unresolved_directory_object_references = set()
+    client.errored_directory_object_references = set()
+    return client
+
+
+CHECK_MODULE = (
+    "prowler.providers.m365.services.entra."
+    "entra_conditional_access_policy_no_deleted_object_references."
+    "entra_conditional_access_policy_no_deleted_object_references.entra_client"
+)
+
+
+class Test_entra_conditional_access_policy_no_deleted_object_references:
+    def test_no_policies(self):
+        """No Conditional Access policies in tenant: no findings."""
+        entra_client = _entra_client_mock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {}
+            entra_client.unresolved_directory_object_references = set()
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_sentinel_only_references_pass(self):
+        """Policy with only sentinel values ('All', 'GuestsOrExternalUsers') passes."""
+        entra_client = _entra_client_mock()
+        policy_id, policy = _make_policy(
+            display_name="MFA For All",
+            included_users=["All"],
+            excluded_users=["GuestsOrExternalUsers"],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = set()
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                "references no deleted directory objects" in result[0].status_extended
+            )
+            assert result[0].resource_id == policy_id
+            assert result[0].resource_name == "MFA For All"
+
+    def test_all_references_resolve_pass(self):
+        """Policy with real identifiers, none in the unresolved set: PASS."""
+        entra_client = _entra_client_mock()
+        live_user = str(uuid4())
+        live_group = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Targeted Policy",
+            included_users=[live_user],
+            included_groups=[live_group],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = set()
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_deleted_user_in_include_fails(self):
+        """Policy referencing a deleted user in includeUsers fails with type+side reported."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Require MFA",
+            included_users=[deleted_user],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "1 deleted directory object(s)" in result[0].status_extended
+            assert "users:" in result[0].status_extended
+            assert deleted_user in result[0].status_extended
+            assert "(include)" in result[0].status_extended
+
+    def test_deleted_group_in_exclude_fails(self):
+        """Policy referencing a deleted group in excludeGroups fails with exclude side reported."""
+        entra_client = _entra_client_mock()
+        deleted_group = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Block Legacy Auth",
+            included_users=["All"],
+            excluded_groups=[deleted_group],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("group", deleted_group)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "groups:" in result[0].status_extended
+            assert "(exclude)" in result[0].status_extended
+
+    def test_deleted_role_in_disabled_policy_still_fails(self):
+        """Disabled policy with a stale role reference still FAILs (per spec)."""
+        entra_client = _entra_client_mock()
+        deleted_role = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Legacy Admin Policy",
+            state=ConditionalAccessPolicyState.DISABLED,
+            included_roles=[deleted_role],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("role", deleted_role)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "roles:" in result[0].status_extended
+            assert deleted_role in result[0].status_extended
+
+    def test_orphans_grouped_by_type_across_collections(self):
+        """A single policy with orphans of every type aggregates them grouped by type."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+        deleted_group = str(uuid4())
+        deleted_role = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Composite Policy",
+            included_users=[deleted_user],
+            excluded_groups=[deleted_group],
+            included_roles=[deleted_role],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user),
+                ("group", deleted_group),
+                ("role", deleted_role),
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "3 deleted directory object(s)" in result[0].status_extended
+            assert "users:" in result[0].status_extended
+            assert "groups:" in result[0].status_extended
+            assert "roles:" in result[0].status_extended
+
+    def test_report_only_policy_failure_notes_mode(self):
+        """A report-only policy with an orphan FAILs and flags the not-yet-enforced state."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Report Only MFA",
+            state=ConditionalAccessPolicyState.ENABLED_FOR_REPORTING,
+            included_users=[deleted_user],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "report-only mode" in result[0].status_extended
+
+    def test_unverified_reference_is_manual(self):
+        """A reference that errored (non-404) yields MANUAL, not PASS."""
+        entra_client = _entra_client_mock()
+        errored_group = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Throttled Lookup Policy",
+            included_users=["All"],
+            excluded_groups=[errored_group],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = set()
+            entra_client.errored_directory_object_references = {
+                ("group", errored_group)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "MANUAL"
+            assert "could not be fully evaluated" in result[0].status_extended
+            assert errored_group in result[0].status_extended
+
+    def test_orphan_takes_precedence_over_unverified(self):
+        """A confirmed deletion FAILs even when another reference is unverified."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+        errored_group = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Mixed Policy",
+            included_users=[deleted_user],
+            excluded_groups=[errored_group],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user)
+            }
+            entra_client.errored_directory_object_references = {
+                ("group", errored_group)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "1 deleted directory object(s)" in result[0].status_extended
+            assert "could not be verified" in result[0].status_extended
+
+    def test_multiple_policies_mixed(self):
+        """Two policies: one clean, one with an orphan. Distinct PASS/FAIL findings."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+
+        clean_id, clean_policy = _make_policy(
+            display_name="Clean Policy",
+            included_users=["All"],
+        )
+        dirty_id, dirty_policy = _make_policy(
+            display_name="Stale Reference Policy",
+            excluded_users=[deleted_user],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {
+                clean_id: clean_policy,
+                dirty_id: dirty_policy,
+            }
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 2
+
+            clean_result = next(r for r in result if r.resource_id == clean_id)
+            dirty_result = next(r for r in result if r.resource_id == dirty_id)
+
+            assert clean_result.status == "PASS"
+            assert dirty_result.status == "FAIL"
+            assert "(exclude)" in dirty_result.status_extended
diff --git a/tests/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked_test.py b/tests/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked_test.py
new file mode 100644
index 0000000000..6c8696da55
--- /dev/null
+++ b/tests/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked_test.py
@@ -0,0 +1,339 @@
+from unittest import mock
+
+from prowler.providers.m365.services.entra.entra_service import (
+    DirectorySyncSettings,
+    Organization,
+)
+from tests.providers.m365.m365_fixtures import set_mocked_m365_provider
+
+CHECK_MODULE = (
+    "prowler.providers.m365.services.entra."
+    "entra_directory_sync_object_takeover_blocked."
+    "entra_directory_sync_object_takeover_blocked"
+)
+
+
+def _hybrid_org():
+    return Organization(
+        id="org-001",
+        name="Hybrid Org",
+        on_premises_sync_enabled=True,
+    )
+
+
+def _cloud_only_org():
+    return Organization(
+        id="org-001",
+        name="Cloud Only Org",
+        on_premises_sync_enabled=False,
+    )
+
+
+class Test_entra_directory_sync_object_takeover_blocked:
+    def test_both_blocks_enabled(self):
+        """PASS when both soft-match and hard-match blocks are enabled."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="sync-001",
+                    block_soft_match_enabled=True,
+                    block_cloud_object_takeover_through_hard_match_enabled=True,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "blocks both soft-match and hard-match" in result[0].status_extended
+
+    def test_soft_match_disabled(self):
+        """FAIL when soft-match block is disabled on a hybrid tenant."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="sync-001",
+                    block_soft_match_enabled=False,
+                    block_cloud_object_takeover_through_hard_match_enabled=True,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "blockSoftMatchEnabled" in result[0].status_extended
+
+    def test_hard_match_disabled(self):
+        """FAIL when hard-match block is disabled on a hybrid tenant."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="sync-001",
+                    block_soft_match_enabled=True,
+                    block_cloud_object_takeover_through_hard_match_enabled=False,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                "blockCloudObjectTakeoverThroughHardMatchEnabled"
+                in result[0].status_extended
+            )
+
+    def test_both_blocks_disabled(self):
+        """FAIL when both blocks are disabled on a hybrid tenant."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="sync-001",
+                    block_soft_match_enabled=False,
+                    block_cloud_object_takeover_through_hard_match_enabled=False,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "blockSoftMatchEnabled" in result[0].status_extended
+            assert (
+                "blockCloudObjectTakeoverThroughHardMatchEnabled"
+                in result[0].status_extended
+            )
+
+    def test_cloud_only_tenant(self):
+        """PASS when tenant is cloud-only and no sync object is returned."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = []
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_cloud_only_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "cloud-only" in result[0].status_extended
+
+    def test_cloud_only_tenant_with_sync_object_returned(self):
+        """PASS for cloud-only tenants even when Graph returns a sync object.
+
+        Microsoft Graph returns an onPremisesSynchronization object (with all
+        features disabled) for cloud-only tenants. The check must not treat the
+        disabled flags as a FAIL when on-premises sync is not enabled.
+        """
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="tenant-id",
+                    password_sync_enabled=False,
+                    seamless_sso_enabled=False,
+                    block_soft_match_enabled=False,
+                    block_cloud_object_takeover_through_hard_match_enabled=False,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_cloud_only_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "cloud-only" in result[0].status_extended
+
+    def test_permission_error_hybrid(self):
+        """MANUAL when permissions are insufficient for a hybrid tenant."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = []
+            entra_client.directory_sync_error = "Insufficient privileges"
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "MANUAL"
+            assert "Cannot verify" in result[0].status_extended
+            assert "Insufficient privileges" in result[0].status_extended
+
+    def test_permission_error_cloud_only(self):
+        """PASS when settings cannot be read but the tenant is cloud-only."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = []
+            entra_client.directory_sync_error = "Insufficient privileges"
+            entra_client.organizations = [_cloud_only_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "cloud-only" in result[0].status_extended
+
+    def test_hybrid_no_settings_returned(self):
+        """MANUAL when a hybrid tenant returns no directory sync settings."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = []
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "MANUAL"
+            assert (
+                "no directory sync settings were returned" in result[0].status_extended
+            )
diff --git a/tests/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/entra_service_principal_privileged_role_no_owners_test.py b/tests/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/entra_service_principal_privileged_role_no_owners_test.py
new file mode 100644
index 0000000000..e62f9eaa08
--- /dev/null
+++ b/tests/providers/m365/services/entra/entra_service_principal_privileged_role_no_owners/entra_service_principal_privileged_role_no_owners_test.py
@@ -0,0 +1,299 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.m365.services.entra.entra_service import ServicePrincipal
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+GLOBAL_ADMIN_ROLE = "62e90394-69f5-4237-9190-012177145e10"
+PRIV_ROLE_ADMIN = "e8611ab8-c189-46e8-94e1-60213ab1f814"
+
+
+class Test_entra_service_principal_privileged_role_no_owners:
+    """Tests for the entra_service_principal_privileged_role_no_owners check."""
+
+    def test_no_service_principals(self):
+        """No service principals configured: expected no findings."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners import (
+                entra_service_principal_privileged_role_no_owners,
+            )
+
+            entra_client.service_principals = {}
+
+            check = entra_service_principal_privileged_role_no_owners()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_service_principal_no_tier0_roles(self):
+        """Service principal without Tier 0 roles: expected PASS."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        sp_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners import (
+                entra_service_principal_privileged_role_no_owners,
+            )
+
+            entra_client.service_principals = {
+                sp_id: ServicePrincipal(
+                    id=sp_id,
+                    name="NonPrivilegedApp",
+                    app_id=str(uuid4()),
+                    directory_role_template_ids=[],
+                    sp_owner_ids=[],
+                    app_owner_ids=[],
+                )
+            }
+
+            check = entra_service_principal_privileged_role_no_owners()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == sp_id
+            assert result[0].resource_name == "NonPrivilegedApp"
+            assert (
+                "no permanent Tier 0 directory role assignments"
+                in result[0].status_extended
+            )
+
+    def test_service_principal_tier0_no_owners(self):
+        """Privileged SP with no owners on SP or app: expected PASS."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        sp_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners import (
+                entra_service_principal_privileged_role_no_owners,
+            )
+
+            entra_client.service_principals = {
+                sp_id: ServicePrincipal(
+                    id=sp_id,
+                    name="SecureApp",
+                    app_id=str(uuid4()),
+                    directory_role_template_ids=[GLOBAL_ADMIN_ROLE],
+                    sp_owner_ids=[],
+                    app_owner_ids=[],
+                )
+            }
+
+            check = entra_service_principal_privileged_role_no_owners()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == sp_id
+            assert result[0].resource_name == "SecureApp"
+            assert "no owners" in result[0].status_extended
+
+    def test_service_principal_tier0_with_sp_owners(self):
+        """Privileged SP with owners on SP only: expected FAIL."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        sp_id = str(uuid4())
+        owner_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners import (
+                entra_service_principal_privileged_role_no_owners,
+            )
+
+            entra_client.service_principals = {
+                sp_id: ServicePrincipal(
+                    id=sp_id,
+                    name="RiskyApp",
+                    app_id=str(uuid4()),
+                    directory_role_template_ids=[GLOBAL_ADMIN_ROLE],
+                    sp_owner_ids=[owner_id],
+                    app_owner_ids=[],
+                )
+            }
+
+            check = entra_service_principal_privileged_role_no_owners()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == sp_id
+            assert "1 owner(s)" in result[0].status_extended
+            assert "1 on the service principal" in result[0].status_extended
+            assert "0 on the parent app registration" in result[0].status_extended
+
+    def test_service_principal_tier0_with_app_owners(self):
+        """Privileged SP with owners on parent app only: expected FAIL."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        sp_id = str(uuid4())
+        app_owner_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners import (
+                entra_service_principal_privileged_role_no_owners,
+            )
+
+            entra_client.service_principals = {
+                sp_id: ServicePrincipal(
+                    id=sp_id,
+                    name="AppRegOwnerRisk",
+                    app_id=str(uuid4()),
+                    directory_role_template_ids=[GLOBAL_ADMIN_ROLE],
+                    sp_owner_ids=[],
+                    app_owner_ids=[app_owner_id],
+                )
+            }
+
+            check = entra_service_principal_privileged_role_no_owners()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "1 owner(s)" in result[0].status_extended
+            assert "0 on the service principal" in result[0].status_extended
+            assert "1 on the parent app registration" in result[0].status_extended
+
+    def test_service_principal_tier0_with_both_owners(self):
+        """Privileged SP with distinct owners on both SP and app: expected FAIL."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        sp_id = str(uuid4())
+        sp_owner_id = str(uuid4())
+        app_owner_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners import (
+                entra_service_principal_privileged_role_no_owners,
+            )
+
+            entra_client.service_principals = {
+                sp_id: ServicePrincipal(
+                    id=sp_id,
+                    name="HighRiskApp",
+                    app_id=str(uuid4()),
+                    directory_role_template_ids=[GLOBAL_ADMIN_ROLE, PRIV_ROLE_ADMIN],
+                    sp_owner_ids=[sp_owner_id],
+                    app_owner_ids=[app_owner_id],
+                )
+            }
+
+            check = entra_service_principal_privileged_role_no_owners()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "2 permanent Tier 0 directory role(s)" in result[0].status_extended
+            assert "2 owner(s)" in result[0].status_extended
+
+    def test_service_principal_tier0_same_owner_on_sp_and_app(self):
+        """Same principal owns both SP and parent app: owner count deduplicated."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+
+        sp_id = str(uuid4())
+        shared_owner_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_service_principal_privileged_role_no_owners.entra_service_principal_privileged_role_no_owners import (
+                entra_service_principal_privileged_role_no_owners,
+            )
+
+            entra_client.service_principals = {
+                sp_id: ServicePrincipal(
+                    id=sp_id,
+                    name="DualOwnedApp",
+                    app_id=str(uuid4()),
+                    directory_role_template_ids=[GLOBAL_ADMIN_ROLE],
+                    sp_owner_ids=[shared_owner_id],
+                    app_owner_ids=[shared_owner_id],
+                )
+            }
+
+            check = entra_service_principal_privileged_role_no_owners()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "1 owner(s)" in result[0].status_extended
+            assert "1 on the service principal" in result[0].status_extended
+            assert "1 on the parent app registration" in result[0].status_extended
diff --git a/tests/providers/m365/services/entra/entra_users_mfa_capable/entra_users_mfa_capable_test.py b/tests/providers/m365/services/entra/entra_users_mfa_capable/entra_users_mfa_capable_test.py
index 8bf0c88f77..86e8e38f22 100644
--- a/tests/providers/m365/services/entra/entra_users_mfa_capable/entra_users_mfa_capable_test.py
+++ b/tests/providers/m365/services/entra/entra_users_mfa_capable/entra_users_mfa_capable_test.py
@@ -1,3 +1,4 @@
+from datetime import datetime, timedelta, timezone
 from unittest import mock
 from uuid import uuid4
 
@@ -326,6 +327,133 @@ class Test_entra_users_mfa_capable:
 
             assert len(result) == 0
 
+    def test_future_hire_member_user_not_checked(self):
+        """Future-hire member user is not active yet: expected no results."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+        entra_client.user_registration_details_error = None
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_users_mfa_capable.entra_users_mfa_capable.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_users_mfa_capable.entra_users_mfa_capable import (
+                entra_users_mfa_capable,
+            )
+
+            user_id = str(uuid4())
+            entra_client.users = {
+                user_id: User(
+                    id=user_id,
+                    name="Future Hire",
+                    on_premises_sync_enabled=False,
+                    directory_roles_ids=[],
+                    is_mfa_capable=False,
+                    account_enabled=True,
+                    user_type="Member",
+                    employee_hire_date=datetime.now(timezone.utc) + timedelta(days=1),
+                )
+            }
+
+            check = entra_users_mfa_capable()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_naive_future_hire_member_user_not_checked(self):
+        """Naive future-hire datetimes are treated as UTC and skipped."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+        entra_client.user_registration_details_error = None
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_users_mfa_capable.entra_users_mfa_capable.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_users_mfa_capable.entra_users_mfa_capable import (
+                entra_users_mfa_capable,
+            )
+
+            user_id = str(uuid4())
+            entra_client.users = {
+                user_id: User(
+                    id=user_id,
+                    name="Future Hire",
+                    on_premises_sync_enabled=False,
+                    directory_roles_ids=[],
+                    is_mfa_capable=False,
+                    account_enabled=True,
+                    user_type="Member",
+                    employee_hire_date=(
+                        datetime.now(timezone.utc) + timedelta(days=1)
+                    ).replace(tzinfo=None),
+                )
+            }
+
+            check = entra_users_mfa_capable()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_current_hire_member_user_is_checked(self):
+        """Current-hire member user is active now: expected evaluation."""
+        entra_client = mock.MagicMock
+        entra_client.audited_tenant = "audited_tenant"
+        entra_client.audited_domain = DOMAIN
+        entra_client.user_registration_details_error = None
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.entra.entra_users_mfa_capable.entra_users_mfa_capable.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_users_mfa_capable.entra_users_mfa_capable import (
+                entra_users_mfa_capable,
+            )
+
+            user_id = str(uuid4())
+            entra_client.users = {
+                user_id: User(
+                    id=user_id,
+                    name="Current Hire",
+                    on_premises_sync_enabled=False,
+                    directory_roles_ids=[],
+                    is_mfa_capable=False,
+                    account_enabled=True,
+                    user_type="Member",
+                    employee_hire_date=datetime.now(timezone.utc),
+                )
+            }
+
+            check = entra_users_mfa_capable()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == "User Current Hire is not MFA capable."
+            assert result[0].resource == entra_client.users[user_id]
+            assert result[0].resource_name == "Current Hire"
+            assert result[0].resource_id == user_id
+
     def test_member_and_guest_users(self):
         """Mix of member and guest users: only member users should be checked."""
         entra_client = mock.MagicMock
diff --git a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py
index f2ee0b2c84..ba6247c7bd 100644
--- a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py
+++ b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py
@@ -411,6 +411,7 @@ class Test_Entra_Service:
                 id="user-1",
                 display_name="User 1",
                 on_premises_sync_enabled=True,
+                employee_hire_date=datetime(2026, 6, 10, tzinfo=timezone.utc),
             ),
             SimpleNamespace(
                 id="user-2",
@@ -535,6 +536,7 @@ class Test_Entra_Service:
             "userType",
             "accountEnabled",
             "onPremisesSyncEnabled",
+            "employeeHireDate",
         }
         with_url_mock.assert_called_once_with("next-link")
         assert users["user-1"].directory_roles_ids == ["role-template-1"]
@@ -548,6 +550,9 @@ class Test_Entra_Service:
         assert users["user-1"].authentication_methods == ["fido2SecurityKey"]
         assert users["user-6"].authentication_methods == ["mobilePhone"]
         assert users["user-2"].authentication_methods == []
+        assert users["user-1"].employee_hire_date == datetime(
+            2026, 6, 10, tzinfo=timezone.utc
+        )
 
     def test__get_users_uses_graph_account_enabled_for_disabled_guests(self):
         """Regression test for https://github.com/prowler-cloud/prowler/issues/10921.
@@ -873,3 +878,189 @@ class Test_Entra_Service:
         assert merged.password_credentials[0].key_id == "cred-app"
         assert merged.password_credentials[0].display_name == "app-level-secret"
         assert merged.password_credentials[0].is_active()
+
+    def test__resolve_identifiers_for_type_flags_only_404(self):
+        """Only HTTP 404 / Request_ResourceNotFound mark an id as deleted.
+
+        Transient errors (5xx, throttling) and successful resolutions must
+        never be added to the unresolved set — that is the contract the check
+        relies on to avoid false positives during Graph outages.
+        """
+        from msgraph.generated.models.o_data_errors.main_error import MainError
+        from msgraph.generated.models.o_data_errors.o_data_error import ODataError
+
+        deleted_by_status = "deleted-status-404"
+        deleted_by_code = "deleted-code-rnf"
+        transient = "transient-503"
+        live = "live-user"
+
+        error_404 = ODataError()
+        error_404.response_status_code = 404
+        error_404.error = None  # status code alone is enough
+
+        error_rnf = ODataError()
+        error_rnf.response_status_code = None
+        error_rnf.error = MainError()
+        error_rnf.error.code = "Request_ResourceNotFound"
+
+        error_503 = ODataError()
+        error_503.response_status_code = 503
+        error_503.error = MainError()
+        error_503.error.code = "ServiceUnavailable"
+
+        user_builders = {
+            deleted_by_status: SimpleNamespace(get=AsyncMock(side_effect=error_404)),
+            deleted_by_code: SimpleNamespace(get=AsyncMock(side_effect=error_rnf)),
+            transient: SimpleNamespace(get=AsyncMock(side_effect=error_503)),
+            live: SimpleNamespace(get=AsyncMock(return_value=SimpleNamespace(id=live))),
+        }
+
+        entra_service = Entra.__new__(Entra)
+        entra_service.client = SimpleNamespace(
+            users=SimpleNamespace(
+                by_user_id=MagicMock(side_effect=lambda uid: user_builders[uid])
+            )
+        )
+
+        unresolved = set()
+        errored = set()
+        asyncio.run(
+            entra_service._resolve_identifiers_for_type(
+                "user", set(user_builders), unresolved, errored
+            )
+        )
+
+        assert unresolved == {
+            ("user", deleted_by_status),
+            ("user", deleted_by_code),
+        }
+        # The transient 503 must be recorded as errored (unverified), never as
+        # deleted and never silently dropped.
+        assert errored == {("user", transient)}
+
+    def test__resolve_identifiers_for_type_role_uses_role_definitions_endpoint(self):
+        """A deleted role is resolved against the roleDefinitions endpoint."""
+        from msgraph.generated.models.o_data_errors.o_data_error import ODataError
+
+        deleted_role = "deleted-role-id"
+
+        error_404 = ODataError()
+        error_404.response_status_code = 404
+        error_404.error = None
+
+        by_role_id = MagicMock(
+            return_value=SimpleNamespace(get=AsyncMock(side_effect=error_404))
+        )
+
+        entra_service = Entra.__new__(Entra)
+        entra_service.client = SimpleNamespace(
+            role_management=SimpleNamespace(
+                directory=SimpleNamespace(
+                    role_definitions=SimpleNamespace(
+                        by_unified_role_definition_id=by_role_id
+                    )
+                )
+            )
+        )
+
+        unresolved = set()
+        errored = set()
+        asyncio.run(
+            entra_service._resolve_identifiers_for_type(
+                "role", {deleted_role}, unresolved, errored
+            )
+        )
+
+        assert unresolved == {("role", deleted_role)}
+        assert errored == set()
+        by_role_id.assert_called_once_with(deleted_role)
+
+    def test__resolve_directory_object_references_skips_sentinels_and_dedups(self):
+        """End-to-end resolver: sentinels are never queried, ids are deduped
+        across policies, and only deleted ids land in the unresolved set."""
+        from msgraph.generated.models.o_data_errors.o_data_error import ODataError
+
+        deleted_user = "deleted-user-id"
+        live_user = "live-user-id"
+        deleted_group = "deleted-group-id"
+        errored_group = "errored-group-id"
+
+        def _user_conditions(**kwargs):
+            base = {
+                "included_users": [],
+                "excluded_users": [],
+                "included_groups": [],
+                "excluded_groups": [],
+                "included_roles": [],
+                "excluded_roles": [],
+            }
+            base.update(kwargs)
+            return SimpleNamespace(**base)
+
+        def _policy(user_conditions):
+            return SimpleNamespace(
+                conditions=SimpleNamespace(user_conditions=user_conditions)
+            )
+
+        policies = {
+            "policy-a": _policy(
+                _user_conditions(
+                    included_users=["All", deleted_user, live_user],
+                    excluded_groups=[deleted_group, errored_group],
+                )
+            ),
+            # Same deleted_user referenced again — must be resolved only once.
+            "policy-b": _policy(
+                _user_conditions(
+                    included_users=[deleted_user],
+                    excluded_users=["GuestsOrExternalUsers"],
+                )
+            ),
+            # Policy without user conditions must be skipped without error.
+            "policy-c": SimpleNamespace(
+                conditions=SimpleNamespace(user_conditions=None)
+            ),
+        }
+
+        error_404 = ODataError()
+        error_404.response_status_code = 404
+        error_404.error = None
+
+        error_503 = ODataError()
+        error_503.response_status_code = 503
+        error_503.error = None
+
+        user_builders = {
+            deleted_user: SimpleNamespace(get=AsyncMock(side_effect=error_404)),
+            live_user: SimpleNamespace(
+                get=AsyncMock(return_value=SimpleNamespace(id=live_user))
+            ),
+        }
+        group_builders = {
+            deleted_group: SimpleNamespace(get=AsyncMock(side_effect=error_404)),
+            errored_group: SimpleNamespace(get=AsyncMock(side_effect=error_503)),
+        }
+        by_user_id = MagicMock(side_effect=lambda uid: user_builders[uid])
+        by_group_id = MagicMock(side_effect=lambda gid: group_builders[gid])
+
+        entra_service = Entra.__new__(Entra)
+        entra_service.client = SimpleNamespace(
+            users=SimpleNamespace(by_user_id=by_user_id),
+            groups=SimpleNamespace(by_group_id=by_group_id),
+        )
+
+        unresolved, errored = asyncio.run(
+            entra_service._resolve_directory_object_references(policies)
+        )
+
+        assert unresolved == {
+            ("user", deleted_user),
+            ("group", deleted_group),
+        }
+        # The 503 group is unverified, not deleted — it lands in errored.
+        assert errored == {("group", errored_group)}
+        # Sentinels are filtered before any Graph call; only the two real user
+        # ids are queried, and the deduped deleted_user is queried exactly once.
+        queried_users = {call.args[0] for call in by_user_id.call_args_list}
+        assert queried_users == {deleted_user, live_user}
+        assert user_builders[deleted_user].get.await_count == 1
diff --git a/tests/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/exchange_mailbox_primary_smtp_uses_custom_domain_test.py b/tests/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/exchange_mailbox_primary_smtp_uses_custom_domain_test.py
new file mode 100644
index 0000000000..9ec073a922
--- /dev/null
+++ b/tests/providers/m365/services/exchange/exchange_mailbox_primary_smtp_uses_custom_domain/exchange_mailbox_primary_smtp_uses_custom_domain_test.py
@@ -0,0 +1,300 @@
+from unittest import mock
+
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+class Test_exchange_mailbox_primary_smtp_uses_custom_domain:
+
+    def test_powershell_unavailable_manual(self):
+        """MANUAL: Exchange Online PowerShell unavailable (mailboxes is None)."""
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+        exchange_client.mailboxes = None
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain import (
+                exchange_mailbox_primary_smtp_uses_custom_domain,
+            )
+
+            check = exchange_mailbox_primary_smtp_uses_custom_domain()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "MANUAL"
+            assert "PowerShell" in result[0].status_extended
+            assert result[0].resource_name == "Exchange Online Mailboxes"
+            assert result[0].resource_id == "exchange_mailboxes"
+
+    def test_empty_tenant_no_findings(self):
+        """Empty tenant (no mailboxes) produces zero findings, not MANUAL."""
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+        exchange_client.mailboxes = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain import (
+                exchange_mailbox_primary_smtp_uses_custom_domain,
+            )
+
+            check = exchange_mailbox_primary_smtp_uses_custom_domain()
+            result = check.execute()
+
+            assert result == []
+
+    def test_custom_domain_passes(self):
+        """PASS: Mailbox primary SMTP uses a custom domain."""
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain import (
+                exchange_mailbox_primary_smtp_uses_custom_domain,
+            )
+            from prowler.providers.m365.services.exchange.exchange_service import (
+                Mailbox,
+            )
+
+            exchange_client.mailboxes = [
+                Mailbox(
+                    identity="user1@contoso.com",
+                    name="User One",
+                    primary_smtp_address="user1@contoso.com",
+                    recipient_type_details="UserMailbox",
+                )
+            ]
+
+            check = exchange_mailbox_primary_smtp_uses_custom_domain()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "custom domain" in result[0].status_extended
+            assert result[0].resource_name == "User One"
+            assert result[0].resource_id == "user1@contoso.com"
+            assert result[0].location == "global"
+
+    def test_onmicrosoft_domain_fails(self):
+        """FAIL: Mailbox primary SMTP uses .onmicrosoft.com."""
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain import (
+                exchange_mailbox_primary_smtp_uses_custom_domain,
+            )
+            from prowler.providers.m365.services.exchange.exchange_service import (
+                Mailbox,
+            )
+
+            exchange_client.mailboxes = [
+                Mailbox(
+                    identity="user1@contoso.onmicrosoft.com",
+                    name="User One",
+                    primary_smtp_address="user1@contoso.onmicrosoft.com",
+                    recipient_type_details="UserMailbox",
+                )
+            ]
+
+            check = exchange_mailbox_primary_smtp_uses_custom_domain()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert ".onmicrosoft.com" in result[0].status_extended
+            assert result[0].resource_name == "User One"
+            assert result[0].resource_id == "user1@contoso.onmicrosoft.com"
+            assert result[0].location == "global"
+
+    def test_mixed_mailboxes(self):
+        """Test multiple mailboxes with mixed domain status."""
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain import (
+                exchange_mailbox_primary_smtp_uses_custom_domain,
+            )
+            from prowler.providers.m365.services.exchange.exchange_service import (
+                Mailbox,
+            )
+
+            exchange_client.mailboxes = [
+                Mailbox(
+                    identity="user1@contoso.com",
+                    name="User One",
+                    primary_smtp_address="user1@contoso.com",
+                    recipient_type_details="UserMailbox",
+                ),
+                Mailbox(
+                    identity="shared@contoso.onmicrosoft.com",
+                    name="Shared Mailbox",
+                    primary_smtp_address="shared@contoso.onmicrosoft.com",
+                    recipient_type_details="SharedMailbox",
+                ),
+            ]
+
+            check = exchange_mailbox_primary_smtp_uses_custom_domain()
+            result = check.execute()
+
+            assert len(result) == 2
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Mailbox user1@contoso.com (UserMailbox) has primary SMTP address user1@contoso.com using a custom domain."
+            )
+            assert result[1].status == "FAIL"
+            assert (
+                result[1].status_extended
+                == "Mailbox shared@contoso.onmicrosoft.com (SharedMailbox) has primary SMTP address shared@contoso.onmicrosoft.com using the .onmicrosoft.com domain instead of a custom domain."
+            )
+
+    def test_room_mailbox_custom_domain(self):
+        """PASS: Room mailbox using a custom domain."""
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain import (
+                exchange_mailbox_primary_smtp_uses_custom_domain,
+            )
+            from prowler.providers.m365.services.exchange.exchange_service import (
+                Mailbox,
+            )
+
+            exchange_client.mailboxes = [
+                Mailbox(
+                    identity="boardroom@contoso.com",
+                    name="Board Room",
+                    primary_smtp_address="boardroom@contoso.com",
+                    recipient_type_details="RoomMailbox",
+                )
+            ]
+
+            check = exchange_mailbox_primary_smtp_uses_custom_domain()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "boardroom@contoso.com"
+            assert result[0].location == "global"
+
+    def test_equipment_mailbox_onmicrosoft(self):
+        """FAIL: Equipment mailbox using .onmicrosoft.com."""
+        exchange_client = mock.MagicMock()
+        exchange_client.audited_tenant = "audited_tenant"
+        exchange_client.audited_domain = DOMAIN
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online"
+            ),
+            mock.patch(
+                "prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_client",
+                new=exchange_client,
+            ),
+        ):
+            from prowler.providers.m365.services.exchange.exchange_mailbox_primary_smtp_uses_custom_domain.exchange_mailbox_primary_smtp_uses_custom_domain import (
+                exchange_mailbox_primary_smtp_uses_custom_domain,
+            )
+            from prowler.providers.m365.services.exchange.exchange_service import (
+                Mailbox,
+            )
+
+            exchange_client.mailboxes = [
+                Mailbox(
+                    identity="projector@contoso.onmicrosoft.com",
+                    name="Projector",
+                    primary_smtp_address="projector@contoso.onmicrosoft.com",
+                    recipient_type_details="EquipmentMailbox",
+                )
+            ]
+
+            check = exchange_mailbox_primary_smtp_uses_custom_domain()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "projector@contoso.onmicrosoft.com"
+            assert result[0].location == "global"
diff --git a/tests/providers/m365/services/exchange/exchange_service_test.py b/tests/providers/m365/services/exchange/exchange_service_test.py
index 8eed77ca99..8d812e3bb3 100644
--- a/tests/providers/m365/services/exchange/exchange_service_test.py
+++ b/tests/providers/m365/services/exchange/exchange_service_test.py
@@ -495,6 +495,104 @@ class Test_Exchange_Service:
 
             exchange_client.powershell.close()
 
+    @patch(
+        "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.get_mailboxes",
+        return_value=[
+            {
+                "Identity": "user1@contoso.com",
+                "DisplayName": "User One",
+                "PrimarySmtpAddress": "user1@contoso.com",
+                "RecipientTypeDetails": "UserMailbox",
+            },
+            {
+                "Identity": "room@contoso.com",
+                "DisplayName": "Boardroom",
+                "PrimarySmtpAddress": "room@contoso.com",
+                "RecipientTypeDetails": "RoomMailbox",
+            },
+            {
+                "Identity": "DiscoverySearchMailbox{D919BA05}",
+                "DisplayName": "Discovery Search Mailbox",
+                "PrimarySmtpAddress": "DiscoverySearchMailbox@contoso.onmicrosoft.com",
+                "RecipientTypeDetails": "DiscoveryMailbox",
+            },
+            {
+                "Identity": "SystemMailbox{1f05a927}",
+                "DisplayName": "Microsoft Exchange",
+                "PrimarySmtpAddress": "SystemMailbox@contoso.onmicrosoft.com",
+                "RecipientTypeDetails": "SystemMailbox",
+            },
+        ],
+    )
+    def test_get_mailboxes_excludes_system_types(self, _mock_get_mailboxes):
+        with (
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online",
+                return_value=True,
+            ),
+        ):
+            exchange_client = Exchange(
+                set_mocked_m365_provider(
+                    identity=M365IdentityInfo(tenant_domain=DOMAIN)
+                )
+            )
+            mailboxes = exchange_client.mailboxes
+            assert mailboxes is not None
+            assert len(mailboxes) == 2
+            identities = {m.identity for m in mailboxes}
+            assert identities == {"user1@contoso.com", "room@contoso.com"}
+            assert all(
+                m.recipient_type_details not in {"DiscoveryMailbox", "SystemMailbox"}
+                for m in mailboxes
+            )
+            exchange_client.powershell.close()
+
+    @patch(
+        "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.get_mailboxes",
+        return_value={
+            "Identity": "user1@contoso.com",
+            "DisplayName": "User One",
+            "PrimarySmtpAddress": "user1@contoso.com",
+            "RecipientTypeDetails": "UserMailbox",
+        },
+    )
+    def test_get_mailboxes_single_dict(self, _mock_get_mailboxes):
+        with (
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online",
+                return_value=True,
+            ),
+        ):
+            exchange_client = Exchange(
+                set_mocked_m365_provider(
+                    identity=M365IdentityInfo(tenant_domain=DOMAIN)
+                )
+            )
+            mailboxes = exchange_client.mailboxes
+            assert mailboxes is not None
+            assert len(mailboxes) == 1
+            assert mailboxes[0].identity == "user1@contoso.com"
+            exchange_client.powershell.close()
+
+    @patch(
+        "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.get_mailboxes",
+        side_effect=Exception("Get-EXOMailbox failed"),
+    )
+    def test_get_mailboxes_returns_none_on_exception(self, _mock_get_mailboxes):
+        with (
+            mock.patch(
+                "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online",
+                return_value=True,
+            ),
+        ):
+            exchange_client = Exchange(
+                set_mocked_m365_provider(
+                    identity=M365IdentityInfo(tenant_domain=DOMAIN)
+                )
+            )
+            assert exchange_client.mailboxes is None
+            exchange_client.powershell.close()
+
     def test_get_total_paid_licenses_none(self):
         with (
             mock.patch(
diff --git a/tests/providers/okta/lib/service/pagination_test.py b/tests/providers/okta/lib/service/pagination_test.py
new file mode 100644
index 0000000000..a14baeb51e
--- /dev/null
+++ b/tests/providers/okta/lib/service/pagination_test.py
@@ -0,0 +1,147 @@
+"""Tests for the shared Okta pagination helpers in
+`prowler.providers.okta.lib.service.pagination`.
+
+Covers `next_after_cursor` (extracts the `after` query param from an
+RFC 5988 `Link: rel="next"` header) and `paginate` (drains all pages
+of an SDK list call by following the cursor).
+
+These tests were carved out of `network_zone_service_test.py` when its
+local pagination helpers were replaced by the shared module — they now
+cover code that six Okta services depend on.
+"""
+
+import asyncio
+from types import SimpleNamespace
+
+from prowler.providers.okta.lib.service.pagination import (
+    next_after_cursor,
+    paginate,
+)
+
+
+def _run(coro):
+    return asyncio.run(coro)
+
+
+def _resp(headers: dict = None):
+    return SimpleNamespace(headers=headers or {})
+
+
+class Test_next_after_cursor:
+    """Behaviours previously covered in `network_zone_service_test.py`
+    under `Test_network_zone_pagination` — relocated here when the
+    local helper was replaced by the shared module.
+    """
+
+    def test_returns_none_when_response_is_none(self):
+        assert next_after_cursor(None) is None
+
+    def test_returns_none_when_no_link_header(self):
+        assert next_after_cursor(_resp({})) is None
+
+    def test_extracts_next_after_cursor(self):
+        link = (
+            '<https://acme.okta.com/api/v1/zones?limit=20>; rel="self", '
+            '<https://acme.okta.com/api/v1/zones?after=next-page>; rel="next"'
+        )
+        assert next_after_cursor(_resp({"Link": link})) == "next-page"
+
+    def test_reads_lowercase_link_header(self):
+        # aiohttp's `CIMultiDict` is case-insensitive in practice, but
+        # callers occasionally pass a dict, so we check both spellings.
+        link = '<https://acme.okta.com/api/v1/zones?after=cursor-1>; rel="next"'
+        assert next_after_cursor(_resp({"link": link})) == "cursor-1"
+
+    def test_next_link_without_after_query_returns_none(self):
+        link = (
+            '<https://acme.okta.com/api/v1/zones?limit=20>; rel="self", '
+            '<https://acme.okta.com/api/v1/zones?limit=20>; rel="next"'
+        )
+        assert next_after_cursor(_resp({"Link": link})) is None
+
+    def test_no_next_segment_returns_none(self):
+        link = '<https://acme.okta.com/api/v1/zones?after=ignored>; rel="self"'
+        assert next_after_cursor(_resp({"Link": link})) is None
+
+    def test_url_decodes_after_cursor(self):
+        # `parse_qs` decodes percent-encoded values — opaque cursors with
+        # `=` or `+` must round-trip through callers that re-encode.
+        link = (
+            "<https://acme.okta.com/api/v1/zones?after=cursor%3Dabc%2B1>; " 'rel="next"'
+        )
+        assert next_after_cursor(_resp({"Link": link})) == "cursor=abc+1"
+
+
+class Test_paginate:
+    def test_returns_items_for_single_page_response(self):
+        async def fetch(_after):
+            return (["a", "b"], _resp({}), None)
+
+        items, err = _run(paginate(fetch))
+        assert items == ["a", "b"]
+        assert err is None
+
+    def test_drains_multiple_pages(self):
+        link = '<https://acme.okta.com/api/v1/x?after=p2>; rel="next"'
+        seen_cursors: list = []
+
+        async def fetch(after):
+            seen_cursors.append(after)
+            if after is None:
+                return (["a"], _resp({"link": link}), None)
+            return (["b"], _resp({}), None)
+
+        items, err = _run(paginate(fetch))
+        assert items == ["a", "b"]
+        assert err is None
+        assert seen_cursors == [None, "p2"]
+
+    def test_returns_empty_when_first_page_is_empty(self):
+        async def fetch(_after):
+            return ([], _resp({}), None)
+
+        items, err = _run(paginate(fetch))
+        assert items == []
+        assert err is None
+
+    def test_returns_empty_and_error_when_first_page_fails(self):
+        async def fetch(_after):
+            return ([], _resp({}), Exception("forbidden"))
+
+        items, err = _run(paginate(fetch))
+        assert items == []
+        assert str(err) == "forbidden"
+
+    def test_returns_partial_items_when_subsequent_page_errors(self):
+        # Carved out of `network_zone_service_test.py`'s
+        # `test_pagination_returns_partial_items_when_second_page_errors`.
+        link = '<https://acme.okta.com/api/v1/x?after=p2>; rel="next"'
+
+        async def fetch(after):
+            if after is None:
+                return (["page-1"], _resp({"link": link}), None)
+            return ([], _resp({}), Exception("page failed"))
+
+        items, err = _run(paginate(fetch))
+        assert items == ["page-1"]
+        assert str(err) == "page failed"
+
+    def test_accepts_early_error_two_tuple_shape(self):
+        # The Okta SDK returns `(items, err)` on request-build failures
+        # (no response) and `(items, resp, err)` on transport responses.
+        # `paginate` reads `result[-1]` for err so the 2-tuple shape is
+        # handled — verify explicitly.
+        async def fetch(_after):
+            return ([], Exception("create failed"))
+
+        items, err = _run(paginate(fetch))
+        assert items == []
+        assert str(err) == "create failed"
+
+    def test_treats_none_items_as_empty_list(self):
+        async def fetch(_after):
+            return (None, _resp({}), None)
+
+        items, err = _run(paginate(fetch))
+        assert items == []
+        assert err is None
diff --git a/tests/providers/okta/lib/service/raw_fetch_test.py b/tests/providers/okta/lib/service/raw_fetch_test.py
new file mode 100644
index 0000000000..173e78888a
--- /dev/null
+++ b/tests/providers/okta/lib/service/raw_fetch_test.py
@@ -0,0 +1,152 @@
+"""Tests for the raw-JSON HTTP helpers in
+`prowler.providers.okta.lib.service.raw_fetch`.
+
+Covers `get_json` (single-shot) and `get_json_paginated`
+(drains list endpoints via the `Link: rel="next"` cursor).
+"""
+
+import asyncio
+import json
+from unittest import mock
+
+from prowler.providers.okta.lib.service.raw_fetch import (
+    get_json,
+    get_json_paginated,
+)
+
+
+def _run(coro):
+    return asyncio.run(coro)
+
+
+def _mock_response(headers: dict = None):
+    r = mock.MagicMock()
+    r.headers = headers or {}
+    return r
+
+
+class Test_get_json:
+    def test_returns_parsed_json_on_success(self):
+        client = mock.MagicMock()
+
+        async def create(*_a, **_k):
+            return ({"url": "/x"}, None)
+
+        async def execute(_req):
+            return (_mock_response(), json.dumps({"hello": "world"}), None)
+
+        client._request_executor.create_request = create
+        client._request_executor.execute = execute
+
+        assert _run(get_json(client, "/x")) == {"hello": "world"}
+
+    def test_returns_none_on_create_request_error(self):
+        client = mock.MagicMock()
+
+        async def create(*_a, **_k):
+            return (None, Exception("boom"))
+
+        client._request_executor.create_request = create
+        assert _run(get_json(client, "/x")) is None
+
+    def test_returns_none_on_execute_error(self):
+        client = mock.MagicMock()
+
+        async def create(*_a, **_k):
+            return ({"url": "/x"}, None)
+
+        async def execute(_req):
+            return (_mock_response(), None, Exception("boom"))
+
+        client._request_executor.create_request = create
+        client._request_executor.execute = execute
+        assert _run(get_json(client, "/x")) is None
+
+
+class Test_get_json_paginated:
+    def test_drains_all_pages_following_link_rel_next(self):
+        # Two pages: first carries `Link: <…?after=cur1>; rel="next"`,
+        # second has no `next`, so iteration stops.
+        client = mock.MagicMock()
+
+        page1 = [{"id": "a"}, {"id": "b"}]
+        page2 = [{"id": "c"}]
+        page1_headers = {
+            "link": '<https://acme.okta.com/api/v1/items?after=cur1>; rel="next"'
+        }
+
+        seen_urls = []
+
+        async def create(**kwargs):
+            seen_urls.append(kwargs["url"])
+            return ({"url": kwargs["url"]}, None)
+
+        async def execute(request):
+            if "after=cur1" in request["url"]:
+                return (_mock_response({}), json.dumps(page2), None)
+            return (_mock_response(page1_headers), json.dumps(page1), None)
+
+        client._request_executor.create_request = create
+        client._request_executor.execute = execute
+
+        items = _run(get_json_paginated(client, "/api/v1/items", page_size=2))
+
+        assert items == [{"id": "a"}, {"id": "b"}, {"id": "c"}]
+        assert len(seen_urls) == 2
+        assert "limit=2" in seen_urls[0]
+        # The cursor was carried into the second request.
+        assert "after=cur1" in seen_urls[1]
+        assert "limit=2" in seen_urls[1]
+
+    def test_single_page_terminates_immediately(self):
+        client = mock.MagicMock()
+
+        async def create(**kwargs):
+            return ({"url": kwargs["url"]}, None)
+
+        async def execute(_req):
+            return (_mock_response({}), json.dumps([{"id": "only"}]), None)
+
+        client._request_executor.create_request = create
+        client._request_executor.execute = execute
+
+        assert _run(get_json_paginated(client, "/api/v1/items")) == [{"id": "only"}]
+
+    def test_returns_none_when_response_is_not_a_list(self):
+        client = mock.MagicMock()
+
+        async def create(**kwargs):
+            return ({"url": kwargs["url"]}, None)
+
+        async def execute(_req):
+            return (_mock_response({}), json.dumps({"error": "nope"}), None)
+
+        client._request_executor.create_request = create
+        client._request_executor.execute = execute
+
+        assert _run(get_json_paginated(client, "/api/v1/items")) is None
+
+    def test_preserves_existing_query_string_and_overrides_limit(self):
+        # Caller already passes `type=USER_LIFECYCLE` — pagination must
+        # merge `limit` without clobbering existing params.
+        client = mock.MagicMock()
+        seen = []
+
+        async def create(**kwargs):
+            seen.append(kwargs["url"])
+            return ({"url": kwargs["url"]}, None)
+
+        async def execute(_req):
+            return (_mock_response({}), "[]", None)
+
+        client._request_executor.create_request = create
+        client._request_executor.execute = execute
+
+        _run(
+            get_json_paginated(
+                client, "/api/v1/policies?type=USER_LIFECYCLE", page_size=50
+            )
+        )
+
+        assert "type=USER_LIFECYCLE" in seen[0]
+        assert "limit=50" in seen[0]
diff --git a/tests/providers/okta/okta_fixtures.py b/tests/providers/okta/okta_fixtures.py
index 23d770cf88..5c3d0e43c3 100644
--- a/tests/providers/okta/okta_fixtures.py
+++ b/tests/providers/okta/okta_fixtures.py
@@ -16,7 +16,18 @@ def set_mocked_okta_provider(
         session = OktaSession(
             org_domain=OKTA_ORG_DOMAIN,
             client_id=OKTA_CLIENT_ID,
-            scopes=["okta.policies.read", "okta.brands.read", "okta.apps.read"],
+            scopes=[
+                "okta.policies.read",
+                "okta.brands.read",
+                "okta.apps.read",
+                "okta.authenticators.read",
+                "okta.networkZones.read",
+                "okta.apiTokens.read",
+                "okta.roles.read",
+                "okta.groups.read",
+                "okta.logStreams.read",
+                "okta.idps.read",
+            ],
             private_key=OKTA_PRIVATE_KEY,
         )
     if identity is None:
@@ -27,6 +38,13 @@ def set_mocked_okta_provider(
                 "okta.policies.read",
                 "okta.brands.read",
                 "okta.apps.read",
+                "okta.authenticators.read",
+                "okta.networkZones.read",
+                "okta.apiTokens.read",
+                "okta.roles.read",
+                "okta.groups.read",
+                "okta.logStreams.read",
+                "okta.idps.read",
             ],
         )
 
diff --git a/tests/providers/okta/services/api_token/api_token_fixtures.py b/tests/providers/okta/services/api_token/api_token_fixtures.py
new file mode 100644
index 0000000000..63a67c1605
--- /dev/null
+++ b/tests/providers/okta/services/api_token/api_token_fixtures.py
@@ -0,0 +1,46 @@
+from unittest import mock
+
+from prowler.providers.okta.services.apitoken.api_token_service import OktaApiToken
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def build_api_token_client(
+    tokens: dict = None,
+    known_network_zone_ids: set[str] = None,
+    missing_scope: dict = None,
+):
+    client = mock.MagicMock()
+    client.api_tokens = tokens or {}
+    client.known_network_zone_ids = known_network_zone_ids or {"nzo-corp"}
+    client.missing_scope = missing_scope or {
+        "api_tokens": None,
+        "network_zones": None,
+        "user_roles": None,
+        "user_groups": None,
+    }
+    client.provider = set_mocked_okta_provider()
+    return client
+
+
+def api_token(
+    token_id: str = "00Tabcdefg1234567890",
+    name: str = "CI token",
+    *,
+    user_id: str = "00uabcdefg1234567890",
+    network_connection: str = "ZONE",
+    network_includes: list[str] = None,
+    network_excludes: list[str] = None,
+    owner_roles: list[str] = None,
+):
+    return OktaApiToken(
+        id=token_id,
+        name=name,
+        client_name="Okta API",
+        user_id=user_id,
+        network_connection=network_connection,
+        network_includes=(
+            network_includes if network_includes is not None else ["nzo-corp"]
+        ),
+        network_excludes=network_excludes or [],
+        owner_roles=owner_roles or ["READ_ONLY_ADMIN"],
+    )
diff --git a/tests/providers/okta/services/api_token/api_token_service_test.py b/tests/providers/okta/services/api_token/api_token_service_test.py
new file mode 100644
index 0000000000..0958bdaaad
--- /dev/null
+++ b/tests/providers/okta/services/api_token/api_token_service_test.py
@@ -0,0 +1,616 @@
+import json
+from types import SimpleNamespace
+from unittest import mock
+
+from prowler.providers.okta.models import OktaIdentityInfo
+from prowler.providers.okta.services.apitoken.api_token_service import ApiToken
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def _resp(headers: dict = None):
+    return SimpleNamespace(headers=headers or {})
+
+
+def _sdk_token(
+    token_id: str = "00Tabcdefg1234567890",
+    name: str = "CI token",
+    *,
+    user_id: str = "00uabcdefg1234567890",
+    connection: str = "ZONE",
+    include: list[str] = None,
+    exclude: list[str] = None,
+):
+    return SimpleNamespace(
+        id=token_id,
+        name=name,
+        client_name="Okta API",
+        user_id=user_id,
+        network=SimpleNamespace(
+            connection=connection,
+            include=include if include is not None else ["nzo-corp"],
+            exclude=exclude or [],
+        ),
+    )
+
+
+def _sdk_role(role_type: str):
+    return SimpleNamespace(type=role_type, label=role_type.replace("_", " ").title())
+
+
+def _sdk_role_wrapped(role_type: str):
+    """Mimic `ListGroupAssignedRoles200ResponseInner` — a oneOf wrapper
+    holding the real StandardRole on `.actual_instance`. The Okta SDK
+    actually returns this shape; treating it like the bare role yields
+    `type=None, label=None` and the role silently vanishes from the
+    check.
+    """
+    inner = _sdk_role(role_type)
+    return SimpleNamespace(actual_instance=inner, type=None, label=None)
+
+
+def _sdk_zone(zone_id: str, name: str):
+    return SimpleNamespace(id=zone_id, name=name)
+
+
+def _sdk_group(group_id: str):
+    return SimpleNamespace(id=group_id)
+
+
+async def _empty_list(*_a, **_k):
+    return ([], _resp({}), None)
+
+
+class Test_ApiToken_service:
+    def test_fetches_tokens_roles_and_known_network_zones(self):
+        provider = set_mocked_okta_provider()
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_list_assigned_roles_for_user(user_id, *_a, **_k):
+            assert user_id == token.user_id
+            return ([_sdk_role("READ_ONLY_ADMIN")], _resp({}), None)
+
+        async def fake_list_network_zones(*_a, **_k):
+            return ([_sdk_zone("nzo-corp", "Corporate")], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_list_assigned_roles_for_user
+            mocked.list_user_groups = _empty_list
+            mocked.list_group_assigned_roles = _empty_list
+            mocked.list_network_zones = fake_list_network_zones
+            mocked_client_cls.return_value = mocked
+
+            service = ApiToken(provider)
+
+        assert set(service.api_tokens.keys()) == {token.id}
+        assert service.api_tokens[token.id].network_connection == "ZONE"
+        assert service.api_tokens[token.id].owner_roles == ["READ_ONLY_ADMIN"]
+        assert service.known_network_zone_ids == {"nzo-corp", "Corporate"}
+
+    def test_role_fetch_error_keeps_token_with_empty_roles(self):
+        provider = set_mocked_okta_provider()
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_roles_error(*_a, **_k):
+            return ([], _resp({}), Exception("forbidden"))
+
+        async def fake_list_network_zones(*_a, **_k):
+            return ([], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_roles_error
+            mocked.list_user_groups = _empty_list
+            mocked.list_group_assigned_roles = _empty_list
+            mocked.list_network_zones = fake_list_network_zones
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.api_tokens[token.id].owner_roles == []
+
+    def test_falls_back_to_raw_roles_when_sdk_role_is_empty(self):
+        provider = set_mocked_okta_provider()
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_list_assigned_roles_for_user(user_id, *_a, **_k):
+            assert user_id == token.user_id
+            return ([SimpleNamespace(type=None, label=None)], _resp({}), None)
+
+        async def fake_create_request(*_a, **_k):
+            return ("raw-role-request", None)
+
+        async def fake_execute(request, *_a, **_k):
+            assert request == "raw-role-request"
+            return (
+                _resp({}),
+                json.dumps(
+                    [
+                        {
+                            "id": "ra-super-admin",
+                            "type": "SUPER_ADMIN",
+                            "label": "Super Administrator",
+                        }
+                    ]
+                ),
+                None,
+            )
+
+        async def fake_list_network_zones(*_a, **_k):
+            return ([_sdk_zone("nzo-corp", "Corporate")], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_list_assigned_roles_for_user
+            mocked._list_assigned_roles_for_user_serialize.return_value = (
+                "GET",
+                "/api/v1/users/00uabcdefg1234567890/roles",
+                {},
+                None,
+                None,
+            )
+            mocked._request_executor.create_request = fake_create_request
+            mocked._request_executor.execute = fake_execute
+            mocked.list_network_zones = fake_list_network_zones
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.api_tokens[token.id].owner_roles == ["SUPER_ADMIN"]
+
+    def test_paginates_known_network_zones_for_token_validation(self):
+        provider = set_mocked_okta_provider()
+        token = _sdk_token(include=["nzo-page-2"])
+        next_link = '<https://acme.okta.com/api/v1/zones?after=cursor-2>; rel="next"'
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_list_assigned_roles_for_user(*_a, **_k):
+            return ([_sdk_role("READ_ONLY_ADMIN")], _resp({}), None)
+
+        async def fake_list_network_zones(*_a, **kwargs):
+            if kwargs.get("after") is None:
+                return (
+                    [_sdk_zone("nzo-page-1", "First")],
+                    _resp({"link": next_link}),
+                    None,
+                )
+            return ([_sdk_zone("nzo-page-2", "Second")], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_list_assigned_roles_for_user
+            mocked.list_user_groups = _empty_list
+            mocked.list_group_assigned_roles = _empty_list
+            mocked.list_network_zones = fake_list_network_zones
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.known_network_zone_ids == {
+            "nzo-page-1",
+            "First",
+            "nzo-page-2",
+            "Second",
+        }
+
+    def test_falls_back_to_raw_network_zones_when_sdk_listing_fails(self):
+        provider = set_mocked_okta_provider()
+        token = _sdk_token(include=["nzo-raw"])
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_list_assigned_roles_for_user(*_a, **_k):
+            return ([_sdk_role("READ_ONLY_ADMIN")], _resp({}), None)
+
+        async def fake_list_network_zones(*_a, **_k):
+            raise ValueError("EnhancedDynamicNetworkZone SDK deserialization failed")
+
+        async def fake_create_request(*_a, **_k):
+            return ("raw-zones-request", None)
+
+        async def fake_execute(request, *_a, **_k):
+            assert request == "raw-zones-request"
+            return (
+                _resp({}),
+                json.dumps([{"id": "nzo-raw", "name": "Raw Corporate"}]),
+                None,
+            )
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_list_assigned_roles_for_user
+            mocked.list_network_zones = fake_list_network_zones
+            mocked._list_network_zones_serialize.return_value = (
+                "GET",
+                "/api/v1/zones",
+                {},
+                None,
+                None,
+            )
+            mocked._request_executor.create_request = fake_create_request
+            mocked._request_executor.execute = fake_execute
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.known_network_zone_ids == {"nzo-raw", "Raw Corporate"}
+
+    def test_returns_empty_on_token_api_error(self):
+        provider = set_mocked_okta_provider()
+
+        async def failing(*_a, **_k):
+            return ([], _resp({}), Exception("forbidden"))
+
+        async def fake_list_network_zones(*_a, **_k):
+            return ([], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = failing
+            mocked.list_network_zones = fake_list_network_zones
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.api_tokens == {}
+
+    def test_missing_api_token_scope_skips_dependent_api_calls(self):
+        provider = set_mocked_okta_provider(
+            identity=OktaIdentityInfo(
+                org_domain="acme.okta.com",
+                client_id="0oa1234567890abcdef",
+                granted_scopes=["okta.networkZones.read", "okta.roles.read"],
+            )
+        )
+
+        async def fail_if_called(*_a, **_k):
+            raise AssertionError("API calls should not run without apiTokens scope")
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fail_if_called
+            mocked.list_network_zones = fail_if_called
+            mocked.list_assigned_roles_for_user = fail_if_called
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.missing_scope["api_tokens"] == "okta.apiTokens.read"
+        assert service.api_tokens == {}
+        assert service.known_network_zone_ids == set()
+
+    def test_missing_network_zone_scope_skips_zone_api_call(self):
+        provider = set_mocked_okta_provider(
+            identity=OktaIdentityInfo(
+                org_domain="acme.okta.com",
+                client_id="0oa1234567890abcdef",
+                granted_scopes=["okta.apiTokens.read", "okta.roles.read"],
+            )
+        )
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_list_assigned_roles_for_user(*_a, **_k):
+            return ([_sdk_role("READ_ONLY_ADMIN")], _resp({}), None)
+
+        async def fail_if_called(*_a, **_k):
+            raise AssertionError("list_network_zones should not be called")
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_list_assigned_roles_for_user
+            mocked.list_network_zones = fail_if_called
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.missing_scope["network_zones"] == "okta.networkZones.read"
+        assert service.known_network_zone_ids == set()
+        assert set(service.api_tokens.keys()) == {token.id}
+
+    def test_missing_role_scope_skips_role_api_call(self):
+        provider = set_mocked_okta_provider(
+            identity=OktaIdentityInfo(
+                org_domain="acme.okta.com",
+                client_id="0oa1234567890abcdef",
+                granted_scopes=["okta.apiTokens.read", "okta.networkZones.read"],
+            )
+        )
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fail_if_called(*_a, **_k):
+            raise AssertionError("list_assigned_roles_for_user should not be called")
+
+        async def fake_list_network_zones(*_a, **_k):
+            return ([_sdk_zone("nzo-corp", "Corporate")], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fail_if_called
+            mocked.list_network_zones = fake_list_network_zones
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.missing_scope["user_roles"] == "okta.roles.read"
+        assert service.api_tokens[token.id].owner_roles == []
+
+
+class Test_ApiToken_service_group_inherited_roles:
+    """Verifies effective-role resolution combines direct + group-inherited.
+
+    Okta's `/api/v1/users/{userId}/roles` returns only directly-assigned
+    admin roles. Roles inherited via group membership — the common path
+    for Super Admin on trial tenants — are invisible to that endpoint.
+    The service must enumerate the user's groups and combine each
+    group's role assignments.
+    """
+
+    def test_group_inherited_super_admin_surfaces(self):
+        provider = set_mocked_okta_provider()
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_direct_roles(*_a, **_k):
+            return ([], _resp({}), None)
+
+        async def fake_user_groups(user_id, *_a, **_k):
+            assert user_id == token.user_id
+            return (
+                [_sdk_group("0gp-admins"), _sdk_group("0gp-eng")],
+                _resp({}),
+                None,
+            )
+
+        async def fake_group_roles(group_id, *_a, **_k):
+            if group_id == "0gp-admins":
+                return ([_sdk_role("SUPER_ADMIN")], _resp({}), None)
+            return ([], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_direct_roles
+            mocked.list_user_groups = fake_user_groups
+            mocked.list_group_assigned_roles = fake_group_roles
+            mocked.list_network_zones = _empty_list
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.api_tokens[token.id].owner_roles == ["SUPER_ADMIN"]
+
+    def test_direct_plus_group_roles_combined_and_deduped(self):
+        provider = set_mocked_okta_provider()
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_direct_roles(*_a, **_k):
+            return ([_sdk_role("READ_ONLY_ADMIN")], _resp({}), None)
+
+        async def fake_user_groups(*_a, **_k):
+            return ([_sdk_group("0gp-1")], _resp({}), None)
+
+        async def fake_group_roles(*_a, **_k):
+            # READ_ONLY_ADMIN already comes from the direct path; the
+            # dedupe should keep a single entry. SUPER_ADMIN is new.
+            return (
+                [_sdk_role("READ_ONLY_ADMIN"), _sdk_role("SUPER_ADMIN")],
+                _resp({}),
+                None,
+            )
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_direct_roles
+            mocked.list_user_groups = fake_user_groups
+            mocked.list_group_assigned_roles = fake_group_roles
+            mocked.list_network_zones = _empty_list
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.api_tokens[token.id].owner_roles == [
+            "READ_ONLY_ADMIN",
+            "SUPER_ADMIN",
+        ]
+
+    def test_role_resolution_cached_per_user_and_group(self):
+        provider = set_mocked_okta_provider()
+        token_a = _sdk_token(token_id="00Ttoken-a", user_id="00uowner-1")
+        token_b = _sdk_token(token_id="00Ttoken-b", user_id="00uowner-1")
+        token_c = _sdk_token(token_id="00Ttoken-c", user_id="00uowner-2")
+
+        direct_calls: list[str] = []
+        groups_calls: list[str] = []
+        group_role_calls: list[str] = []
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token_a, token_b, token_c], _resp({}), None)
+
+        async def fake_direct_roles(user_id, *_a, **_k):
+            direct_calls.append(user_id)
+            return ([], _resp({}), None)
+
+        async def fake_user_groups(user_id, *_a, **_k):
+            groups_calls.append(user_id)
+            return ([_sdk_group("0gp-shared")], _resp({}), None)
+
+        async def fake_group_roles(group_id, *_a, **_k):
+            group_role_calls.append(group_id)
+            return ([_sdk_role("HELP_DESK_ADMIN")], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_direct_roles
+            mocked.list_user_groups = fake_user_groups
+            mocked.list_group_assigned_roles = fake_group_roles
+            mocked.list_network_zones = _empty_list
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        # Owner 00uowner-1 appears twice but is resolved once.
+        assert sorted(direct_calls) == ["00uowner-1", "00uowner-2"]
+        assert sorted(groups_calls) == ["00uowner-1", "00uowner-2"]
+        # Shared group resolved once even though both owners belong to it.
+        assert group_role_calls == ["0gp-shared"]
+        for token in (token_a, token_b, token_c):
+            assert service.api_tokens[token.id].owner_roles == ["HELP_DESK_ADMIN"]
+
+    def test_missing_groups_scope_falls_back_to_direct_only(self):
+        provider = set_mocked_okta_provider(
+            identity=OktaIdentityInfo(
+                org_domain="acme.okta.com",
+                client_id="0oa1234567890abcdef",
+                granted_scopes=[
+                    "okta.apiTokens.read",
+                    "okta.networkZones.read",
+                    "okta.roles.read",
+                ],
+            )
+        )
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_direct_roles(*_a, **_k):
+            return ([_sdk_role("READ_ONLY_ADMIN")], _resp({}), None)
+
+        async def fail_if_called(*_a, **_k):
+            raise AssertionError(
+                "list_user_groups must not be called without okta.groups.read"
+            )
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_direct_roles
+            mocked.list_user_groups = fail_if_called
+            mocked.list_group_assigned_roles = fail_if_called
+            mocked.list_network_zones = _empty_list
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.missing_scope["user_groups"] == "okta.groups.read"
+        assert service.api_tokens[token.id].owner_roles == ["READ_ONLY_ADMIN"]
+
+    def test_wrapped_oneof_role_shape_is_unwrapped(self):
+        """Regression: the SDK returns each role as a oneOf wrapper with
+        the real StandardRole on `.actual_instance`. The previous
+        `_role_to_string` read `.type`/`.label` from the wrapper, got
+        None back, and produced an empty `owner_roles` — causing a
+        Super Admin token to silently PASS the check."""
+        provider = set_mocked_okta_provider()
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_direct_roles(*_a, **_k):
+            return ([_sdk_role_wrapped("SUPER_ADMIN")], _resp({}), None)
+
+        async def fake_user_groups(*_a, **_k):
+            return ([_sdk_group("0gp-extra")], _resp({}), None)
+
+        async def fake_group_roles(*_a, **_k):
+            return ([_sdk_role_wrapped("APP_ADMIN")], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_direct_roles
+            mocked.list_user_groups = fake_user_groups
+            mocked.list_group_assigned_roles = fake_group_roles
+            mocked.list_network_zones = _empty_list
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.api_tokens[token.id].owner_roles == [
+            "SUPER_ADMIN",
+            "APP_ADMIN",
+        ]
+
+    def test_group_role_fetch_failure_does_not_drop_other_groups(self):
+        provider = set_mocked_okta_provider()
+        token = _sdk_token()
+
+        async def fake_list_api_tokens(*_a, **_k):
+            return ([token], _resp({}), None)
+
+        async def fake_direct_roles(*_a, **_k):
+            return ([], _resp({}), None)
+
+        async def fake_user_groups(*_a, **_k):
+            return (
+                [_sdk_group("0gp-broken"), _sdk_group("0gp-good")],
+                _resp({}),
+                None,
+            )
+
+        async def fake_group_roles(group_id, *_a, **_k):
+            if group_id == "0gp-broken":
+                raise RuntimeError("upstream parse failure")
+            return ([_sdk_role("SUPER_ADMIN")], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_api_tokens = fake_list_api_tokens
+            mocked.list_assigned_roles_for_user = fake_direct_roles
+            mocked.list_user_groups = fake_user_groups
+            mocked.list_group_assigned_roles = fake_group_roles
+            mocked.list_network_zones = _empty_list
+            mocked_client_cls.return_value = mocked
+            service = ApiToken(provider)
+
+        assert service.api_tokens[token.id].owner_roles == ["SUPER_ADMIN"]
diff --git a/tests/providers/okta/services/api_token/apitoken_not_super_admin/apitoken_not_super_admin_test.py b/tests/providers/okta/services/api_token/apitoken_not_super_admin/apitoken_not_super_admin_test.py
new file mode 100644
index 0000000000..6177d4b422
--- /dev/null
+++ b/tests/providers/okta/services/api_token/apitoken_not_super_admin/apitoken_not_super_admin_test.py
@@ -0,0 +1,99 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.api_token.api_token_fixtures import (
+    api_token,
+    build_api_token_client,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.apitoken."
+    "apitoken_not_super_admin.apitoken_not_super_admin.api_token_client"
+)
+
+
+def _run_check(api_token_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=api_token_client),
+    ):
+        from prowler.providers.okta.services.apitoken.apitoken_not_super_admin.apitoken_not_super_admin import (
+            apitoken_not_super_admin,
+        )
+
+        return apitoken_not_super_admin().execute()
+
+
+class Test_apitoken_not_super_admin:
+    def test_no_tokens_returns_no_findings(self):
+        findings = _run_check(build_api_token_client({}))
+        assert findings == []
+
+    def test_missing_api_token_scope_is_manual(self):
+        findings = _run_check(
+            build_api_token_client(
+                {},
+                missing_scope={"api_tokens": "okta.apiTokens.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert "okta.apiTokens.read" in findings[0].status_extended
+        assert "okta.roles.read" in findings[0].status_extended
+        assert "okta.groups.read" in findings[0].status_extended
+
+    def test_missing_user_roles_scope_is_manual(self):
+        token = api_token(owner_roles=[])
+        findings = _run_check(
+            build_api_token_client(
+                {token.id: token},
+                missing_scope={"user_roles": "okta.roles.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert findings[0].resource_id == token.id
+        assert "okta.roles.read" in findings[0].status_extended
+
+    def test_token_owner_without_super_admin_passes(self):
+        token = api_token(owner_roles=["READ_ONLY_ADMIN"])
+        findings = _run_check(build_api_token_client({token.id: token}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == token.id
+
+    def test_token_owner_with_super_admin_fails(self):
+        token = api_token(owner_roles=["SUPER_ADMIN"])
+        findings = _run_check(build_api_token_client({token.id: token}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "Super Admin" in findings[0].status_extended
+
+    def test_missing_groups_scope_adds_best_effort_caveat_on_pass(self):
+        token = api_token(owner_roles=["READ_ONLY_ADMIN"])
+        findings = _run_check(
+            build_api_token_client(
+                {token.id: token},
+                missing_scope={"user_groups": "okta.groups.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert "Group-inherited roles were not checked" in findings[0].status_extended
+        assert "okta.groups.read" in findings[0].status_extended
+
+    def test_missing_groups_scope_does_not_caveat_when_owner_is_super_admin(self):
+        token = api_token(owner_roles=["SUPER_ADMIN"])
+        findings = _run_check(
+            build_api_token_client(
+                {token.id: token},
+                missing_scope={"user_groups": "okta.groups.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "Super Admin" in findings[0].status_extended
+        assert "Group-inherited" not in findings[0].status_extended
diff --git a/tests/providers/okta/services/api_token/apitoken_restricted_to_network_zone/apitoken_restricted_to_network_zone_test.py b/tests/providers/okta/services/api_token/apitoken_restricted_to_network_zone/apitoken_restricted_to_network_zone_test.py
new file mode 100644
index 0000000000..9da6f92939
--- /dev/null
+++ b/tests/providers/okta/services/api_token/apitoken_restricted_to_network_zone/apitoken_restricted_to_network_zone_test.py
@@ -0,0 +1,114 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.api_token.api_token_fixtures import (
+    api_token,
+    build_api_token_client,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.apitoken."
+    "apitoken_restricted_to_network_zone.apitoken_restricted_to_network_zone.api_token_client"
+)
+
+
+def _run_check(api_token_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=api_token_client),
+    ):
+        from prowler.providers.okta.services.apitoken.apitoken_restricted_to_network_zone.apitoken_restricted_to_network_zone import (
+            apitoken_restricted_to_network_zone,
+        )
+
+        return apitoken_restricted_to_network_zone().execute()
+
+
+class Test_apitoken_restricted_to_network_zone:
+    def test_no_tokens_returns_no_findings(self):
+        findings = _run_check(build_api_token_client({}))
+        assert findings == []
+
+    def test_missing_api_token_scope_is_manual(self):
+        findings = _run_check(
+            build_api_token_client(
+                {},
+                missing_scope={"api_tokens": "okta.apiTokens.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert "okta.apiTokens.read" in findings[0].status_extended
+        assert "okta.networkZones.read" in findings[0].status_extended
+
+    def test_missing_network_zone_scope_is_manual(self):
+        token = api_token(network_connection="ZONE", network_includes=["nzo-corp"])
+        findings = _run_check(
+            build_api_token_client(
+                {token.id: token},
+                missing_scope={"network_zones": "okta.networkZones.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert findings[0].resource_id == token.id
+        assert "okta.networkZones.read" in findings[0].status_extended
+
+    def test_missing_network_zone_scope_still_fails_anywhere_token(self):
+        token = api_token(network_connection="ANYWHERE", network_includes=[])
+        findings = _run_check(
+            build_api_token_client(
+                {token.id: token},
+                missing_scope={"network_zones": "okta.networkZones.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "from any IP" in findings[0].status_extended
+
+    def test_token_restricted_to_known_network_zone_passes(self):
+        token = api_token(network_connection="ZONE", network_includes=["nzo-corp"])
+        findings = _run_check(
+            build_api_token_client(
+                {token.id: token}, known_network_zone_ids={"nzo-corp"}
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == token.id
+
+    def test_token_with_only_excluded_network_zone_fails(self):
+        token = api_token(
+            network_connection="ZONE",
+            network_includes=[],
+            network_excludes=["nzo-blocked"],
+        )
+        findings = _run_check(
+            build_api_token_client(
+                {token.id: token}, known_network_zone_ids={"nzo-blocked"}
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "does not allowlist" in findings[0].status_extended
+
+    def test_token_open_to_anywhere_fails(self):
+        token = api_token(network_connection="ANYWHERE", network_includes=[])
+        findings = _run_check(build_api_token_client({token.id: token}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "from any IP" in findings[0].status_extended
+
+    def test_token_restricted_to_unknown_zone_fails(self):
+        token = api_token(network_connection="ZONE", network_includes=["nzo-missing"])
+        findings = _run_check(
+            build_api_token_client(
+                {token.id: token}, known_network_zone_ids={"nzo-corp"}
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "unknown Network Zone" in findings[0].status_extended
diff --git a/tests/providers/okta/services/authenticator/authenticator_fixtures.py b/tests/providers/okta/services/authenticator/authenticator_fixtures.py
new file mode 100644
index 0000000000..f15603221b
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_fixtures.py
@@ -0,0 +1,76 @@
+from unittest import mock
+
+from prowler.providers.okta.services.authenticator.authenticator_service import (
+    OktaAuthenticator,
+    PasswordPolicy,
+)
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def build_authenticator_client(
+    password_policies: dict = None,
+    authenticators: dict = None,
+    missing_scope: dict = None,
+):
+    client = mock.MagicMock()
+    client.password_policies = password_policies or {}
+    client.authenticators = authenticators or {}
+    client.missing_scope = missing_scope or {
+        "password_policies": None,
+        "authenticators": None,
+    }
+    client.provider = set_mocked_okta_provider()
+    return client
+
+
+def password_policy(
+    policy_id: str = "pol-password",
+    name: str = "Default Password Policy",
+    *,
+    status: str = "ACTIVE",
+    priority: int = 1,
+    max_attempts: int = 3,
+    min_length: int = 15,
+    min_upper_case: int = 1,
+    min_lower_case: int = 1,
+    min_number: int = 1,
+    min_symbol: int = 1,
+    min_age_minutes: int = 1440,
+    max_age_days: int = 60,
+    history_count: int = 5,
+    common_password_check: bool = True,
+):
+    return PasswordPolicy(
+        id=policy_id,
+        name=name,
+        status=status,
+        priority=priority,
+        max_attempts=max_attempts,
+        min_length=min_length,
+        min_upper_case=min_upper_case,
+        min_lower_case=min_lower_case,
+        min_number=min_number,
+        min_symbol=min_symbol,
+        min_age_minutes=min_age_minutes,
+        max_age_days=max_age_days,
+        history_count=history_count,
+        common_password_check=common_password_check,
+    )
+
+
+def authenticator(
+    auth_id: str = "aut-okta-verify",
+    key: str = "okta_verify",
+    name: str = "Okta Verify",
+    *,
+    status: str = "ACTIVE",
+    fips: str = "REQUIRED",
+):
+    return OktaAuthenticator(
+        id=auth_id,
+        key=key,
+        name=name,
+        status=status,
+        type="app",
+        fips=fips,
+    )
diff --git a/tests/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/authenticator_okta_verify_fips_compliant_test.py b/tests/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/authenticator_okta_verify_fips_compliant_test.py
new file mode 100644
index 0000000000..467dc44611
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_okta_verify_fips_compliant/authenticator_okta_verify_fips_compliant_test.py
@@ -0,0 +1,74 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    authenticator,
+    build_authenticator_client,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_okta_verify_fips_compliant."
+    "authenticator_okta_verify_fips_compliant.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_okta_verify_fips_compliant.authenticator_okta_verify_fips_compliant import (
+            authenticator_okta_verify_fips_compliant,
+        )
+
+        return authenticator_okta_verify_fips_compliant().execute()
+
+
+class Test_authenticator_okta_verify_fips_compliant:
+    def test_okta_verify_fips_required_passes(self):
+        okta_verify = authenticator(key="okta_verify", fips="REQUIRED")
+        findings = _run_check(
+            build_authenticator_client(authenticators={okta_verify.id: okta_verify})
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == okta_verify.id
+
+    def test_okta_verify_without_fips_required_fails(self):
+        okta_verify = authenticator(key="okta_verify", fips="OPTIONAL")
+        findings = _run_check(
+            build_authenticator_client(authenticators={okta_verify.id: okta_verify})
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "FIPS" in findings[0].status_extended
+
+    def test_missing_okta_verify_fails(self):
+        findings = _run_check(build_authenticator_client(authenticators={}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "Okta Verify authenticator is missing." in findings[0].status_extended
+
+    def test_inactive_okta_verify_surfaces_current_status(self):
+        okta_verify = authenticator(key="okta_verify", status="INACTIVE")
+        findings = _run_check(
+            build_authenticator_client(authenticators={okta_verify.id: okta_verify})
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "INACTIVE" in findings[0].status_extended
+
+    def test_missing_authenticators_scope_is_manual(self):
+        findings = _run_check(
+            build_authenticator_client(
+                authenticators={},
+                missing_scope={"authenticators": "okta.authenticators.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert "okta.authenticators.read" in findings[0].status_extended
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_common_password_check/authenticator_password_common_password_check_test.py b/tests/providers/okta/services/authenticator/authenticator_password_common_password_check/authenticator_password_common_password_check_test.py
new file mode 100644
index 0000000000..c0e49deb8c
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_common_password_check/authenticator_password_common_password_check_test.py
@@ -0,0 +1,60 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_common_password_check.authenticator_password_common_password_check.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_common_password_check.authenticator_password_common_password_check import (
+            authenticator_password_common_password_check,
+        )
+
+        return authenticator_password_common_password_check().execute()
+
+
+class Test_authenticator_password_common_password_check:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_missing_password_policies_scope_is_manual(self):
+        findings = _run_check(
+            build_authenticator_client(
+                {},
+                missing_scope={"password_policies": "okta.policies.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert "okta.policies.read" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(common_password_check=True)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(common_password_check=False)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/authenticator_password_complexity_lowercase_test.py b/tests/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/authenticator_password_complexity_lowercase_test.py
new file mode 100644
index 0000000000..8483f46552
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_complexity_lowercase/authenticator_password_complexity_lowercase_test.py
@@ -0,0 +1,49 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_complexity_lowercase.authenticator_password_complexity_lowercase.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_complexity_lowercase.authenticator_password_complexity_lowercase import (
+            authenticator_password_complexity_lowercase,
+        )
+
+        return authenticator_password_complexity_lowercase().execute()
+
+
+class Test_authenticator_password_complexity_lowercase:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(min_lower_case=1)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(min_lower_case=0)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_complexity_number/authenticator_password_complexity_number_test.py b/tests/providers/okta/services/authenticator/authenticator_password_complexity_number/authenticator_password_complexity_number_test.py
new file mode 100644
index 0000000000..cac8f8b444
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_complexity_number/authenticator_password_complexity_number_test.py
@@ -0,0 +1,49 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_complexity_number.authenticator_password_complexity_number.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_complexity_number.authenticator_password_complexity_number import (
+            authenticator_password_complexity_number,
+        )
+
+        return authenticator_password_complexity_number().execute()
+
+
+class Test_authenticator_password_complexity_number:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(min_number=1)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(min_number=0)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_complexity_symbol/authenticator_password_complexity_symbol_test.py b/tests/providers/okta/services/authenticator/authenticator_password_complexity_symbol/authenticator_password_complexity_symbol_test.py
new file mode 100644
index 0000000000..93ed18a36d
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_complexity_symbol/authenticator_password_complexity_symbol_test.py
@@ -0,0 +1,49 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_complexity_symbol.authenticator_password_complexity_symbol.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_complexity_symbol.authenticator_password_complexity_symbol import (
+            authenticator_password_complexity_symbol,
+        )
+
+        return authenticator_password_complexity_symbol().execute()
+
+
+class Test_authenticator_password_complexity_symbol:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(min_symbol=1)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(min_symbol=0)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/authenticator_password_complexity_uppercase_test.py b/tests/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/authenticator_password_complexity_uppercase_test.py
new file mode 100644
index 0000000000..74ab626e52
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_complexity_uppercase/authenticator_password_complexity_uppercase_test.py
@@ -0,0 +1,49 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_complexity_uppercase.authenticator_password_complexity_uppercase.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_complexity_uppercase.authenticator_password_complexity_uppercase import (
+            authenticator_password_complexity_uppercase,
+        )
+
+        return authenticator_password_complexity_uppercase().execute()
+
+
+class Test_authenticator_password_complexity_uppercase:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(min_upper_case=1)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(min_upper_case=0)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_history_5/authenticator_password_history_5_test.py b/tests/providers/okta/services/authenticator/authenticator_password_history_5/authenticator_password_history_5_test.py
new file mode 100644
index 0000000000..e6741c53c2
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_history_5/authenticator_password_history_5_test.py
@@ -0,0 +1,49 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_history_5.authenticator_password_history_5.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_history_5.authenticator_password_history_5 import (
+            authenticator_password_history_5,
+        )
+
+        return authenticator_password_history_5().execute()
+
+
+class Test_authenticator_password_history_5:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(history_count=5)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(history_count=4)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/authenticator_password_lockout_threshold_3_test.py b/tests/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/authenticator_password_lockout_threshold_3_test.py
new file mode 100644
index 0000000000..35c7026e11
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_lockout_threshold_3/authenticator_password_lockout_threshold_3_test.py
@@ -0,0 +1,49 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_lockout_threshold_3.authenticator_password_lockout_threshold_3.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_lockout_threshold_3.authenticator_password_lockout_threshold_3 import (
+            authenticator_password_lockout_threshold_3,
+        )
+
+        return authenticator_password_lockout_threshold_3().execute()
+
+
+class Test_authenticator_password_lockout_threshold_3:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(max_attempts=3)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(max_attempts=4)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/authenticator_password_maximum_age_60d_test.py b/tests/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/authenticator_password_maximum_age_60d_test.py
new file mode 100644
index 0000000000..938b29a290
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_maximum_age_60d/authenticator_password_maximum_age_60d_test.py
@@ -0,0 +1,49 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_maximum_age_60d.authenticator_password_maximum_age_60d.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_maximum_age_60d.authenticator_password_maximum_age_60d import (
+            authenticator_password_maximum_age_60d,
+        )
+
+        return authenticator_password_maximum_age_60d().execute()
+
+
+class Test_authenticator_password_maximum_age_60d:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(max_age_days=60)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(max_age_days=61)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/authenticator_password_minimum_age_24h_test.py b/tests/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/authenticator_password_minimum_age_24h_test.py
new file mode 100644
index 0000000000..0fbe562330
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_minimum_age_24h/authenticator_password_minimum_age_24h_test.py
@@ -0,0 +1,49 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_minimum_age_24h.authenticator_password_minimum_age_24h.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_minimum_age_24h.authenticator_password_minimum_age_24h import (
+            authenticator_password_minimum_age_24h,
+        )
+
+        return authenticator_password_minimum_age_24h().execute()
+
+
+class Test_authenticator_password_minimum_age_24h:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(min_age_minutes=1440)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(min_age_minutes=1439)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
diff --git a/tests/providers/okta/services/authenticator/authenticator_password_minimum_length_15/authenticator_password_minimum_length_15_test.py b/tests/providers/okta/services/authenticator/authenticator_password_minimum_length_15/authenticator_password_minimum_length_15_test.py
new file mode 100644
index 0000000000..2608c42998
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_password_minimum_length_15/authenticator_password_minimum_length_15_test.py
@@ -0,0 +1,62 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    build_authenticator_client,
+    password_policy,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_password_minimum_length_15.authenticator_password_minimum_length_15.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_password_minimum_length_15.authenticator_password_minimum_length_15 import (
+            authenticator_password_minimum_length_15,
+        )
+
+        return authenticator_password_minimum_length_15().execute()
+
+
+class Test_authenticator_password_minimum_length_15:
+    def test_no_active_password_policies_fails(self):
+        findings = _run_check(build_authenticator_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Password Policies" in findings[0].status_extended
+
+    def test_compliant_password_policy_passes(self):
+        policy = password_policy(min_length=15)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == policy.id
+
+    def test_non_compliant_password_policy_fails(self):
+        policy = password_policy(min_length=14)
+        findings = _run_check(build_authenticator_client({policy.id: policy}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert findings[0].resource_id == policy.id
+
+    def test_multiple_active_policies_emit_one_finding_each(self):
+        compliant = password_policy(policy_id="pol-good", name="Strict", min_length=15)
+        weak = password_policy(
+            policy_id="pol-weak", name="Weak", min_length=8, priority=2
+        )
+        findings = _run_check(
+            build_authenticator_client({compliant.id: compliant, weak.id: weak})
+        )
+        assert len(findings) == 2
+        by_name = {finding.resource_name: finding for finding in findings}
+        assert by_name["Strict"].status == "PASS"
+        assert by_name["Weak"].status == "FAIL"
diff --git a/tests/providers/okta/services/authenticator/authenticator_service_test.py b/tests/providers/okta/services/authenticator/authenticator_service_test.py
new file mode 100644
index 0000000000..d66af92ca2
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_service_test.py
@@ -0,0 +1,188 @@
+from types import SimpleNamespace
+from unittest import mock
+
+from prowler.providers.okta.models import OktaIdentityInfo
+from prowler.providers.okta.services.authenticator.authenticator_service import (
+    Authenticator,
+    OktaAuthenticator,
+    PasswordPolicy,
+)
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def _resp(headers: dict = None):
+    return SimpleNamespace(headers=headers or {})
+
+
+def _sdk_password_policy(
+    policy_id: str = "pol-password", name: str = "Default", common_exclude=True
+):
+    return SimpleNamespace(
+        id=policy_id,
+        name=name,
+        priority=1,
+        status="ACTIVE",
+        system=True,
+        settings=SimpleNamespace(
+            password=SimpleNamespace(
+                lockout=SimpleNamespace(max_attempts=3),
+                complexity=SimpleNamespace(
+                    min_length=15,
+                    min_upper_case=1,
+                    min_lower_case=1,
+                    min_number=1,
+                    min_symbol=1,
+                    dictionary=SimpleNamespace(
+                        common=SimpleNamespace(exclude=common_exclude)
+                    ),
+                ),
+                age=SimpleNamespace(
+                    min_age_minutes=1440,
+                    max_age_days=60,
+                    history_count=5,
+                ),
+            )
+        ),
+    )
+
+
+def _sdk_authenticator(
+    auth_id: str = "aut-okta-verify",
+    key: str = "okta_verify",
+    status: str = "ACTIVE",
+    fips: str = "REQUIRED",
+):
+    return SimpleNamespace(
+        id=auth_id,
+        key=key,
+        name="Okta Verify" if key == "okta_verify" else "Smart Card IdP",
+        status=status,
+        type="app",
+        settings=SimpleNamespace(compliance=SimpleNamespace(fips=fips)),
+    )
+
+
+class Test_Authenticator_service:
+    def test_fetches_password_policies_and_authenticators(self):
+        provider = set_mocked_okta_provider()
+        policy = _sdk_password_policy()
+        okta_verify = _sdk_authenticator()
+
+        async def fake_list_policies(*_a, **_k):
+            return ([policy], _resp({}), None)
+
+        async def fake_list_authenticators(*_a, **_k):
+            return ([okta_verify], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_policies = fake_list_policies
+            mocked.list_authenticators = fake_list_authenticators
+            mocked_client_cls.return_value = mocked
+
+            service = Authenticator(provider)
+
+        assert isinstance(service.password_policies[policy.id], PasswordPolicy)
+        assert service.password_policies[policy.id].min_length == 15
+        assert service.password_policies[policy.id].common_password_check is True
+        assert isinstance(service.authenticators[okta_verify.id], OktaAuthenticator)
+        assert service.authenticators[okta_verify.id].fips == "REQUIRED"
+
+    def test_common_password_exclude_false_is_not_compliant(self):
+        provider = set_mocked_okta_provider()
+        policy = _sdk_password_policy(common_exclude=False)
+
+        async def fake_list_policies(*_a, **_k):
+            return ([policy], _resp({}), None)
+
+        async def fake_list_authenticators(*_a, **_k):
+            return ([], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_policies = fake_list_policies
+            mocked.list_authenticators = fake_list_authenticators
+            mocked_client_cls.return_value = mocked
+            service = Authenticator(provider)
+
+        assert service.password_policies[policy.id].common_password_check is False
+
+    def test_paginates_password_policies(self):
+        provider = set_mocked_okta_provider()
+        page_1 = _sdk_password_policy("pol-1", "First")
+        page_2 = _sdk_password_policy("pol-2", "Second")
+        quote = chr(34)
+        next_link = (
+            "<https://acme.okta.com/api/v1/policies?type=PASSWORD&after=cursor-2>; "
+            f"rel={quote}next{quote}"
+        )
+        calls = []
+
+        async def fake_list_policies(*_a, **kwargs):
+            calls.append(kwargs.get("after"))
+            if kwargs.get("after") is None:
+                return ([page_1], _resp({"link": next_link}), None)
+            return ([page_2], _resp({}), None)
+
+        async def fake_list_authenticators(*_a, **_k):
+            return ([], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_policies = fake_list_policies
+            mocked.list_authenticators = fake_list_authenticators
+            mocked_client_cls.return_value = mocked
+            service = Authenticator(provider)
+
+        assert calls == [None, "cursor-2"]
+        assert set(service.password_policies.keys()) == {"pol-1", "pol-2"}
+
+    def test_missing_scopes_skip_dependent_api_calls(self):
+        provider = set_mocked_okta_provider(
+            identity=OktaIdentityInfo(
+                org_domain="acme.okta.com",
+                client_id="0oa1234567890abcdef",
+                granted_scopes=["okta.apps.read"],
+            )
+        )
+
+        async def fail_if_called(*_a, **_k):
+            raise AssertionError("Authenticator API calls should not run")
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_policies = fail_if_called
+            mocked.list_authenticators = fail_if_called
+            mocked_client_cls.return_value = mocked
+            service = Authenticator(provider)
+
+        assert service.missing_scope["password_policies"] == "okta.policies.read"
+        assert service.missing_scope["authenticators"] == "okta.authenticators.read"
+        assert service.password_policies == {}
+        assert service.authenticators == {}
+
+    def test_returns_empty_collections_on_api_errors(self):
+        provider = set_mocked_okta_provider()
+
+        async def failing(*_a, **_k):
+            return ([], _resp({}), Exception("forbidden"))
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_policies = failing
+            mocked.list_authenticators = failing
+            mocked_client_cls.return_value = mocked
+            service = Authenticator(provider)
+
+        assert service.password_policies == {}
+        assert service.authenticators == {}
diff --git a/tests/providers/okta/services/authenticator/authenticator_smart_card_active/authenticator_smart_card_active_test.py b/tests/providers/okta/services/authenticator/authenticator_smart_card_active/authenticator_smart_card_active_test.py
new file mode 100644
index 0000000000..c85527f0be
--- /dev/null
+++ b/tests/providers/okta/services/authenticator/authenticator_smart_card_active/authenticator_smart_card_active_test.py
@@ -0,0 +1,74 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.authenticator.authenticator_fixtures import (
+    authenticator,
+    build_authenticator_client,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.authenticator."
+    "authenticator_smart_card_active.authenticator_smart_card_active.authenticator_client"
+)
+
+
+def _run_check(authenticator_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=authenticator_client),
+    ):
+        from prowler.providers.okta.services.authenticator.authenticator_smart_card_active.authenticator_smart_card_active import (
+            authenticator_smart_card_active,
+        )
+
+        return authenticator_smart_card_active().execute()
+
+
+class Test_authenticator_smart_card_active:
+    def test_smart_card_active_passes(self):
+        smart_card = authenticator(
+            auth_id="aut-smart-card",
+            key="smart_card_idp",
+            name="Smart Card IdP",
+            status="ACTIVE",
+        )
+        findings = _run_check(
+            build_authenticator_client(authenticators={smart_card.id: smart_card})
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert findings[0].resource_id == smart_card.id
+
+    def test_missing_smart_card_fails(self):
+        findings = _run_check(build_authenticator_client(authenticators={}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "not active" in findings[0].status_extended
+
+    def test_missing_authenticators_scope_is_manual(self):
+        findings = _run_check(
+            build_authenticator_client(
+                authenticators={},
+                missing_scope={"authenticators": "okta.authenticators.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert "okta.authenticators.read" in findings[0].status_extended
+
+    def test_inactive_smart_card_fails(self):
+        smart_card = authenticator(
+            auth_id="aut-smart-card",
+            key="smart_card_idp",
+            name="Smart Card IdP",
+            status="INACTIVE",
+        )
+        findings = _run_check(
+            build_authenticator_client(authenticators={smart_card.id: smart_card})
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "INACTIVE" in findings[0].status_extended
diff --git a/tests/providers/okta/services/idp/idp_fixtures.py b/tests/providers/okta/services/idp/idp_fixtures.py
new file mode 100644
index 0000000000..8ebc449717
--- /dev/null
+++ b/tests/providers/okta/services/idp/idp_fixtures.py
@@ -0,0 +1,44 @@
+"""Shared helpers for `idp` service check tests."""
+
+from unittest import mock
+
+from prowler.providers.okta.services.idp.idp_service import OktaIdentityProvider
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def build_idp_client(
+    identity_providers: dict = None,
+    missing_scope: dict = None,
+):
+    client = mock.MagicMock()
+    client.identity_providers = identity_providers or {}
+    client.provider = set_mocked_okta_provider()
+    client.audit_config = {}
+    client.missing_scope = missing_scope or {"identity_providers": None}
+    return client
+
+
+def smart_card_idp(
+    idp_id: str = "0oa-x509",
+    name: str = "CAC IdP",
+    status: str = "ACTIVE",
+    issuer: str = "CN=DOD ROOT CA 6",
+    kid: str = "kid-abc-123",
+):
+    return OktaIdentityProvider(
+        id=idp_id,
+        name=name,
+        type="X509",
+        status=status,
+        trust_issuer=issuer,
+        trust_kid=kid,
+    )
+
+
+def non_smart_card_idp(
+    idp_id: str = "0oa-saml",
+    name: str = "Corporate SAML",
+    type: str = "SAML2",
+    status: str = "ACTIVE",
+):
+    return OktaIdentityProvider(id=idp_id, name=name, type=type, status=status)
diff --git a/tests/providers/okta/services/idp/idp_service_test.py b/tests/providers/okta/services/idp/idp_service_test.py
new file mode 100644
index 0000000000..3c30c0d3eb
--- /dev/null
+++ b/tests/providers/okta/services/idp/idp_service_test.py
@@ -0,0 +1,80 @@
+import json
+from unittest import mock
+
+from okta.models.identity_provider_protocol import IdentityProviderProtocol
+
+from prowler.providers.okta.services.idp.idp_service import Idp, OktaIdentityProvider
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def _resp(headers: dict = None):
+    r = mock.MagicMock()
+    r.headers = headers or {}
+    return r
+
+
+def _fake_idp(idp_id, name, type_, status="ACTIVE", issuer=None, kid=None):
+    # Build a real `IdentityProviderProtocol` when issuer/kid are provided
+    # so the test exercises the SDK's Pydantic v2 oneOf wrapper — credentials
+    # live on `actual_instance`, not directly on the wrapper. MagicMock
+    # auto-attribute-creation would otherwise hide a missed unwrap.
+    idp = mock.MagicMock()
+    idp.id = idp_id
+    idp.name = name
+    idp.type = type_
+    idp.status = status
+    if issuer is None and kid is None:
+        idp.protocol = None
+    else:
+        idp.protocol = IdentityProviderProtocol.from_json(
+            json.dumps(
+                {
+                    "type": "MTLS",
+                    "credentials": {"trust": {"issuer": issuer, "kid": kid}},
+                }
+            )
+        )
+    return idp
+
+
+def _patch_sdk(**methods):
+    return mock.patch(
+        "prowler.providers.okta.lib.service.service.OktaSDKClient",
+        return_value=mock.MagicMock(**methods),
+    )
+
+
+class Test_Idp_service:
+    def test_fetches_idps_with_trust_fields(self):
+        provider = set_mocked_okta_provider()
+        x509 = _fake_idp(
+            "0oa1",
+            "CAC",
+            "X509",
+            issuer="CN=DOD ROOT CA 6",
+            kid="kid-1",
+        )
+        saml = _fake_idp("0oa2", "Corp", "SAML2")
+
+        async def fake_list(*_a, **_k):
+            return ([x509, saml], _resp({}), None)
+
+        with _patch_sdk(list_identity_providers=fake_list):
+            service = Idp(provider)
+
+        assert set(service.identity_providers.keys()) == {"0oa1", "0oa2"}
+        assert isinstance(service.identity_providers["0oa1"], OktaIdentityProvider)
+        assert service.identity_providers["0oa1"].trust_issuer == "CN=DOD ROOT CA 6"
+        assert service.identity_providers["0oa1"].trust_kid == "kid-1"
+        assert service.identity_providers["0oa2"].trust_issuer is None
+
+    def test_returns_empty_on_api_error(self):
+        provider = set_mocked_okta_provider()
+
+        async def failing(*_a, **_k):
+            return ([], _resp({}), Exception("API failure"))
+
+        with _patch_sdk(list_identity_providers=failing):
+            service = Idp(provider)
+
+        assert service.identity_providers == {}
diff --git a/tests/providers/okta/services/idp/idp_smart_card_dod_approved_ca/idp_smart_card_dod_approved_ca_test.py b/tests/providers/okta/services/idp/idp_smart_card_dod_approved_ca/idp_smart_card_dod_approved_ca_test.py
new file mode 100644
index 0000000000..f6517e14a9
--- /dev/null
+++ b/tests/providers/okta/services/idp/idp_smart_card_dod_approved_ca/idp_smart_card_dod_approved_ca_test.py
@@ -0,0 +1,125 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.idp.idp_fixtures import (
+    build_idp_client,
+    non_smart_card_idp,
+    smart_card_idp,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.idp."
+    "idp_smart_card_dod_approved_ca.idp_smart_card_dod_approved_ca.idp_client"
+)
+
+DOD_PKI_ISSUER = "CN=DoD ID CA-59, OU=PKI, OU=DoD, O=U.S. Government, C=US"
+ECA_ISSUER = "CN=ECA Root CA 4, OU=ECA, O=U.S. Government, C=US"
+NON_DOD_ISSUER = "CN=ACME Internal Root, O=Acme Corp, C=US"
+
+
+def _run_check(client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=client),
+    ):
+        from prowler.providers.okta.services.idp.idp_smart_card_dod_approved_ca.idp_smart_card_dod_approved_ca import (
+            idp_smart_card_dod_approved_ca,
+        )
+
+        return idp_smart_card_dod_approved_ca().execute()
+
+
+class Test_idp_smart_card_dod_approved_ca:
+    def test_pass_when_active_idp_chain_matches_dod_pki_pattern(self):
+        idp = smart_card_idp(name="CAC", issuer=DOD_PKI_ISSUER, kid="kid-x")
+        client = build_idp_client(identity_providers={idp.id: idp})
+        findings = _run_check(client)
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert "OU=DoD" in findings[0].status_extended
+        assert DOD_PKI_ISSUER in findings[0].status_extended
+
+    def test_pass_when_active_idp_chain_matches_eca_pattern(self):
+        idp = smart_card_idp(name="ECA Partner", issuer=ECA_ISSUER, kid="kid-e")
+        client = build_idp_client(identity_providers={idp.id: idp})
+        findings = _run_check(client)
+        assert findings[0].status == "PASS"
+        assert "OU=ECA" in findings[0].status_extended
+
+    def test_manual_when_active_but_issuer_does_not_match_any_pattern(self):
+        idp = smart_card_idp(name="Custom", issuer=NON_DOD_ISSUER, kid="kid-c")
+        client = build_idp_client(identity_providers={idp.id: idp})
+        findings = _run_check(client)
+        assert findings[0].status == "MANUAL"
+        assert NON_DOD_ISSUER in findings[0].status_extended
+        assert "okta_dod_approved_ca_issuer_patterns" in findings[0].status_extended
+
+    def test_pass_when_audit_config_pattern_matches(self):
+        idp = smart_card_idp(name="Custom DOD", issuer=NON_DOD_ISSUER, kid="kid-c")
+        client = build_idp_client(identity_providers={idp.id: idp})
+        client.audit_config = {
+            "okta_dod_approved_ca_issuer_patterns": [r"CN=ACME Internal Root"]
+        }
+        findings = _run_check(client)
+        assert findings[0].status == "PASS"
+
+    def test_audit_config_overrides_bundled_defaults(self):
+        # When the operator supplies a list, the bundled DEFAULT patterns
+        # are replaced (not merged) so customers can carve out a strict set.
+        idp = smart_card_idp(name="DoD", issuer=DOD_PKI_ISSUER, kid="kid-x")
+        client = build_idp_client(identity_providers={idp.id: idp})
+        client.audit_config = {
+            "okta_dod_approved_ca_issuer_patterns": [r"CN=YourTenantCustomDodCA"]
+        }
+        findings = _run_check(client)
+        assert findings[0].status == "MANUAL"
+
+    def test_malformed_audit_config_pattern_skipped(self):
+        # An invalid regex from the operator must not crash the whole check.
+        idp = smart_card_idp(name="CAC", issuer=DOD_PKI_ISSUER, kid="kid-x")
+        client = build_idp_client(identity_providers={idp.id: idp})
+        client.audit_config = {
+            "okta_dod_approved_ca_issuer_patterns": [r"[invalid(regex", r"OU=DoD"]
+        }
+        findings = _run_check(client)
+        assert findings[0].status == "PASS"
+
+    def test_fail_when_x509_idp_is_inactive(self):
+        idp = smart_card_idp(status="INACTIVE", issuer=DOD_PKI_ISSUER)
+        client = build_idp_client(identity_providers={idp.id: idp})
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        assert "INACTIVE" in findings[0].status_extended
+
+    def test_fail_when_no_smart_card_idp_configured(self):
+        client = build_idp_client(identity_providers={"saml": non_smart_card_idp()})
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        assert (
+            "No Smart Card (X509) Identity Providers are configured"
+            in findings[0].status_extended
+        )
+        assert "mutelist" in findings[0].status_extended
+
+    def test_manual_when_idps_scope_missing(self):
+        client = build_idp_client(
+            missing_scope={"identity_providers": "okta.idps.read"}
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "MANUAL"
+        assert "okta.idps.read" in findings[0].status_extended
+
+    def test_multiple_x509_idps_yield_one_finding_each(self):
+        idp_a = smart_card_idp(idp_id="0oa-a", name="A", issuer=DOD_PKI_ISSUER)
+        idp_b = smart_card_idp(
+            idp_id="0oa-b", name="B", status="INACTIVE", issuer=DOD_PKI_ISSUER
+        )
+        client = build_idp_client(identity_providers={idp_a.id: idp_a, idp_b.id: idp_b})
+        findings = _run_check(client)
+        assert len(findings) == 2
+        # We don't strictly assert ordering — just that both are covered.
+        statuses = sorted(f.status for f in findings)
+        assert statuses == ["FAIL", "PASS"]
diff --git a/tests/providers/okta/services/network_zone/network_zone_block_anonymized_proxies/network_zone_block_anonymized_proxies_test.py b/tests/providers/okta/services/network_zone/network_zone_block_anonymized_proxies/network_zone_block_anonymized_proxies_test.py
new file mode 100644
index 0000000000..89cc2fd8ed
--- /dev/null
+++ b/tests/providers/okta/services/network_zone/network_zone_block_anonymized_proxies/network_zone_block_anonymized_proxies_test.py
@@ -0,0 +1,153 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.network_zone.network_zone_fixtures import (
+    build_network_zone_client,
+    network_zone,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.network."
+    "network_zone_block_anonymized_proxies."
+    "network_zone_block_anonymized_proxies.network_zone_client"
+)
+
+
+def _run_check(network_zone_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=network_zone_client),
+    ):
+        from prowler.providers.okta.services.network.network_zone_block_anonymized_proxies.network_zone_block_anonymized_proxies import (
+            network_zone_block_anonymized_proxies,
+        )
+
+        return network_zone_block_anonymized_proxies().execute()
+
+
+class Test_network_zone_block_anonymized_proxies:
+    def test_no_zones_fails(self):
+        findings = _run_check(build_network_zone_client({}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "No active Okta Network Zone blocklist" in findings[0].status_extended
+
+    def test_missing_network_zone_scope_is_manual(self):
+        findings = _run_check(
+            build_network_zone_client(
+                {},
+                missing_scope={"network_zones": "okta.networkZones.read"},
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert "okta.networkZones.read" in findings[0].status_extended
+
+    def test_sdk_network_zone_retrieval_error_is_manual(self):
+        findings = _run_check(
+            build_network_zone_client(
+                {},
+                retrieval_error="Error listing Network Zones: forbidden",
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert "could not be retrieved" in findings[0].status_extended
+        assert "forbidden" in findings[0].status_extended
+
+    def test_raw_network_zone_retrieval_error_is_manual(self):
+        findings = _run_check(
+            build_network_zone_client(
+                {},
+                retrieval_error="Raw Network Zones fetch (execute) failed: timeout",
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert "could not be retrieved" in findings[0].status_extended
+        assert "timeout" in findings[0].status_extended
+
+    def test_active_ip_blocklist_gateway_is_manual(self):
+        zone = network_zone(gateways=["198.51.100.10/32"])
+        findings = _run_check(build_network_zone_client({zone.id: zone}))
+        assert len(findings) == 1
+        assert findings[0].status == "MANUAL"
+        assert findings[0].resource_id == zone.id
+        assert "manual IP blocklist" in findings[0].status_extended
+        assert "cannot verify full anonymizer coverage" in findings[0].status_extended
+
+    def test_pass_with_active_enhanced_dynamic_anonymizer_blocklist(self):
+        zone = network_zone(
+            zone_id="nzo-enhanced",
+            name="DefaultEnhancedDynamicZone",
+            zone_type="DYNAMIC_V2",
+            system=True,
+            ip_service_categories=["ANONYMIZER"],
+        )
+        findings = _run_check(build_network_zone_client({zone.id: zone}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert "Enhanced Dynamic" in findings[0].status_extended
+
+    def test_pass_with_custom_enhanced_dynamic_anonymizer_blocklist(self):
+        zone = network_zone(
+            zone_id="nzo-custom-enhanced",
+            name="Custom Anonymous VPN Blocklist",
+            zone_type="DYNAMIC_V2",
+            system=False,
+            ip_service_categories=["VPN"],
+        )
+        findings = _run_check(build_network_zone_client({zone.id: zone}))
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert "Enhanced Dynamic" in findings[0].status_extended
+
+    def test_dynamic_blocklist_without_anonymizer_category_fails(self):
+        zone = network_zone(
+            zone_id="nzo-dynamic",
+            name="Dynamic Blocklist Without Anonymizers",
+            zone_type="DYNAMIC",
+            ip_service_categories=["RISKY_IPS"],
+        )
+        findings = _run_check(build_network_zone_client({zone.id: zone}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "do not actively block" in findings[0].status_extended
+
+    def test_default_enhanced_dynamic_zone_without_categories_fails(self):
+        zone = network_zone(
+            zone_id="nzo-default-enhanced",
+            name="DefaultEnhancedDynamicZone",
+            zone_type="DYNAMIC_V2",
+            system=True,
+            ip_service_categories=[],
+        )
+        findings = _run_check(build_network_zone_client({zone.id: zone}))
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "do not actively block" in findings[0].status_extended
+
+    def test_existing_zones_without_anonymized_proxy_blocklist_fail(self):
+        policy_zone = network_zone(
+            zone_id="nzo-policy",
+            name="Corporate Policy Zone",
+            usage="POLICY",
+            gateways=["10.0.0.0/8"],
+        )
+        inactive_blocklist = network_zone(
+            zone_id="nzo-inactive",
+            name="Inactive Blocklist",
+            status="INACTIVE",
+            gateways=["203.0.113.0/24"],
+        )
+        findings = _run_check(
+            build_network_zone_client(
+                {policy_zone.id: policy_zone, inactive_blocklist.id: inactive_blocklist}
+            )
+        )
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "do not actively block" in findings[0].status_extended
diff --git a/tests/providers/okta/services/network_zone/network_zone_fixtures.py b/tests/providers/okta/services/network_zone/network_zone_fixtures.py
new file mode 100644
index 0000000000..09328a5d73
--- /dev/null
+++ b/tests/providers/okta/services/network_zone/network_zone_fixtures.py
@@ -0,0 +1,42 @@
+from unittest import mock
+
+from prowler.providers.okta.services.network.network_zone_service import OktaNetworkZone
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def build_network_zone_client(
+    zones: dict = None,
+    missing_scope: dict = None,
+    retrieval_error: str | None = None,
+):
+    client = mock.MagicMock()
+    client.network_zones = zones or {}
+    client.missing_scope = missing_scope or {"network_zones": None}
+    client.retrieval_error = retrieval_error
+    client.provider = set_mocked_okta_provider()
+    return client
+
+
+def network_zone(
+    zone_id: str = "nzo-1",
+    name: str = "BlockedIpZone",
+    *,
+    status: str = "ACTIVE",
+    zone_type: str = "IP",
+    usage: str = "BLOCKLIST",
+    system: bool = False,
+    gateways: list[str] = None,
+    proxies: list[str] = None,
+    ip_service_categories: list[str] = None,
+):
+    return OktaNetworkZone(
+        id=zone_id,
+        name=name,
+        status=status,
+        type=zone_type,
+        usage=usage,
+        system=system,
+        gateways=gateways or [],
+        proxies=proxies or [],
+        ip_service_categories=ip_service_categories or [],
+    )
diff --git a/tests/providers/okta/services/network_zone/network_zone_service_test.py b/tests/providers/okta/services/network_zone/network_zone_service_test.py
new file mode 100644
index 0000000000..36790c1328
--- /dev/null
+++ b/tests/providers/okta/services/network_zone/network_zone_service_test.py
@@ -0,0 +1,560 @@
+import json
+from types import SimpleNamespace
+from unittest import mock
+
+from pydantic import ValidationError
+
+from prowler.providers.okta.models import OktaIdentityInfo
+from prowler.providers.okta.services.network.network_zone_service import (
+    NetworkZone,
+    OktaNetworkZone,
+    _raw_zone_to_model,
+    _value,
+)
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def _resp(headers: dict = None):
+    return SimpleNamespace(headers=headers or {})
+
+
+def _sdk_zone(
+    zone_id: str,
+    name: str,
+    *,
+    status: str = "ACTIVE",
+    zone_type: str = "IP",
+    usage: str = "BLOCKLIST",
+    system: bool = False,
+    gateways: list[str] = None,
+    proxies: list[str] = None,
+    ip_service_categories: list[str] = None,
+):
+    return SimpleNamespace(
+        id=zone_id,
+        name=name,
+        status=status,
+        type=zone_type,
+        usage=usage,
+        system=system,
+        gateways=gateways or [],
+        proxies=proxies or [],
+        ip_service_categories=ip_service_categories or [],
+    )
+
+
+class _ValueObject:
+    def __init__(self, value: str):
+        self.value = value
+
+
+class Test_value_helper:
+    def test_value_returns_empty_string_for_none(self):
+        assert _value(None) == ""
+
+
+class Test_NetworkZone_service:
+    def test_fetches_ip_and_enhanced_dynamic_zones(self):
+        provider = set_mocked_okta_provider()
+        ip_zone = _sdk_zone(
+            "nzo-ip",
+            "Blocked IPs",
+            gateways=["203.0.113.10/32"],
+        )
+        enhanced_zone = _sdk_zone(
+            "nzo-enhanced",
+            "DefaultEnhancedDynamicZone",
+            zone_type="DYNAMIC_V2",
+            system=True,
+            ip_service_categories=["ANONYMIZER"],
+        )
+
+        async def fake_list_network_zones(*_a, **_k):
+            return ([ip_zone, enhanced_zone], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_network_zones = fake_list_network_zones
+            mocked_client_cls.return_value = mocked
+
+            service = NetworkZone(provider)
+
+        assert set(service.network_zones.keys()) == {"nzo-ip", "nzo-enhanced"}
+        assert isinstance(service.network_zones["nzo-ip"], OktaNetworkZone)
+        assert service.network_zones["nzo-ip"].gateways == ["203.0.113.10/32"]
+        assert service.network_zones["nzo-enhanced"].type == "DYNAMIC_V2"
+        assert service.network_zones["nzo-enhanced"].ip_service_categories == [
+            "ANONYMIZER"
+        ]
+
+    def test_paginates_network_zones(self):
+        provider = set_mocked_okta_provider()
+        page_1 = _sdk_zone("nzo-1", "First")
+        page_2 = _sdk_zone("nzo-2", "Second")
+        next_link = '<https://acme.okta.com/api/v1/zones?after=cursor-2>; rel="next"'
+        calls = []
+
+        async def fake_list_network_zones(*_a, **kwargs):
+            calls.append(kwargs.get("after"))
+            if kwargs.get("after") is None:
+                return ([page_1], _resp({"link": next_link}), None)
+            return ([page_2], _resp({}), None)
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_network_zones = fake_list_network_zones
+            mocked_client_cls.return_value = mocked
+            service = NetworkZone(provider)
+
+        assert calls == [None, "cursor-2"]
+        assert set(service.network_zones.keys()) == {"nzo-1", "nzo-2"}
+
+    def test_preserves_sdk_error_reason_on_api_error(self):
+        provider = set_mocked_okta_provider()
+
+        async def failing(*_a, **_k):
+            return ([], _resp({}), Exception("forbidden"))
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_network_zones = failing
+            mocked_client_cls.return_value = mocked
+            service = NetworkZone(provider)
+
+        assert service.network_zones == {}
+        assert service.retrieval_error == "Error listing Network Zones: forbidden"
+
+    def test_build_zone_extracts_sdk_network_zone_address_values(self):
+        from okta.models.network_zone_address import NetworkZoneAddress
+
+        zone = _sdk_zone(
+            "nzo-ip",
+            "Blocked IPs",
+            gateways=[
+                NetworkZoneAddress(
+                    type="CIDR",
+                    value="203.0.113.10/32",
+                )
+            ],
+            proxies=[
+                NetworkZoneAddress(
+                    type="CIDR",
+                    value="198.51.100.10/32",
+                )
+            ],
+        )
+
+        built_zone = NetworkZone._build_zone(zone)
+
+        assert built_zone.gateways == ["203.0.113.10/32"]
+        assert built_zone.proxies == ["198.51.100.10/32"]
+
+    def test_build_zone_normalizes_sdk_value_objects_to_strings(self):
+        zone = _sdk_zone(
+            "nzo-sdk-values",
+            "SDK Values",
+            gateways=[_ValueObject("203.0.113.10/32")],
+            proxies=[_ValueObject("198.51.100.10/32")],
+        )
+        zone.asns = SimpleNamespace(include=[_ValueObject("64512")], exclude=[])
+        zone.locations = SimpleNamespace(include=[_ValueObject("US")], exclude=[])
+
+        built_zone = NetworkZone._build_zone(zone)
+
+        assert built_zone.gateways == ["203.0.113.10/32"]
+        assert built_zone.proxies == ["198.51.100.10/32"]
+        assert built_zone.asns == ["64512"]
+        assert built_zone.locations == ["US"]
+
+    def test_build_zone_extracts_sdk_enhanced_dynamic_category_values(self):
+        from okta.models.enhanced_dynamic_network_zone_all_of_ip_service_categories import (
+            EnhancedDynamicNetworkZoneAllOfIpServiceCategories,
+        )
+
+        zone = _sdk_zone(
+            "nzo-enhanced",
+            "Enhanced Anonymizers",
+            zone_type="DYNAMIC_V2",
+            system=False,
+        )
+        zone.ip_service_categories = EnhancedDynamicNetworkZoneAllOfIpServiceCategories(
+            include=["ALL_ANONYMIZERS"],
+            exclude=[],
+        )
+
+        built_zone = NetworkZone._build_zone(zone)
+
+        assert built_zone.ip_service_categories == ["ALL_ANONYMIZERS"]
+
+    def test_missing_network_zone_scope_skips_api_call(self):
+        provider = set_mocked_okta_provider(
+            identity=OktaIdentityInfo(
+                org_domain="acme.okta.com",
+                client_id="0oa1234567890abcdef",
+                granted_scopes=["okta.policies.read", "okta.brands.read"],
+            )
+        )
+
+        async def fail_if_called(*_a, **_k):
+            raise AssertionError("list_network_zones should not be called")
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient"
+        ) as mocked_client_cls:
+            mocked = mock.MagicMock()
+            mocked.list_network_zones = fail_if_called
+            mocked_client_cls.return_value = mocked
+            service = NetworkZone(provider)
+
+        assert service.missing_scope["network_zones"] == "okta.networkZones.read"
+        assert service.network_zones == {}
+
+
+class Test_NetworkZone_service_sdk_validation_fallback:
+    """Verifies the raw-JSON fallback for the Okta SDK Enhanced Dynamic
+    Zone deserialization bug.
+
+    The Okta Management API returns `asns.include` as a JSON array
+    (typically `[]`) but the SDK's `EnhancedDynamicNetworkZoneAllOfAsnsInclude`
+    is an object-shaped pydantic model — so listing zones raises
+    ValidationError. Without a fallback the whole fetch crashes and
+    every check FAILs as if no zones exist; with the fallback we parse
+    the raw JSON and STIG evaluation continues.
+    """
+
+    @staticmethod
+    def _trigger_real_validation_error() -> ValidationError:
+        try:
+            from okta.models.enhanced_dynamic_network_zone_all_of_asns_include import (  # noqa: E501
+                EnhancedDynamicNetworkZoneAllOfAsnsInclude,
+            )
+
+            EnhancedDynamicNetworkZoneAllOfAsnsInclude.from_dict([])
+        except ValidationError as ve:
+            return ve
+        raise AssertionError("Expected pydantic ValidationError from Okta SDK model")
+
+    def _build_service_with_raw_payload(
+        self, raw_zones_payload, response=None, body_factory=None
+    ):
+        response_body = (
+            body_factory(raw_zones_payload)
+            if body_factory
+            else json.dumps(raw_zones_payload)
+        )
+        return self._build_service_with_raw_response(response_body, response=response)
+
+    def _build_service_with_raw_response(
+        self, response_body, response=None, execute_error=None
+    ):
+        provider = set_mocked_okta_provider()
+        ve = self._trigger_real_validation_error()
+
+        async def failing_list_network_zones(*_a, **_k):
+            raise ve
+
+        async def fake_raw_create(*_a, **_k):
+            return ({"url": "/api/v1/zones"}, None)
+
+        async def fake_raw_execute(_request):
+            return (response, response_body, execute_error)
+
+        sdk_mock = mock.MagicMock()
+        sdk_mock.list_network_zones = failing_list_network_zones
+        sdk_mock._request_executor.create_request = fake_raw_create
+        sdk_mock._request_executor.execute = fake_raw_execute
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk_mock,
+        ):
+            return NetworkZone(provider)
+
+    def test_raw_fallback_projects_ip_and_enhanced_dynamic_zones(self):
+        zones_payload = [
+            {
+                "id": "nzo-ip",
+                "name": "Blocked IPs",
+                "status": "ACTIVE",
+                "type": "IP",
+                "usage": "BLOCKLIST",
+                "system": False,
+                "gateways": [{"type": "CIDR", "value": "203.0.113.10/32"}],
+                "proxies": [],
+            },
+            {
+                "id": "nzo-enhanced",
+                "name": "DefaultEnhancedDynamicZone",
+                "status": "ACTIVE",
+                "type": "DYNAMIC_V2",
+                "usage": "BLOCKLIST",
+                "system": True,
+                "asns": {"include": [], "exclude": []},
+                "locations": {"include": [], "exclude": []},
+                "ipServiceCategories": [{"value": "ANONYMIZER"}],
+            },
+        ]
+
+        service = self._build_service_with_raw_payload(zones_payload)
+
+        assert set(service.network_zones.keys()) == {"nzo-ip", "nzo-enhanced"}
+        ip_zone = service.network_zones["nzo-ip"]
+        assert ip_zone.type == "IP"
+        assert ip_zone.gateways == ["203.0.113.10/32"]
+        enhanced = service.network_zones["nzo-enhanced"]
+        assert enhanced.type == "DYNAMIC_V2"
+        assert enhanced.system is True
+        assert enhanced.ip_service_categories == ["ANONYMIZER"]
+        assert enhanced.asns == []
+        assert enhanced.locations == []
+
+    def test_raw_fallback_handles_empty_payload(self):
+        service = self._build_service_with_raw_payload([])
+        assert service.network_zones == {}
+
+    def test_raw_fallback_handles_executor_error(self):
+        provider = set_mocked_okta_provider()
+        ve = self._trigger_real_validation_error()
+
+        async def failing_list_network_zones(*_a, **_k):
+            raise ve
+
+        async def fake_raw_create(*_a, **_k):
+            return (None, Exception("network down"))
+
+        sdk_mock = mock.MagicMock()
+        sdk_mock.list_network_zones = failing_list_network_zones
+        sdk_mock._request_executor.create_request = fake_raw_create
+        sdk_mock._request_executor.execute = mock.AsyncMock()
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk_mock,
+        ):
+            service = NetworkZone(provider)
+
+        assert service.network_zones == {}
+        assert service.retrieval_error == (
+            "Raw Network Zones fetch failed; see logs for details."
+        )
+
+    def test_raw_fallback_handles_execute_error(self):
+        service = self._build_service_with_raw_response(
+            None,
+            execute_error=Exception("timeout"),
+        )
+
+        assert service.network_zones == {}
+        assert service.retrieval_error == (
+            "Raw Network Zones fetch failed; see logs for details."
+        )
+
+    def test_raw_fallback_decodes_bytes_response_body(self):
+        service = self._build_service_with_raw_payload(
+            [
+                {
+                    "id": "nzo-bytes",
+                    "name": "Bytes",
+                    "status": "ACTIVE",
+                    "type": "IP",
+                    "usage": "BLOCKLIST",
+                }
+            ],
+            body_factory=lambda payload: json.dumps(payload).encode("utf-8"),
+        )
+
+        assert set(service.network_zones.keys()) == {"nzo-bytes"}
+
+    def test_raw_fallback_handles_invalid_utf8_response_body(self):
+        service = self._build_service_with_raw_response(b"\xff")
+
+        assert service.network_zones == {}
+        assert service.retrieval_error == (
+            "Raw Network Zones fetch failed; see logs for details."
+        )
+
+    def test_raw_fallback_handles_invalid_json_response_body(self):
+        service = self._build_service_with_raw_response("{")
+
+        assert service.network_zones == {}
+        assert service.retrieval_error == (
+            "Raw Network Zones fetch failed; see logs for details."
+        )
+
+    def test_raw_fallback_handles_unexpected_payload_shape(self):
+        service = self._build_service_with_raw_payload({"id": "nzo-not-a-list"})
+
+        assert service.network_zones == {}
+        assert service.retrieval_error == (
+            "Raw Network Zones fetch failed; see logs for details."
+        )
+
+    def test_raw_fallback_skips_non_dict_payload_items(self):
+        service = self._build_service_with_raw_payload(
+            [
+                "not-a-zone",
+                {
+                    "id": "nzo-valid",
+                    "name": "Valid",
+                    "status": "ACTIVE",
+                    "type": "IP",
+                    "usage": "BLOCKLIST",
+                },
+            ]
+        )
+
+        assert set(service.network_zones.keys()) == {"nzo-valid"}
+
+    def test_raw_fallback_paginates_via_link_header(self):
+        next_link = '<https://acme.okta.com/api/v1/zones?after=cursor-2>; rel="next"'
+        page_1 = [
+            {
+                "id": "nzo-1",
+                "name": "First",
+                "status": "ACTIVE",
+                "type": "IP",
+                "usage": "BLOCKLIST",
+            }
+        ]
+        page_2 = [
+            {
+                "id": "nzo-2",
+                "name": "Second",
+                "status": "ACTIVE",
+                "type": "IP",
+                "usage": "BLOCKLIST",
+            }
+        ]
+
+        provider = set_mocked_okta_provider()
+        ve = self._trigger_real_validation_error()
+        execute_calls = []
+
+        async def failing_list_network_zones(*_a, **_k):
+            raise ve
+
+        async def fake_raw_create(*_a, **kwargs):
+            return ({"url": kwargs.get("url", "")}, None)
+
+        async def fake_raw_execute(request):
+            execute_calls.append(request)
+            if len(execute_calls) == 1:
+                return (
+                    SimpleNamespace(headers={"link": next_link}),
+                    json.dumps(page_1),
+                    None,
+                )
+            return (SimpleNamespace(headers={}), json.dumps(page_2), None)
+
+        sdk_mock = mock.MagicMock()
+        sdk_mock.list_network_zones = failing_list_network_zones
+        sdk_mock._request_executor.create_request = fake_raw_create
+        sdk_mock._request_executor.execute = fake_raw_execute
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk_mock,
+        ):
+            service = NetworkZone(provider)
+
+        assert len(execute_calls) == 2
+        assert "after=cursor-2" in execute_calls[1]["url"]
+        assert set(service.network_zones.keys()) == {"nzo-1", "nzo-2"}
+
+
+class Test_raw_zone_to_model:
+    def test_extracts_address_values_and_categories(self):
+        zone = _raw_zone_to_model(
+            {
+                "id": "nzo-ip",
+                "name": "IPs",
+                "status": "ACTIVE",
+                "type": "IP",
+                "usage": "BLOCKLIST",
+                "system": False,
+                "gateways": [
+                    {"type": "CIDR", "value": "203.0.113.0/24"},
+                    {"type": "RANGE", "value": "198.51.100.5-198.51.100.10"},
+                ],
+                "proxies": [{"type": "CIDR", "value": "192.0.2.0/24"}],
+                "ipServiceCategories": [
+                    {"value": "ANONYMIZER"},
+                    {"value": "TOR_ANONYMIZER"},
+                ],
+            }
+        )
+        assert zone.gateways == [
+            "203.0.113.0/24",
+            "198.51.100.5-198.51.100.10",
+        ]
+        assert zone.proxies == ["192.0.2.0/24"]
+        assert zone.ip_service_categories == ["ANONYMIZER", "TOR_ANONYMIZER"]
+
+    def test_collapses_non_list_asns_and_locations_to_empty(self):
+        zone = _raw_zone_to_model(
+            {
+                "id": "nzo-enhanced",
+                "name": "Enhanced",
+                "type": "DYNAMIC_V2",
+                "asns": {"include": [], "exclude": []},
+                "locations": {"include": [], "exclude": []},
+            }
+        )
+        assert zone.asns == []
+        assert zone.locations == []
+        assert isinstance(zone, OktaNetworkZone)
+
+    def test_extracts_ip_service_categories_from_raw_include_condition(self):
+        zone = _raw_zone_to_model(
+            {
+                "id": "nzo-enhanced",
+                "name": "Enhanced",
+                "type": "DYNAMIC_V2",
+                "ipServiceCategories": {
+                    "include": ["ALL_ANONYMIZERS"],
+                    "exclude": [],
+                },
+            }
+        )
+        assert zone.ip_service_categories == ["ALL_ANONYMIZERS"]
+
+    def test_extracts_scalar_ip_service_category_condition(self):
+        zone = _raw_zone_to_model(
+            {
+                "id": "nzo-enhanced",
+                "name": "Enhanced",
+                "type": "DYNAMIC_V2",
+                "ipServiceCategories": {
+                    "include": {"value": "VPN_ANONYMIZER"},
+                    "exclude": [],
+                },
+            }
+        )
+        assert zone.ip_service_categories == ["VPN_ANONYMIZER"]
+
+    def test_ignores_none_address_entries_and_empty_condition_values(self):
+        zone = _raw_zone_to_model(
+            {
+                "id": "nzo-ip",
+                "gateways": [None],
+                "ipServiceCategories": {
+                    "include": None,
+                    "exclude": [],
+                },
+            }
+        )
+        assert zone.gateways == []
+        assert zone.ip_service_categories == []
+
+    def test_falls_back_name_to_id_when_missing(self):
+        zone = _raw_zone_to_model({"id": "nzo-1"})
+        assert zone.id == "nzo-1"
+        assert zone.name == "nzo-1"
+        assert zone.status == ""
+        assert zone.system is False
diff --git a/tests/providers/okta/services/signon/signon_service_test.py b/tests/providers/okta/services/signon/signon_service_test.py
index c408bc1221..0caeb0e680 100644
--- a/tests/providers/okta/services/signon/signon_service_test.py
+++ b/tests/providers/okta/services/signon/signon_service_test.py
@@ -1,12 +1,14 @@
 from unittest import mock
 
+from prowler.providers.okta.lib.service.pagination import (
+    next_after_cursor as _next_after_cursor,
+)
 from prowler.providers.okta.models import OktaIdentityInfo
 from prowler.providers.okta.services.signon.signon_service import (
     GlobalSessionPolicy,
     GlobalSessionPolicyRule,
     SignInPage,
     Signon,
-    _next_after_cursor,
 )
 from tests.providers.okta.okta_fixtures import (
     OKTA_CLIENT_ID,
diff --git a/tests/providers/okta/services/systemlog/systemlog_fixtures.py b/tests/providers/okta/services/systemlog/systemlog_fixtures.py
new file mode 100644
index 0000000000..efc8289f43
--- /dev/null
+++ b/tests/providers/okta/services/systemlog/systemlog_fixtures.py
@@ -0,0 +1,27 @@
+"""Shared helpers for `systemlog` service check tests."""
+
+from unittest import mock
+
+from prowler.providers.okta.services.systemlog.systemlog_service import LogStream
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def build_systemlog_client(
+    log_streams: dict = None,
+    missing_scope: dict = None,
+):
+    client = mock.MagicMock()
+    client.log_streams = log_streams or {}
+    client.provider = set_mocked_okta_provider()
+    client.audit_config = {}
+    client.missing_scope = missing_scope or {"log_streams": None}
+    return client
+
+
+def log_stream(
+    stream_id: str = "log-1",
+    name: str = "EventBridge stream",
+    status: str = "ACTIVE",
+    type: str = "AWS_EVENTBRIDGE",
+):
+    return LogStream(id=stream_id, name=name, status=status, type=type)
diff --git a/tests/providers/okta/services/systemlog/systemlog_service_test.py b/tests/providers/okta/services/systemlog/systemlog_service_test.py
new file mode 100644
index 0000000000..63dee95dcc
--- /dev/null
+++ b/tests/providers/okta/services/systemlog/systemlog_service_test.py
@@ -0,0 +1,185 @@
+import json
+from unittest import mock
+
+from prowler.providers.okta.models import OktaIdentityInfo
+from prowler.providers.okta.services.systemlog.systemlog_service import (
+    LogStream,
+    SystemLog,
+)
+from tests.providers.okta.okta_fixtures import (
+    OKTA_CLIENT_ID,
+    OKTA_ORG_DOMAIN,
+    set_mocked_okta_provider,
+)
+
+
+def _resp(headers: dict = None):
+    r = mock.MagicMock()
+    r.headers = headers or {}
+    return r
+
+
+def _fake_stream(
+    stream_id: str, name: str, status: str = "ACTIVE", type_: str = "AWS_EVENTBRIDGE"
+):
+    s = mock.MagicMock()
+    s.id = stream_id
+    s.name = name
+    s.status = status
+    s.type = type_
+    return s
+
+
+def _patch_sdk(**methods):
+    return mock.patch(
+        "prowler.providers.okta.lib.service.service.OktaSDKClient",
+        return_value=mock.MagicMock(**methods),
+    )
+
+
+class Test_SystemLog_service:
+    def test_fetches_active_streams(self):
+        provider = set_mocked_okta_provider()
+        s1 = _fake_stream("log-1", "EventBridge")
+        s2 = _fake_stream("log-2", "Splunk", type_="SPLUNK_CLOUD_LOGSTREAMING")
+
+        async def fake_list(*_a, **_k):
+            return ([s1, s2], _resp({}), None)
+
+        with _patch_sdk(list_log_streams=fake_list):
+            service = SystemLog(provider)
+
+        assert set(service.log_streams.keys()) == {"log-1", "log-2"}
+        assert isinstance(service.log_streams["log-1"], LogStream)
+        assert service.log_streams["log-2"].type == "SPLUNK_CLOUD_LOGSTREAMING"
+
+    def test_returns_empty_on_api_error(self):
+        provider = set_mocked_okta_provider()
+
+        async def failing(*_a, **_k):
+            return ([], _resp({}), Exception("E0000007"))
+
+        with _patch_sdk(list_log_streams=failing):
+            service = SystemLog(provider)
+
+        assert service.log_streams == {}
+
+    def test_skips_fetch_when_scope_missing(self):
+        identity = OktaIdentityInfo(
+            org_domain=OKTA_ORG_DOMAIN,
+            client_id=OKTA_CLIENT_ID,
+            granted_scopes=["okta.policies.read"],  # no logStreams scope
+        )
+        provider = set_mocked_okta_provider(identity=identity)
+
+        called = False
+
+        async def fake_list(*_a, **_k):
+            nonlocal called
+            called = True
+            return ([], _resp({}), None)
+
+        with _patch_sdk(list_log_streams=fake_list):
+            service = SystemLog(provider)
+
+        assert called is False
+        assert service.log_streams == {}
+        assert service.missing_scope["log_streams"] == "okta.logStreams.read"
+
+
+class Test_SystemLog_service_sdk_validation_fallback:
+    """Verifies the raw-JSON fallback when the Okta SDK rejects API values.
+
+    The SDK's `LogStreamSettingsAws.eventSourceName` validator uses the
+    regex `^[a-zA-Z0-9.\\-_]$` — missing the `+` quantifier, so every
+    multi-character name raises pydantic `ValidationError`. Without the
+    fallback the whole stream list is lost; with it, the raw JSON path
+    still surfaces each stream's id/name/status/type.
+    """
+
+    def test_raw_fallback_projects_streams_when_sdk_raises(self):
+        from pydantic import ValidationError
+
+        provider = set_mocked_okta_provider()
+
+        raw_payload = [
+            {
+                "id": "log-1",
+                "name": "EventBridge prod",
+                "status": "ACTIVE",
+                "type": "AWS_EVENTBRIDGE",
+            },
+            {
+                "id": "log-2",
+                "name": "Splunk staging",
+                "status": "INACTIVE",
+                "type": "SPLUNK_CLOUD_LOGSTREAMING",
+            },
+        ]
+
+        async def failing_list_log_streams(*_a, **_k):
+            try:
+                # Trigger a real pydantic ValidationError so we exercise
+                # the exact exception type the SDK raises in production.
+                from okta.models.log_stream_settings_aws import LogStreamSettingsAws
+
+                LogStreamSettingsAws(
+                    accountId="123456789012",
+                    eventSourceName="MultiCharacter",
+                    region="us-east-1",
+                )
+            except ValidationError as ve:
+                raise ve
+            return ([], _resp({}), None)
+
+        async def fake_raw_create(*_a, **_k):
+            return ({"url": "/api/v1/logStreams"}, None)
+
+        async def fake_raw_execute(_request):
+            return (None, json.dumps(raw_payload), None)
+
+        sdk = mock.MagicMock()
+        sdk.list_log_streams = failing_list_log_streams
+        sdk._request_executor.create_request = fake_raw_create
+        sdk._request_executor.execute = fake_raw_execute
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk,
+        ):
+            service = SystemLog(provider)
+
+        assert set(service.log_streams.keys()) == {"log-1", "log-2"}
+        assert service.log_streams["log-1"].status == "ACTIVE"
+        assert service.log_streams["log-2"].status == "INACTIVE"
+        assert service.log_streams["log-2"].type == "SPLUNK_CLOUD_LOGSTREAMING"
+
+    def test_raw_fallback_handles_empty_list(self):
+        from pydantic import ValidationError
+
+        provider = set_mocked_okta_provider()
+
+        async def failing(*_a, **_k):
+            raise ValidationError.from_exception_data(
+                title="LogStreamSettingsAws",
+                line_errors=[],
+            )
+
+        async def fake_create(*_a, **_k):
+            return ({"url": "/api/v1/logStreams"}, None)
+
+        async def fake_execute(_req):
+            return (None, "[]", None)
+
+        sdk = mock.MagicMock()
+        sdk.list_log_streams = failing
+        sdk._request_executor.create_request = fake_create
+        sdk._request_executor.execute = fake_execute
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk,
+        ):
+            service = SystemLog(provider)
+
+        assert service.log_streams == {}
diff --git a/tests/providers/okta/services/systemlog/systemlog_streaming_enabled/systemlog_streaming_enabled_test.py b/tests/providers/okta/services/systemlog/systemlog_streaming_enabled/systemlog_streaming_enabled_test.py
new file mode 100644
index 0000000000..64d2bcb8fc
--- /dev/null
+++ b/tests/providers/okta/services/systemlog/systemlog_streaming_enabled/systemlog_streaming_enabled_test.py
@@ -0,0 +1,73 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.systemlog.systemlog_fixtures import (
+    build_systemlog_client,
+    log_stream,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.systemlog."
+    "systemlog_streaming_enabled.systemlog_streaming_enabled.systemlog_client"
+)
+
+
+def _run_check(client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=client),
+    ):
+        from prowler.providers.okta.services.systemlog.systemlog_streaming_enabled.systemlog_streaming_enabled import (
+            systemlog_streaming_enabled,
+        )
+
+        return systemlog_streaming_enabled().execute()
+
+
+class Test_systemlog_streaming_enabled:
+    def test_pass_when_active_stream_exists(self):
+        client = build_systemlog_client(
+            log_streams={"log-1": log_stream(name="EventBridge prod")}
+        )
+        findings = _run_check(client)
+        assert len(findings) == 1
+        assert findings[0].status == "PASS"
+        assert "EventBridge prod" in findings[0].status_extended
+
+    def test_pass_when_multiple_active_streams(self):
+        client = build_systemlog_client(
+            log_streams={
+                "log-1": log_stream(stream_id="log-1", name="A"),
+                "log-2": log_stream(stream_id="log-2", name="B"),
+            }
+        )
+        findings = _run_check(client)
+        assert len(findings) == 2
+        assert all(f.status == "PASS" for f in findings)
+
+    def test_fail_when_all_streams_inactive(self):
+        client = build_systemlog_client(
+            log_streams={"log-1": log_stream(name="A", status="INACTIVE")}
+        )
+        findings = _run_check(client)
+        assert len(findings) == 1
+        assert findings[0].status == "FAIL"
+        assert "none are ACTIVE" in findings[0].status_extended
+
+    def test_fail_when_no_streams_configured(self):
+        client = build_systemlog_client(log_streams={})
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        assert "No Okta Log Streams are configured" in findings[0].status_extended
+        assert "mutelist" in findings[0].status_extended
+
+    def test_manual_when_scope_missing(self):
+        client = build_systemlog_client(
+            missing_scope={"log_streams": "okta.logStreams.read"}
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "MANUAL"
+        assert "okta.logStreams.read" in findings[0].status_extended
diff --git a/tests/providers/okta/services/user/user_fixtures.py b/tests/providers/okta/services/user/user_fixtures.py
new file mode 100644
index 0000000000..99282c1efa
--- /dev/null
+++ b/tests/providers/okta/services/user/user_fixtures.py
@@ -0,0 +1,55 @@
+"""Shared helpers for `user` service check tests."""
+
+from unittest import mock
+
+from prowler.providers.okta.services.user.user_service import (
+    ExternalDirectoryIdp,
+    UserAutomation,
+)
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def build_user_client(
+    automations: dict = None,
+    external_directory_idps: dict = None,
+    audit_config: dict = None,
+    missing_scope: dict = None,
+):
+    client = mock.MagicMock()
+    client.automations = automations or {}
+    client.external_directory_idps = external_directory_idps or {}
+    client.provider = set_mocked_okta_provider()
+    client.audit_config = audit_config or {}
+    client.missing_scope = missing_scope or {
+        "automations": None,
+        "identity_providers": None,
+    }
+    return client
+
+
+def automation(
+    automation_id: str = "auto-1",
+    name: str = "User Inactivity",
+    status: str = "ACTIVE",
+    schedule_status: str = "ACTIVE",
+    inactivity_days: int = 35,
+    lifecycle_action: str = "SUSPENDED",
+    groups: list = None,
+):
+    # `groups is None` keeps the "Everyone-equivalent" default; passing
+    # `groups=[]` lets a test exercise the empty-scope FAIL path.
+    return UserAutomation(
+        id=automation_id,
+        name=name,
+        status=status,
+        schedule_status=schedule_status,
+        inactivity_days=inactivity_days,
+        lifecycle_action=lifecycle_action,
+        applies_to_groups=["everyone"] if groups is None else groups,
+    )
+
+
+def ad_idp(idp_id: str = "0oa-ad", name: str = "Corp AD"):
+    return ExternalDirectoryIdp(
+        id=idp_id, name=name, type="ACTIVE_DIRECTORY", status="ACTIVE"
+    )
diff --git a/tests/providers/okta/services/user/user_inactivity_automation_35d_enabled/user_inactivity_automation_35d_enabled_test.py b/tests/providers/okta/services/user/user_inactivity_automation_35d_enabled/user_inactivity_automation_35d_enabled_test.py
new file mode 100644
index 0000000000..99cb7db6a0
--- /dev/null
+++ b/tests/providers/okta/services/user/user_inactivity_automation_35d_enabled/user_inactivity_automation_35d_enabled_test.py
@@ -0,0 +1,165 @@
+from unittest import mock
+
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+from tests.providers.okta.services.user.user_fixtures import (
+    ad_idp,
+    automation,
+    build_user_client,
+)
+
+CHECK_PATH = (
+    "prowler.providers.okta.services.user."
+    "user_inactivity_automation_35d_enabled."
+    "user_inactivity_automation_35d_enabled.user_client"
+)
+
+
+def _run_check(client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_okta_provider(),
+        ),
+        mock.patch(CHECK_PATH, new=client),
+    ):
+        from prowler.providers.okta.services.user.user_inactivity_automation_35d_enabled.user_inactivity_automation_35d_enabled import (
+            user_inactivity_automation_35d_enabled,
+        )
+
+        return user_inactivity_automation_35d_enabled().execute()
+
+
+class Test_user_inactivity_automation_35d_enabled:
+    def test_pass_when_compliant_automation_present(self):
+        client = build_user_client(
+            automations={"auto-1": automation(name="Inactivity 35d")}
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "PASS"
+        assert "Inactivity 35d" in findings[0].status_extended
+        assert "SUSPENDED" in findings[0].status_extended
+
+    def test_pass_message_names_groups_and_asks_for_coverage_verification(self):
+        # Okta has no built-in Everyone group ID and group names vary by
+        # tenant (e.g. "pepito"), so we can't assert tenant-wide coverage
+        # automatically — surface the group IDs and let the operator verify.
+        client = build_user_client(
+            automations={"auto-1": automation(groups=["grp-A", "grp-B"])}
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "PASS"
+        assert "grp-A, grp-B" in findings[0].status_extended
+        assert "cover every user" in findings[0].status_extended
+
+    def test_fail_when_applies_to_no_group(self):
+        # An automation with empty `people.groups.include` runs against
+        # nobody — Okta does not implicitly cover every user.
+        client = build_user_client(automations={"auto-1": automation(groups=[])})
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        assert "no group scope" in findings[0].status_extended
+
+    def test_pass_when_lower_threshold(self):
+        # Inactivity threshold lower than the default is still compliant.
+        client = build_user_client(
+            automations={"auto-1": automation(inactivity_days=14)}
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "PASS"
+
+    def test_fail_when_threshold_too_high(self):
+        client = build_user_client(
+            automations={"auto-1": automation(inactivity_days=90)}
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        assert "inactivity 90d (max 35d)" in findings[0].status_extended
+
+    def test_fail_when_status_inactive(self):
+        client = build_user_client(
+            automations={"auto-1": automation(status="INACTIVE")}
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        assert "status INACTIVE" in findings[0].status_extended
+
+    def test_fail_when_schedule_inactive(self):
+        client = build_user_client(
+            automations={"auto-1": automation(schedule_status="INACTIVE")}
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        assert "schedule INACTIVE" in findings[0].status_extended
+
+    def test_fail_when_wrong_lifecycle_action(self):
+        client = build_user_client(
+            automations={"auto-1": automation(lifecycle_action="ACTIVE")}
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        assert "action ACTIVE" in findings[0].status_extended
+
+    def test_fail_when_no_automations(self):
+        client = build_user_client(automations={})
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        assert "No Okta Workflows automations" in findings[0].status_extended
+
+    def test_fail_lists_every_missing_piece_for_unfinished_automation(self):
+        # Mirrors the real-world case where an admin clicks "Add Automation"
+        # in the UI but never configures conditions or actions. The service
+        # emits a placeholder UserAutomation so the check FAILs with a
+        # specific message instead of pretending the policy doesn't exist.
+        from prowler.providers.okta.services.user.user_service import UserAutomation
+
+        shell = UserAutomation(
+            id="pol-1",
+            name="TestCheck",
+            status="INACTIVE",
+            schedule_status="INACTIVE",
+            inactivity_days=None,
+            lifecycle_action=None,
+            applies_to_groups=[],
+            policy_id="pol-1",
+            policy_name="TestCheck",
+        )
+        client = build_user_client(automations={"pol-1": shell})
+        findings = _run_check(client)
+        assert findings[0].status == "FAIL"
+        msg = findings[0].status_extended
+        assert "TestCheck" in msg
+        assert "status INACTIVE" in msg
+        assert "schedule INACTIVE" in msg
+        assert "no inactivity condition" in msg
+        assert "action unset" in msg
+
+    def test_manual_na_when_external_directory_idp_present(self):
+        client = build_user_client(
+            automations={"auto-1": automation(inactivity_days=90)},  # non-compliant
+            external_directory_idps={"0oa-ad": ad_idp(name="Corp AD")},
+        )
+        findings = _run_check(client)
+        # External directory short-circuits to MANUAL N/A regardless of
+        # the automations state.
+        assert findings[0].status == "MANUAL"
+        assert "ACTIVE_DIRECTORY" in findings[0].status_extended
+        assert "Corp AD" in findings[0].status_extended
+
+    def test_manual_when_scope_missing(self):
+        client = build_user_client(
+            missing_scope={
+                "automations": "okta.policies.read",
+                "identity_providers": None,
+            }
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "MANUAL"
+        assert "okta.policies.read" in findings[0].status_extended
+
+    def test_threshold_overridden_via_audit_config(self):
+        client = build_user_client(
+            automations={"auto-1": automation(inactivity_days=60)},
+            audit_config={"okta_user_inactivity_max_days": 90},
+        )
+        findings = _run_check(client)
+        assert findings[0].status == "PASS"
diff --git a/tests/providers/okta/services/user/user_service_test.py b/tests/providers/okta/services/user/user_service_test.py
new file mode 100644
index 0000000000..f4e0309b7b
--- /dev/null
+++ b/tests/providers/okta/services/user/user_service_test.py
@@ -0,0 +1,477 @@
+import json
+from unittest import mock
+
+from prowler.providers.okta.services.user.user_service import (
+    ExternalDirectoryIdp,
+    User,
+    UserAutomation,
+    _raw_rule_to_automation,
+    _rule_to_automation,
+)
+from tests.providers.okta.okta_fixtures import set_mocked_okta_provider
+
+
+def _resp(headers: dict = None):
+    r = mock.MagicMock()
+    r.headers = headers or {}
+    return r
+
+
+def _fake_policy(
+    policy_id,
+    name="Inactivity Policy",
+    status="ACTIVE",
+    inactivity_days=35,
+    inactivity_unit="DAYS",
+    groups=None,
+):
+    # In the actual API response, the inactivity condition and the
+    # group scope live on the *policy*, not on its rules — keep the
+    # typed fixture aligned with that shape so it mirrors raw JSON.
+    p = mock.MagicMock()
+    p.id = policy_id
+    p.name = name
+    p.status = status
+    if inactivity_days is None:
+        p.conditions.people.users.inactivity = None
+    else:
+        p.conditions.people.users.inactivity.number = inactivity_days
+        p.conditions.people.users.inactivity.unit = inactivity_unit
+    p.conditions.people.groups.include = ["everyone"] if groups is None else groups
+    return p
+
+
+def _fake_rule(
+    rule_id="rule-1",
+    name="Inactivity",
+    status="ACTIVE",
+    lifecycle_action="SUSPENDED",
+):
+    # A USER_LIFECYCLE policy rule carries only the lifecycle action;
+    # its `conditions` is typically empty.
+    r = mock.MagicMock()
+    r.id = rule_id
+    r.name = name
+    r.status = status
+    r.actions.user_lifecycle.action = lifecycle_action
+    return r
+
+
+def _fake_idp(idp_type, status="ACTIVE", idp_id="0oa-1", name="x"):
+    idp = mock.MagicMock()
+    idp.id = idp_id
+    idp.name = name
+    idp.type = idp_type
+    idp.status = status
+    return idp
+
+
+def _patch_sdk(**methods):
+    return mock.patch(
+        "prowler.providers.okta.lib.service.service.OktaSDKClient",
+        return_value=mock.MagicMock(**methods),
+    )
+
+
+class Test_rule_to_automation:
+    def test_parses_inactivity_and_lifecycle(self):
+        policy = _fake_policy("pol-1", name="Inactivity Policy")
+        rule = _fake_rule(rule_id="rule-1", name="Inactivity")
+        m = _rule_to_automation(rule, policy)
+        assert isinstance(m, UserAutomation)
+        assert m.id == "rule-1"
+        assert m.status == "ACTIVE"
+        assert m.schedule_status == "ACTIVE"
+        assert m.inactivity_days == 35
+        assert m.lifecycle_action == "SUSPENDED"
+        assert m.applies_to_groups == ["everyone"]
+        assert m.policy_id == "pol-1"
+        assert m.policy_name == "Inactivity Policy"
+
+    def test_returns_none_when_id_missing(self):
+        policy = _fake_policy("pol")
+        bad = _fake_rule()
+        bad.id = ""
+        assert _rule_to_automation(bad, policy) is None
+
+    def test_ignores_non_days_unit(self):
+        policy = _fake_policy("pol", inactivity_unit="WEEKS")
+        rule = _fake_rule()
+        m = _rule_to_automation(rule, policy)
+        assert m.inactivity_days is None
+
+    def test_reads_inactivity_and_groups_from_policy_not_rule(self):
+        # The typed path used to read inactivity/groups from the rule;
+        # an SDK update that started populating `policy.conditions`
+        # exposed the mismatch. Locking the policy-shaped projection in.
+        policy = _fake_policy("pol", inactivity_days=21, groups=["grp-x"])
+        rule = _fake_rule()
+        # Sanity: nothing inactivity-ish on the rule.
+        del rule.conditions
+        m = _rule_to_automation(rule, policy)
+        assert m.inactivity_days == 21
+        assert m.applies_to_groups == ["grp-x"]
+
+
+class Test_User_service:
+    def test_fetches_automations_via_policy_api(self):
+        provider = set_mocked_okta_provider()
+        policy = _fake_policy("pol-1")
+        rule = _fake_rule(rule_id="rule-1")
+
+        async def fake_list_policies(*_a, **_k):
+            return ([policy], _resp({}), None)
+
+        async def fake_list_rules(*_a, **_k):
+            return ([rule], _resp({}), None)
+
+        async def fake_list_idps(*_a, **_k):
+            return ([], _resp({}), None)
+
+        sdk = mock.MagicMock()
+        sdk.list_policies = fake_list_policies
+        sdk.list_policy_rules = fake_list_rules
+        sdk.list_identity_providers = fake_list_idps
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk,
+        ):
+            service = User(provider)
+
+        assert "rule-1" in service.automations
+        assert service.automations["rule-1"].inactivity_days == 35
+        assert service.external_directory_idps == {}
+
+    def test_returns_empty_on_policies_api_error(self):
+        provider = set_mocked_okta_provider()
+
+        async def failing(*_a, **_k):
+            return ([], _resp({}), Exception("E0000007"))
+
+        async def fake_list_idps(*_a, **_k):
+            return ([], _resp({}), None)
+
+        sdk = mock.MagicMock()
+        sdk.list_policies = failing
+        sdk.list_identity_providers = fake_list_idps
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk,
+        ):
+            service = User(provider)
+
+        assert service.automations == {}
+
+    def test_detects_external_directory_idp(self):
+        provider = set_mocked_okta_provider()
+
+        async def empty_policies(*_a, **_k):
+            return ([], _resp({}), None)
+
+        ad = _fake_idp("ACTIVE_DIRECTORY", idp_id="0oa-ad", name="Corp AD")
+        saml = _fake_idp("SAML2", idp_id="0oa-saml")
+
+        async def fake_list_idps(*_a, **_k):
+            return ([ad, saml], _resp({}), None)
+
+        sdk = mock.MagicMock()
+        sdk.list_policies = empty_policies
+        sdk.list_identity_providers = fake_list_idps
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk,
+        ):
+            service = User(provider)
+
+        assert "0oa-ad" in service.external_directory_idps
+        assert "0oa-saml" not in service.external_directory_idps
+        assert isinstance(
+            service.external_directory_idps["0oa-ad"], ExternalDirectoryIdp
+        )
+
+
+class Test_raw_rule_to_automation:
+    def test_projects_inactivity_and_lifecycle(self):
+        # Real API shape: inactivity + groups live on the POLICY,
+        # lifecycle action lives on the RULE under
+        # `actions.updateUserLifecycle.targetStatus`.
+        policy = {
+            "id": "pol-1",
+            "name": "TestCheck",
+            "status": "ACTIVE",
+            "conditions": {
+                "people": {
+                    "users": {"inactivity": {"number": 35, "unit": "DAYS"}},
+                    "groups": {"include": ["everyone"]},
+                }
+            },
+            "type": "USER_LIFECYCLE",
+        }
+        rule = {
+            "id": "rule-1",
+            "name": "lifecycle-rule-1",
+            "status": "ACTIVE",
+            "conditions": {},
+            "actions": {
+                "updateUserLifecycle": {
+                    "targetStatus": "SUSPENDED",
+                    "quietPeriod": {"number": 0, "unit": "DAYS"},
+                }
+            },
+        }
+        m = _raw_rule_to_automation(rule, policy, "pol-1", "TestCheck", "ACTIVE")
+        assert isinstance(m, UserAutomation)
+        assert m.id == "rule-1"
+        assert m.status == "ACTIVE"
+        assert m.schedule_status == "ACTIVE"
+        assert m.inactivity_days == 35
+        assert m.lifecycle_action == "SUSPENDED"
+        assert m.applies_to_groups == ["everyone"]
+        assert m.policy_id == "pol-1"
+        assert m.policy_name == "TestCheck"
+
+    def test_returns_none_when_id_missing(self):
+        assert _raw_rule_to_automation({"name": "x"}, {}, "pol", "P", "ACTIVE") is None
+
+    def test_ignores_non_days_unit(self):
+        policy = {
+            "id": "pol",
+            "conditions": {
+                "people": {"users": {"inactivity": {"number": 5, "unit": "WEEKS"}}}
+            },
+        }
+        rule = {"id": "rule-2", "actions": {}}
+        m = _raw_rule_to_automation(rule, policy, "pol", "P", "ACTIVE")
+        assert m.inactivity_days is None
+
+    def test_missing_policy_dict_gives_empty_inactivity_and_groups(self):
+        rule = {
+            "id": "rule-3",
+            "actions": {"updateUserLifecycle": {"targetStatus": "SUSPENDED"}},
+        }
+        m = _raw_rule_to_automation(rule, None, "pol", "P", "ACTIVE")
+        assert m.inactivity_days is None
+        assert m.applies_to_groups == []
+        assert m.lifecycle_action == "SUSPENDED"
+
+
+class Test_User_service_sdk_discriminator_fallback:
+    """Verifies the raw-JSON fallback when the SDK can't deserialize USER_LIFECYCLE.
+
+    Okta SDK 3.4.2 ships a `Policy.from_dict` discriminator mapping that
+    omits `USER_LIFECYCLE`, so the typed call raises ValueError. Without
+    the fallback the whole automations list is lost; with it the raw
+    JSON path projects each rule onto a `UserAutomation` snapshot.
+    """
+
+    def test_raw_fallback_projects_user_lifecycle_policy_rules(self):
+        provider = set_mocked_okta_provider()
+
+        # Real API shape: inactivity + groups on POLICY, lifecycle
+        # action on RULE under `actions.updateUserLifecycle.targetStatus`.
+        policy_payload = [
+            {
+                "id": "pol-1",
+                "name": "TestCheck",
+                "status": "ACTIVE",
+                "type": "USER_LIFECYCLE",
+                "conditions": {
+                    "people": {
+                        "users": {"inactivity": {"number": 35, "unit": "DAYS"}},
+                        "groups": {"include": ["everyone"]},
+                    }
+                },
+            }
+        ]
+        rules_payload = [
+            {
+                "id": "rule-1",
+                "name": "lifecycle-rule-1",
+                "status": "ACTIVE",
+                "conditions": {},
+                "actions": {
+                    "updateUserLifecycle": {
+                        "targetStatus": "SUSPENDED",
+                        "quietPeriod": {"number": 0, "unit": "DAYS"},
+                    }
+                },
+            }
+        ]
+
+        async def failing_list_policies(*_a, **_k):
+            raise ValueError(
+                "Policy failed to lookup discriminator value from {...}. "
+                "Discriminator property name: type, mapping: {...}"
+            )
+
+        async def fake_list_idps(*_a, **_k):
+            return ([], _resp({}), None)
+
+        async def fake_raw_create(*_a, **kwargs):
+            url = kwargs.get("url", "") or ""
+            return ({"url": url}, None)
+
+        async def fake_raw_execute(request):
+            url = request.get("url", "")
+            if "/api/v1/policies/pol-1/rules" in url:
+                return (None, json.dumps(rules_payload), None)
+            if "/api/v1/policies" in url:
+                return (None, json.dumps(policy_payload), None)
+            return (None, "[]", None)
+
+        sdk = mock.MagicMock()
+        sdk.list_policies = failing_list_policies
+        sdk.list_identity_providers = fake_list_idps
+        sdk._request_executor.create_request = fake_raw_create
+        sdk._request_executor.execute = fake_raw_execute
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk,
+        ):
+            service = User(provider)
+
+        assert "rule-1" in service.automations
+        a = service.automations["rule-1"]
+        assert a.inactivity_days == 35
+        assert a.lifecycle_action == "SUSPENDED"
+        assert a.schedule_status == "ACTIVE"
+        assert a.policy_id == "pol-1"
+        assert a.policy_name == "TestCheck"
+
+    def test_raw_fallback_emits_shell_for_policy_with_no_rules(self):
+        # Mirrors the real-world tenant state where an admin clicked
+        # "Add Automation" in the UI but never configured conditions or
+        # actions. The policy exists; it has zero rules. The raw fallback
+        # must surface the policy as a shell UserAutomation so the check
+        # FAILs with a specific message instead of dropping it.
+        provider = set_mocked_okta_provider()
+
+        async def failing_list_policies(*_a, **_k):
+            raise ValueError("missing discriminator mapping")
+
+        async def fake_list_idps(*_a, **_k):
+            return ([], _resp({}), None)
+
+        async def fake_raw_create(*_a, **kwargs):
+            return ({"url": kwargs.get("url", "") or ""}, None)
+
+        async def fake_raw_execute(request):
+            url = request.get("url", "")
+            if "/api/v1/policies/pol-empty/rules" in url:
+                return (None, "[]", None)
+            if "/api/v1/policies" in url:
+                return (
+                    None,
+                    json.dumps(
+                        [
+                            {
+                                "id": "pol-empty",
+                                "name": "TestCheck",
+                                "status": "INACTIVE",
+                                "type": "USER_LIFECYCLE",
+                            }
+                        ]
+                    ),
+                    None,
+                )
+            return (None, "[]", None)
+
+        sdk = mock.MagicMock()
+        sdk.list_policies = failing_list_policies
+        sdk.list_identity_providers = fake_list_idps
+        sdk._request_executor.create_request = fake_raw_create
+        sdk._request_executor.execute = fake_raw_execute
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk,
+        ):
+            service = User(provider)
+
+        assert "pol-empty" in service.automations
+        shell = service.automations["pol-empty"]
+        assert shell.name == "TestCheck"
+        assert shell.status == "INACTIVE"
+        assert shell.schedule_status == "INACTIVE"
+        assert shell.inactivity_days is None
+        assert shell.lifecycle_action is None
+        assert shell.applies_to_groups == []
+        assert shell.policy_id == "pol-empty"
+
+    def test_rule_typed_failure_triggers_raw_fallback_for_all_policies(self):
+        # When the typed `list_policies` succeeds but the typed
+        # `list_policy_rules` fails for a policy, the previous behavior
+        # was to emit a shell automation — silently misclassifying a
+        # valid automation as "unfinished". Now `_fetch_rules` returns
+        # None as a sentinel and the caller re-runs the entire
+        # discovery via raw JSON so no rule data is lost.
+        provider = set_mocked_okta_provider()
+
+        typed_policy = _fake_policy(
+            "pol-1", name="TestCheck", inactivity_days=35, groups=["everyone"]
+        )
+
+        async def fake_list_policies(*_a, **_k):
+            return ([typed_policy], _resp({}), None)
+
+        async def failing_list_policy_rules(*_a, **_k):
+            raise ValueError("KnowledgeConstraint.types expected uppercase")
+
+        async def fake_list_idps(*_a, **_k):
+            return ([], _resp({}), None)
+
+        raw_policy_payload = [
+            {
+                "id": "pol-1",
+                "name": "TestCheck",
+                "status": "ACTIVE",
+                "type": "USER_LIFECYCLE",
+                "conditions": {
+                    "people": {
+                        "users": {"inactivity": {"number": 35, "unit": "DAYS"}},
+                        "groups": {"include": ["everyone"]},
+                    }
+                },
+            }
+        ]
+        raw_rules_payload = [
+            {
+                "id": "rule-1",
+                "name": "lifecycle-rule-1",
+                "status": "ACTIVE",
+                "actions": {"updateUserLifecycle": {"targetStatus": "SUSPENDED"}},
+            }
+        ]
+
+        async def fake_raw_create(*_a, **kwargs):
+            return ({"url": kwargs.get("url", "") or ""}, None)
+
+        async def fake_raw_execute(request):
+            url = request.get("url", "")
+            if "/api/v1/policies/pol-1/rules" in url:
+                return (None, json.dumps(raw_rules_payload), None)
+            if "/api/v1/policies" in url:
+                return (None, json.dumps(raw_policy_payload), None)
+            return (None, "[]", None)
+
+        sdk = mock.MagicMock()
+        sdk.list_policies = fake_list_policies
+        sdk.list_policy_rules = failing_list_policy_rules
+        sdk.list_identity_providers = fake_list_idps
+        sdk._request_executor.create_request = fake_raw_create
+        sdk._request_executor.execute = fake_raw_execute
+
+        with mock.patch(
+            "prowler.providers.okta.lib.service.service.OktaSDKClient",
+            return_value=sdk,
+        ):
+            service = User(provider)
+
+        # Raw-projected automation, not a shell.
+        assert "rule-1" in service.automations
+        assert service.automations["rule-1"].inactivity_days == 35
+        assert service.automations["rule-1"].lifecycle_action == "SUSPENDED"
diff --git a/tests/providers/openstack/openstack_provider_test.py b/tests/providers/openstack/openstack_provider_test.py
index 654d109134..b36fcd97a5 100644
--- a/tests/providers/openstack/openstack_provider_test.py
+++ b/tests/providers/openstack/openstack_provider_test.py
@@ -631,8 +631,7 @@ class TestOpenstackProviderCloudsYaml:
     def test_clouds_yaml_explicit_file_path(self, tmp_path):
         """Test loading clouds.yaml from an explicit file path."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -644,8 +643,7 @@ clouds:
       project_domain_name: YamlProjectDomain
     region_name: RegionOne
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -681,8 +679,7 @@ clouds:
     def test_clouds_yaml_with_explicit_cloud_name(self, tmp_path):
         """Test loading clouds.yaml with an explicit cloud name."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   default-cloud:
     auth:
@@ -692,8 +689,7 @@ clouds:
       project_id: default-project-id
     region_name: RegionOne
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -719,8 +715,7 @@ clouds:
     def test_clouds_yaml_file_without_cloud_name(self, tmp_path):
         """Test error when clouds.yaml file is provided without cloud name."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -729,8 +724,7 @@ clouds:
       password: test-password
       project_id: test-project-id
     region_name: RegionOne
-"""
-        )
+""")
 
         with pytest.raises(OpenStackInvalidConfigError) as excinfo:
             OpenstackProvider(clouds_yaml_file=str(clouds_yaml))
@@ -750,8 +744,7 @@ clouds:
     def test_clouds_yaml_cloud_not_found(self, tmp_path):
         """Test error when specified cloud is not in clouds.yaml."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   existing-cloud:
     auth:
@@ -760,8 +753,7 @@ clouds:
       password: test-password
       project_id: test-project-id
     region_name: RegionOne
-"""
-        )
+""")
 
         with pytest.raises(OpenStackCloudNotFoundError) as excinfo:
             OpenstackProvider(
@@ -774,8 +766,7 @@ clouds:
     def test_clouds_yaml_missing_required_fields(self, tmp_path):
         """Test error when clouds.yaml is missing required fields."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   incomplete-cloud:
     auth:
@@ -783,8 +774,7 @@ clouds:
       username: test-user
       # Missing password and other required fields
     region_name: RegionOne
-"""
-        )
+""")
 
         with pytest.raises(OpenStackInvalidConfigError) as excinfo:
             OpenstackProvider(
@@ -798,16 +788,14 @@ clouds:
     def test_clouds_yaml_malformed_yaml(self, tmp_path):
         """Test error when clouds.yaml is malformed."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   malformed-cloud:
     auth:
       auth_url: https://openstack.example.com:5000/v3
       username: test-user
     - invalid: yaml: structure
-"""
-        )
+""")
 
         with pytest.raises(OpenStackInvalidConfigError):
             OpenstackProvider(
@@ -818,8 +806,7 @@ clouds:
     def test_clouds_yaml_with_project_name(self, tmp_path):
         """Test clouds.yaml using project_name instead of project_id."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -831,8 +818,7 @@ clouds:
       project_domain_name: Default
     region_name: RegionOne
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -863,8 +849,7 @@ clouds:
         monkeypatch.setenv("OS_REGION_NAME", "EnvRegion")
 
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -874,8 +859,7 @@ clouds:
       project_id: yaml-project-id
     region_name: YamlRegion
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -902,8 +886,7 @@ clouds:
     def test_test_connection_with_clouds_yaml(self, tmp_path):
         """Test static test_connection method with clouds.yaml."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -913,8 +896,7 @@ clouds:
       project_id: test-project-id
     region_name: RegionOne
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -950,8 +932,7 @@ clouds:
     def test_test_connection_clouds_yaml_cloud_not_found(self, tmp_path):
         """Test test_connection error when cloud is not in clouds.yaml."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   existing-cloud:
     auth:
@@ -960,8 +941,7 @@ clouds:
       password: test-password
       project_id: test-project-id
     region_name: RegionOne
-"""
-        )
+""")
 
         connection_result = OpenstackProvider.test_connection(
             clouds_yaml_file=str(clouds_yaml),
@@ -1139,8 +1119,7 @@ clouds:
     def test_clouds_yaml_file_with_regions_list(self, tmp_path):
         """Test loading clouds.yaml file with regions list."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -1152,8 +1131,7 @@ clouds:
       - RegionOne
       - RegionTwo
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -1177,8 +1155,7 @@ clouds:
     def test_clouds_yaml_file_with_both_regions_raises_error(self, tmp_path):
         """Test that clouds.yaml file with both region_name and regions raises error."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -1191,8 +1168,7 @@ clouds:
       - RegionOne
       - RegionTwo
     identity_api_version: 3
-"""
-        )
+""")
 
         with pytest.raises(OpenStackAmbiguousRegionError):
             OpenstackProvider(
@@ -1203,8 +1179,7 @@ clouds:
     def test_clouds_yaml_file_with_no_region_raises_error(self, tmp_path):
         """Test that clouds.yaml file with neither region_name nor regions raises error."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -1213,8 +1188,7 @@ clouds:
       password: test-password
       project_id: test-project-id
     identity_api_version: 3
-"""
-        )
+""")
 
         with pytest.raises(OpenStackNoRegionError):
             OpenstackProvider(
diff --git a/tests/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped_test.py b/tests/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped_test.py
new file mode 100644
index 0000000000..5b974c893c
--- /dev/null
+++ b/tests/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped_test.py
@@ -0,0 +1,326 @@
+from datetime import datetime
+from unittest import mock
+
+import pytest
+
+from prowler.lib.check.models import Check_Report_OCI
+from prowler.providers.oraclecloud.services.identity.identity_service import Policy
+from tests.providers.oraclecloud.oci_fixtures import (
+    OCI_COMPARTMENT_ID,
+    OCI_REGION,
+    OCI_TENANCY_ID,
+    set_mocked_oraclecloud_provider,
+)
+
+CHECK_PATH = "prowler.providers.oraclecloud.services.identity.identity_storage_service_level_admins_scoped.identity_storage_service_level_admins_scoped"
+
+
+def _policy(
+    name: str, statements: list[str], lifecycle_state: str = "ACTIVE"
+) -> Policy:
+    return Policy(
+        id=f"ocid1.policy.oc1..{name.lower().replace(' ', '-')}",
+        name=name,
+        description="Test policy",
+        compartment_id=OCI_COMPARTMENT_ID,
+        statements=statements,
+        time_created=datetime.now(),
+        lifecycle_state=lifecycle_state,
+        region=OCI_REGION,
+    )
+
+
+def _identity_client(policies: list[Policy]) -> mock.MagicMock:
+    identity_client = mock.MagicMock()
+    identity_client.policies = policies
+    identity_client.audited_tenancy = OCI_TENANCY_ID
+    identity_client.audited_regions = [mock.MagicMock(key=OCI_REGION)]
+    return identity_client
+
+
+def _run_check(policies: list[Policy]) -> list[Check_Report_OCI]:
+    identity_client = _identity_client(policies)
+
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_oraclecloud_provider(),
+        ),
+        mock.patch(f"{CHECK_PATH}.identity_client", new=identity_client),
+    ):
+        from prowler.providers.oraclecloud.services.identity.identity_storage_service_level_admins_scoped.identity_storage_service_level_admins_scoped import (
+            identity_storage_service_level_admins_scoped,
+        )
+
+        return identity_storage_service_level_admins_scoped().execute()
+
+
+class Test_identity_storage_service_level_admins_scoped:
+    def test_no_policies_passes_with_tenancy_finding(self):
+        result = _run_check([])
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert result[0].resource_id == OCI_TENANCY_ID
+        assert result[0].resource_name == "Tenancy"
+        assert (
+            result[0].status_extended
+            == "No active storage service-level administrator policies grant manage permissions without excluding delete permissions."
+        )
+
+    def test_manage_volumes_without_delete_exclusion_fails(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Volume Admins",
+                    ["Allow group VolumeUsers to manage volumes in tenancy"],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert result[0].resource_name == "Volume Admins"
+        assert "VOLUME_DELETE" in result[0].status_extended
+        assert (
+            "Allow group VolumeUsers to manage volumes in tenancy"
+            in result[0].status_extended
+        )
+
+    def test_manage_volumes_with_delete_exclusion_passes(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Volume Admins",
+                    [
+                        "Allow group VolumeUsers to manage volumes in tenancy where request.permission!='VOLUME_DELETE'"
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert (
+            result[0].status_extended
+            == "Policy 'Volume Admins' excludes required storage delete permissions from storage manage statements."
+        )
+
+    def test_delete_exclusion_parser_is_case_and_whitespace_insensitive(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Volume Admins",
+                    [
+                        "  allow   group VolumeUsers TO   manage   volumes in tenancy WHERE request.permission   !=   'volume_delete'  "
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+
+    def test_generic_where_clause_does_not_pass(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Bucket Admins",
+                    [
+                        "Allow group BucketUsers to manage buckets in tenancy where request.region='iad'"
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "BUCKET_DELETE" in result[0].status_extended
+        assert "request.region='iad'" in result[0].status_extended
+
+    @pytest.mark.parametrize(
+        "statement",
+        [
+            "Allow group BucketUsers to manage buckets in tenancy where ANY {request.permission!='BUCKET_DELETE', request.region='iad'}",
+            "Allow group BucketUsers to manage buckets in tenancy where request.permission!='BUCKET_DELETE' OR request.region='iad'",
+        ],
+    )
+    def test_disjunctive_delete_exclusion_does_not_pass(self, statement):
+        result = _run_check([_policy("Bucket Admins", [statement])])
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "BUCKET_DELETE" in result[0].status_extended
+
+    def test_quoted_literals_do_not_make_delete_exclusion_disjunctive(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Bucket Admins",
+                    [
+                        "Allow group BucketUsers to manage buckets in tenancy where request.permission!='BUCKET_DELETE' and target.tag.namespace='any-tag'"
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+
+    @pytest.mark.parametrize(
+        "resource,permission",
+        [
+            ("file-systems", "FILE_SYSTEM_DELETE"),
+            ("mount-targets", "MOUNT_TARGET_DELETE"),
+            ("export-sets", "EXPORT_SET_DELETE"),
+            ("volumes", "VOLUME_DELETE"),
+            ("volume-backups", "VOLUME_BACKUP_DELETE"),
+            ("objects", "OBJECT_DELETE"),
+            ("buckets", "BUCKET_DELETE"),
+        ],
+    )
+    def test_storage_resources_require_matching_delete_exclusion(
+        self, resource, permission
+    ):
+        fail_result = _run_check(
+            [
+                _policy(
+                    "Storage Admins",
+                    [f"Allow group StorageUsers to manage {resource} in tenancy"],
+                )
+            ]
+        )
+        pass_result = _run_check(
+            [
+                _policy(
+                    "Storage Admins",
+                    [
+                        f"Allow group StorageUsers to manage {resource} in tenancy where request.permission != '{permission}'"
+                    ],
+                )
+            ]
+        )
+
+        assert len(fail_result) == 1
+        assert fail_result[0].status == "FAIL"
+        assert permission in fail_result[0].status_extended
+        assert len(pass_result) == 1
+        assert pass_result[0].status == "PASS"
+
+    def test_file_family_fails_until_all_delete_permissions_are_excluded(self):
+        partial_result = _run_check(
+            [
+                _policy(
+                    "File Admins",
+                    [
+                        "Allow group FileUsers to manage file-family in tenancy where ALL {request.permission!='FILE_SYSTEM_DELETE', request.permission!='MOUNT_TARGET_DELETE'}"
+                    ],
+                )
+            ]
+        )
+        complete_result = _run_check(
+            [
+                _policy(
+                    "File Admins",
+                    [
+                        "Allow group FileUsers to manage file-family in tenancy where ALL {request.permission!='FILE_SYSTEM_DELETE', request.permission!='MOUNT_TARGET_DELETE', request.permission!='EXPORT_SET_DELETE'}"
+                    ],
+                )
+            ]
+        )
+
+        assert len(partial_result) == 1
+        assert partial_result[0].status == "FAIL"
+        assert "EXPORT_SET_DELETE" in partial_result[0].status_extended
+        assert len(complete_result) == 1
+        assert complete_result[0].status == "PASS"
+
+    @pytest.mark.parametrize(
+        "family,missing_permission,statement",
+        [
+            (
+                "volume-family",
+                "VOLUME_BACKUP_DELETE",
+                "Allow group VolumeUsers to manage volume-family in tenancy where request.permission!='VOLUME_DELETE'",
+            ),
+            (
+                "object-family",
+                "BUCKET_DELETE",
+                "Allow group BucketUsers to manage object-family in tenancy where request.permission!='OBJECT_DELETE'",
+            ),
+            (
+                "all-resources",
+                "BUCKET_DELETE",
+                "Allow group StorageUsers to manage all-resources in tenancy where ALL {request.permission!='VOLUME_DELETE', request.permission!='VOLUME_BACKUP_DELETE', request.permission!='FILE_SYSTEM_DELETE', request.permission!='MOUNT_TARGET_DELETE', request.permission!='EXPORT_SET_DELETE', request.permission!='OBJECT_DELETE'}",
+            ),
+        ],
+    )
+    def test_families_and_all_resources_fail_unless_all_delete_permissions_are_excluded(
+        self, family, missing_permission, statement
+    ):
+        result = _run_check([_policy("Storage Admins", [statement])])
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert family in result[0].status_extended
+        assert missing_permission in result[0].status_extended
+
+    def test_all_resources_passes_when_all_storage_delete_permissions_are_excluded(
+        self,
+    ):
+        result = _run_check(
+            [
+                _policy(
+                    "Storage Admins",
+                    [
+                        "Allow group StorageUsers to manage all-resources in tenancy where ALL {request.permission!='VOLUME_DELETE', request.permission!='VOLUME_BACKUP_DELETE', request.permission!='FILE_SYSTEM_DELETE', request.permission!='MOUNT_TARGET_DELETE', request.permission!='EXPORT_SET_DELETE', request.permission!='OBJECT_DELETE', request.permission!='BUCKET_DELETE'}"
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+
+    def test_inactive_policies_are_ignored(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Inactive Volume Admins",
+                    ["Allow group VolumeUsers to manage volumes in tenancy"],
+                    lifecycle_state="INACTIVE",
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert result[0].resource_name == "Tenancy"
+
+    def test_tenant_admin_policy_is_ignored(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Tenant Admin Policy",
+                    ["Allow group Administrators to manage all-resources in tenancy"],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert result[0].resource_name == "Tenancy"
+
+    def test_policies_without_storage_manage_statements_are_ignored(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Network Admins",
+                    ["Allow group NetworkUsers to manage vcns in tenancy"],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert result[0].resource_name == "Tenancy"
diff --git a/tests/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration_test.py b/tests/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration_test.py
new file mode 100644
index 0000000000..2d1e6b7875
--- /dev/null
+++ b/tests/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration_test.py
@@ -0,0 +1,150 @@
+from unittest import mock
+
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    AccessKey,
+)
+from tests.providers.stackit.stackit_fixtures import (
+    STACKIT_PROJECT_ID,
+    set_mocked_stackit_provider,
+)
+
+
+class Test_objectstorage_access_key_expiration:
+    def test_no_access_keys(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.access_keys = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_access_key_expiration.objectstorage_access_key_expiration import (
+                objectstorage_access_key_expiration,
+            )
+
+            check = objectstorage_access_key_expiration()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_access_key_with_expiration(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.access_keys = [
+            AccessKey(
+                key_id="key-123",
+                display_name="my-key",
+                expires="2027-01-01T00:00:00+00:00",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_access_key_expiration.objectstorage_access_key_expiration import (
+                objectstorage_access_key_expiration,
+            )
+
+            check = objectstorage_access_key_expiration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "has an expiration date set" in result[0].status_extended
+            assert result[0].resource_id == "key-123"
+            assert result[0].resource_name == "my-key"
+            assert result[0].location == "eu01"
+
+    def test_access_key_no_expiration_none(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.access_keys = [
+            AccessKey(
+                key_id="key-456",
+                display_name="never-expiring-key",
+                expires=None,
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_access_key_expiration.objectstorage_access_key_expiration import (
+                objectstorage_access_key_expiration,
+            )
+
+            check = objectstorage_access_key_expiration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "no expiration date" in result[0].status_extended
+            assert result[0].resource_id == "key-456"
+
+    def test_access_key_no_expiration_sentinel(self):
+        """Year-0001 date is the SDK sentinel for 'never expires'."""
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.access_keys = [
+            AccessKey(
+                key_id="key-789",
+                display_name="sentinel-key",
+                expires="0001-01-01T00:00:00+00:00",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_access_key_expiration.objectstorage_access_key_expiration import (
+                objectstorage_access_key_expiration,
+            )
+
+            check = objectstorage_access_key_expiration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "no expiration date" in result[0].status_extended
diff --git a/tests/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled_test.py b/tests/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled_test.py
new file mode 100644
index 0000000000..a802dac78f
--- /dev/null
+++ b/tests/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled_test.py
@@ -0,0 +1,111 @@
+from unittest import mock
+
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    Bucket,
+)
+from tests.providers.stackit.stackit_fixtures import (
+    STACKIT_PROJECT_ID,
+    set_mocked_stackit_provider,
+)
+
+
+class Test_objectstorage_bucket_object_lock_enabled:
+    def test_no_buckets(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_object_lock_enabled.objectstorage_bucket_object_lock_enabled import (
+                objectstorage_bucket_object_lock_enabled,
+            )
+
+            check = objectstorage_bucket_object_lock_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_object_lock_enabled(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=True,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_object_lock_enabled.objectstorage_bucket_object_lock_enabled import (
+                objectstorage_bucket_object_lock_enabled,
+            )
+
+            check = objectstorage_bucket_object_lock_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "has S3 Object Lock enabled" in result[0].status_extended
+            assert result[0].resource_id == "my-bucket"
+            assert result[0].resource_name == "my-bucket"
+            assert result[0].location == "eu01"
+
+    def test_bucket_object_lock_disabled(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=False,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_object_lock_enabled.objectstorage_bucket_object_lock_enabled import (
+                objectstorage_bucket_object_lock_enabled,
+            )
+
+            check = objectstorage_bucket_object_lock_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "does not have S3 Object Lock enabled" in result[0].status_extended
+            assert result[0].resource_id == "my-bucket"
diff --git a/tests/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy_test.py b/tests/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy_test.py
new file mode 100644
index 0000000000..59fdf73370
--- /dev/null
+++ b/tests/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy_test.py
@@ -0,0 +1,153 @@
+from unittest import mock
+
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    Bucket,
+)
+from tests.providers.stackit.stackit_fixtures import (
+    STACKIT_PROJECT_ID,
+    set_mocked_stackit_provider,
+)
+
+
+class Test_objectstorage_bucket_retention_policy:
+    def test_no_buckets(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_retention_policy.objectstorage_bucket_retention_policy import (
+                objectstorage_bucket_retention_policy,
+            )
+
+            check = objectstorage_bucket_retention_policy()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_with_retention_policy(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=True,
+                retention_days=30,
+                retention_mode="COMPLIANCE",
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_retention_policy.objectstorage_bucket_retention_policy import (
+                objectstorage_bucket_retention_policy,
+            )
+
+            check = objectstorage_bucket_retention_policy()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "30 day(s)" in result[0].status_extended
+            assert "COMPLIANCE" in result[0].status_extended
+            assert result[0].resource_id == "my-bucket"
+            assert result[0].location == "eu01"
+
+    def test_bucket_without_retention_policy(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=False,
+                retention_days=None,
+                retention_mode=None,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_retention_policy.objectstorage_bucket_retention_policy import (
+                objectstorage_bucket_retention_policy,
+            )
+
+            check = objectstorage_bucket_retention_policy()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                "does not have a default retention policy" in result[0].status_extended
+            )
+            assert result[0].resource_id == "my-bucket"
+
+    def test_bucket_retention_zero_days(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=True,
+                retention_days=0,
+                retention_mode="GOVERNANCE",
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_retention_policy.objectstorage_bucket_retention_policy import (
+                objectstorage_bucket_retention_policy,
+            )
+
+            check = objectstorage_bucket_retention_policy()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
diff --git a/tests/providers/stackit/services/objectstorage/stackit_objectstorage_service_test.py b/tests/providers/stackit/services/objectstorage/stackit_objectstorage_service_test.py
new file mode 100644
index 0000000000..59f6559a54
--- /dev/null
+++ b/tests/providers/stackit/services/objectstorage/stackit_objectstorage_service_test.py
@@ -0,0 +1,645 @@
+from types import SimpleNamespace
+from unittest import mock
+
+import pytest
+
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    AccessKey,
+    ObjectStorageService,
+)
+from tests.providers.stackit.stackit_fixtures import STACKIT_PROJECT_ID
+
+
+class TestObjectStorageService:
+    def test_list_buckets_keeps_bucket_when_retention_not_configured(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        not_found_error = Exception("not found")
+        not_found_error.status = 404
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(
+            buckets=[
+                SimpleNamespace(
+                    name="my-bucket",
+                    object_lock_enabled=True,
+                )
+            ]
+        )
+        client.get_default_retention.side_effect = not_found_error
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 1
+        assert service.buckets[0].name == "my-bucket"
+        assert service.buckets[0].object_lock_enabled is True
+        assert service.buckets[0].retention_days is None
+        assert service.buckets[0].retention_mode is None
+
+    def test_list_buckets_propagates_unexpected_retention_api_errors(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        api_error = Exception("service unavailable")
+        api_error.status = 503
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(
+            buckets=[
+                SimpleNamespace(
+                    name="my-bucket",
+                    object_lock_enabled=True,
+                )
+            ]
+        )
+        client.get_default_retention.side_effect = api_error
+
+        with pytest.raises(Exception, match="service unavailable"):
+            service._list_buckets(client, "eu01")
+
+        assert service.buckets == []
+        service.provider.handle_api_error.assert_called_once_with(api_error)
+
+    def test_init_creates_service_with_no_regions(self):
+        provider = mock.MagicMock()
+        provider.identity.project_id = STACKIT_PROJECT_ID
+        provider.generate_regional_clients.return_value = {}
+
+        service = ObjectStorageService(provider)
+
+        assert service.project_id == STACKIT_PROJECT_ID
+        assert service.buckets == []
+        assert service.access_keys == []
+        provider.generate_regional_clients.assert_called_once_with("objectstorage")
+
+    def test_fetch_all_regions_skips_404_region(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+        service.access_keys = []
+
+        not_found = Exception("not found")
+        not_found.status = 404
+        service.regional_clients = {"eu01": mock.MagicMock()}
+
+        with mock.patch.object(service, "_list_buckets", side_effect=not_found):
+            service._fetch_all_regions()
+
+        assert service.buckets == []
+
+    def test_fetch_all_regions_reraises_non_404_error(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+        service.access_keys = []
+
+        server_error = Exception("internal server error")
+        server_error.status = 500
+        service.regional_clients = {"eu01": mock.MagicMock()}
+
+        with mock.patch.object(service, "_list_buckets", side_effect=server_error):
+            with pytest.raises(Exception, match="internal server error"):
+                service._fetch_all_regions()
+
+    def test_list_buckets_with_dict_api_response(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        not_found = Exception("not found")
+        not_found.status = 404
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = {
+            "buckets": [
+                SimpleNamespace(name="dict-response-bucket", object_lock_enabled=True)
+            ]
+        }
+        client.get_default_retention.side_effect = not_found
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 1
+        assert service.buckets[0].name == "dict-response-bucket"
+
+    def test_list_buckets_with_dict_bucket_data(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        not_found = Exception("not found")
+        not_found.status = 404
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(
+            buckets=[{"name": "dict-bucket", "objectLockEnabled": True}]
+        )
+        client.get_default_retention.side_effect = not_found
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 1
+        assert service.buckets[0].name == "dict-bucket"
+        assert service.buckets[0].object_lock_enabled is True
+
+    def test_list_buckets_skips_unknown_bucket_type(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(buckets=[42])
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 0
+
+    def test_get_default_retention_with_dict_response(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+
+        client = mock.MagicMock()
+        client.get_default_retention.return_value = {"days": 14, "mode": "GOVERNANCE"}
+
+        days, mode = service._get_default_retention(client, "eu01", "my-bucket")
+
+        assert days == 14
+        assert mode == "GOVERNANCE"
+
+    def test_list_access_keys_with_object_data(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[SimpleNamespace(id="cg-001", display_name="main-group")]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(
+            access_keys=[
+                SimpleNamespace(
+                    key_id="key-001",
+                    display_name="my-key",
+                    expires="2027-01-01T00:00:00+00:00",
+                )
+            ]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        client.list_credentials_groups.assert_called_once_with(
+            project_id=STACKIT_PROJECT_ID, region="eu01"
+        )
+        client.list_access_keys.assert_called_once_with(
+            project_id=STACKIT_PROJECT_ID, region="eu01", credentials_group="cg-001"
+        )
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-001"
+        assert service.access_keys[0].display_name == "my-key"
+        assert service.access_keys[0].region == "eu01"
+        assert service.access_keys[0].expires == "2027-01-01T00:00:00+00:00"
+        assert service.access_keys[0].credentials_group_id == "cg-001"
+        assert service.access_keys[0].credentials_group_name == "main-group"
+
+    def test_list_access_keys_with_credentials_group_id_object_data(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[
+                SimpleNamespace(
+                    credentials_group_id="cg-sdk",
+                    display_name="sdk-group",
+                )
+            ]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(access_keys=[])
+
+        service._list_access_keys(client, "eu01")
+
+        client.list_access_keys.assert_called_once_with(
+            project_id=STACKIT_PROJECT_ID, region="eu01", credentials_group="cg-sdk"
+        )
+
+    def test_list_access_keys_collects_keys_from_multiple_credentials_groups(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[
+                SimpleNamespace(id="cg-001", display_name="group-one"),
+                SimpleNamespace(id="cg-002", display_name="group-two"),
+            ]
+        )
+        client.list_access_keys.side_effect = [
+            SimpleNamespace(
+                access_keys=[
+                    SimpleNamespace(
+                        key_id="key-001",
+                        display_name="key-one",
+                        expires="2027-01-01T00:00:00+00:00",
+                    )
+                ]
+            ),
+            SimpleNamespace(
+                access_keys=[
+                    SimpleNamespace(
+                        key_id="key-002",
+                        display_name="key-two",
+                        expires=None,
+                    )
+                ]
+            ),
+        ]
+
+        service._list_access_keys(client, "eu01")
+
+        assert client.list_access_keys.call_args_list == [
+            mock.call(
+                project_id=STACKIT_PROJECT_ID,
+                region="eu01",
+                credentials_group="cg-001",
+            ),
+            mock.call(
+                project_id=STACKIT_PROJECT_ID,
+                region="eu01",
+                credentials_group="cg-002",
+            ),
+        ]
+        assert [key.key_id for key in service.access_keys] == ["key-001", "key-002"]
+        assert service.access_keys[1].expires is None
+        assert service.access_keys[1].has_expiration() is False
+        assert [key.credentials_group_id for key in service.access_keys] == [
+            "cg-001",
+            "cg-002",
+        ]
+
+    def test_list_access_keys_with_dict_api_response(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = {
+            "credentialsGroups": [{"id": "cg-dict", "displayName": "dict-group"}]
+        }
+        client.list_access_keys.return_value = {
+            "accessKeys": [
+                {"keyId": "key-dict", "displayName": "dict-key", "expires": None}
+            ]
+        }
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-dict"
+        assert service.access_keys[0].display_name == "dict-key"
+        assert service.access_keys[0].expires is None
+        assert service.access_keys[0].has_expiration() is False
+        assert service.access_keys[0].credentials_group_id == "cg-dict"
+        assert service.access_keys[0].credentials_group_name == "dict-group"
+
+    def test_list_access_keys_with_raw_json_response_and_null_expires(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        class RawResponse:
+            status = 200
+
+            def json(self):
+                return {
+                    "accessKeys": [
+                        {
+                            "keyId": "key-raw",
+                            "displayName": "raw-key",
+                            "expires": None,
+                        }
+                    ]
+                }
+
+        class FakeClient:
+            def __init__(self):
+                self.list_credentials_groups = mock.MagicMock(
+                    return_value=SimpleNamespace(
+                        credentials_groups=[SimpleNamespace(id="cg-raw")]
+                    )
+                )
+                self.list_access_keys = mock.MagicMock()
+                self.raw_call = None
+
+            def list_access_keys_without_preload_content(self, **kwargs):
+                self.raw_call = kwargs
+                return RawResponse()
+
+        client = FakeClient()
+
+        service._list_access_keys(client, "eu01")
+
+        assert client.raw_call == {
+            "project_id": STACKIT_PROJECT_ID,
+            "region": "eu01",
+            "credentials_group": "cg-raw",
+        }
+        client.list_access_keys.assert_not_called()
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-raw"
+        assert service.access_keys[0].expires is None
+        assert service.access_keys[0].has_expiration() is False
+
+    def test_list_access_keys_with_raw_data_response(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        class RawResponse:
+            status = 200
+            data = b'{"accessKeys":[{"keyId":"key-data","displayName":"data-key"}]}'
+
+        class FakeClient:
+            def __init__(self):
+                self.list_credentials_groups = mock.MagicMock(
+                    return_value=SimpleNamespace(
+                        credentials_groups=[SimpleNamespace(id="cg-data")]
+                    )
+                )
+
+            def list_access_keys_without_preload_content(self, **kwargs):
+                return RawResponse()
+
+        service._list_access_keys(FakeClient(), "eu01")
+
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-data"
+        assert service.access_keys[0].display_name == "data-key"
+
+    def test_list_access_keys_raw_response_propagates_non_success_status(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        class RawResponse:
+            status = 503
+
+        class FakeClient:
+            def __init__(self):
+                self.list_credentials_groups = mock.MagicMock(
+                    return_value=SimpleNamespace(
+                        credentials_groups=[SimpleNamespace(id="cg-error")]
+                    )
+                )
+
+            def list_access_keys_without_preload_content(self, **kwargs):
+                return RawResponse()
+
+        with pytest.raises(Exception, match="status 503") as error:
+            service._list_access_keys(FakeClient(), "eu01")
+
+        assert error.value.status == 503
+        service.provider.handle_api_error.assert_called_once_with(error.value)
+
+    def test_list_access_keys_with_dict_key_data(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[{"id": "cg-456", "displayName": "group-456"}]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(
+            access_keys=[
+                {
+                    "keyId": "key-456",
+                    "displayName": "my-dict-key",
+                    "expires": "2028-06-01T00:00:00+00:00",
+                }
+            ]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-456"
+        assert service.access_keys[0].display_name == "my-dict-key"
+        assert service.access_keys[0].credentials_group_id == "cg-456"
+
+    def test_list_access_keys_skips_unknown_type(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[SimpleNamespace(id="cg-001")]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(access_keys=[42])
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 0
+
+    def test_list_access_keys_no_keys(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[SimpleNamespace(id="cg-empty")]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(access_keys=[])
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 0
+
+    def test_list_access_keys_no_credentials_groups(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 0
+        client.list_access_keys.assert_not_called()
+
+    def test_list_access_keys_skips_malformed_credentials_groups(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[
+                42,
+                {},
+                SimpleNamespace(id="cg-valid", display_name="valid-group"),
+            ]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(
+            access_keys=[SimpleNamespace(key_id="key-valid")]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        client.list_access_keys.assert_called_once_with(
+            project_id=STACKIT_PROJECT_ID, region="eu01", credentials_group="cg-valid"
+        )
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-valid"
+
+    def test_fetch_all_regions_calls_both_list_methods(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+        service.access_keys = []
+
+        service.regional_clients = {"eu01": mock.MagicMock()}
+
+        with (
+            mock.patch.object(service, "_list_buckets") as mock_buckets,
+            mock.patch.object(service, "_list_access_keys") as mock_keys,
+        ):
+            service._fetch_all_regions()
+
+        mock_buckets.assert_called_once()
+        mock_keys.assert_called_once()
+
+    def test_list_buckets_handles_bucket_processing_error(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        class BrokenBucket:
+            @property
+            def name(self):
+                raise RuntimeError("broken bucket attribute")
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(buckets=[BrokenBucket()])
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 0
+
+    def test_list_access_keys_handles_key_processing_error(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        class BrokenKey:
+            @property
+            def key_id(self):
+                raise RuntimeError("broken key attribute")
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[SimpleNamespace(id="cg-001")]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(
+            access_keys=[BrokenKey()]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 0
+
+
+class TestAccessKeyModel:
+    def test_has_expiration_with_invalid_date_string(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="not-a-valid-date",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.has_expiration() is False
+
+    def test_expires_within_days_when_no_expiration(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires=None,
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires is None
+        assert key.has_expiration() is False
+        assert key.expires_within_days(90) is False
+
+    def test_expires_within_days_when_expiring_soon(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="2026-06-15T00:00:00+00:00",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires_within_days(90) is True
+
+    def test_expires_within_days_when_not_expiring_soon(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="2030-01-01T00:00:00+00:00",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires_within_days(30) is False
+
+    def test_expires_within_days_with_naive_datetime(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="2026-06-10T00:00:00",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires_within_days(90) is True
+
+    def test_expires_within_days_with_sentinel_key(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="0001-01-01T00:00:00+00:00",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires_within_days(90) is False
diff --git a/tests/providers/stackit/stackit_provider_test.py b/tests/providers/stackit/stackit_provider_test.py
index 8bcbe17f84..13bc7f4698 100644
--- a/tests/providers/stackit/stackit_provider_test.py
+++ b/tests/providers/stackit/stackit_provider_test.py
@@ -411,3 +411,68 @@ class Test_StackitProvider_Handle_API_Error:
         with pytest.raises(RuntimeError) as excinfo:
             StackitProvider.handle_api_error(original)
         assert excinfo.value is original
+
+
+class TestGenerateRegionalClients:
+    """Tests for StackitProvider.generate_regional_clients."""
+
+    def _make_provider(self):
+        provider = object.__new__(StackitProvider)
+        provider._service_account_key_path = "/tmp/sa-key.json"
+        provider._service_account_key = None
+        provider._audited_regions = None
+        return provider
+
+    def _fake_classes(self):
+        class FakeConfig:
+            pass
+
+        class FakeIaasClient:
+            def __init__(self, config):
+                pass
+
+        class FakeObjStorageClient:
+            def __init__(self, config):
+                pass
+
+        return FakeConfig, FakeIaasClient, FakeObjStorageClient
+
+    def test_objectstorage_service_uses_objectstorage_api_class(self, monkeypatch):
+        FakeConfig, FakeIaasClient, FakeObjStorageClient = self._fake_classes()
+
+        monkeypatch.setattr(
+            StackitProvider,
+            "_SERVICE_API_CLASS",
+            {"iaas": FakeIaasClient, "objectstorage": FakeObjStorageClient},
+        )
+        provider = self._make_provider()
+        monkeypatch.setattr(
+            provider, "get_available_service_regions", lambda _s, _r: ["eu01"]
+        )
+        with patch.object(
+            StackitProvider, "_build_sdk_configuration", return_value=FakeConfig()
+        ):
+            clients = provider.generate_regional_clients("objectstorage")
+
+        assert "eu01" in clients
+        assert isinstance(clients["eu01"], FakeObjStorageClient)
+
+    def test_iaas_service_uses_iaas_api_class(self, monkeypatch):
+        FakeConfig, FakeIaasClient, FakeObjStorageClient = self._fake_classes()
+
+        monkeypatch.setattr(
+            StackitProvider,
+            "_SERVICE_API_CLASS",
+            {"iaas": FakeIaasClient, "objectstorage": FakeObjStorageClient},
+        )
+        provider = self._make_provider()
+        monkeypatch.setattr(
+            provider, "get_available_service_regions", lambda _s, _r: ["eu01"]
+        )
+        with patch.object(
+            StackitProvider, "_build_sdk_configuration", return_value=FakeConfig()
+        ):
+            clients = provider.generate_regional_clients("iaas")
+
+        assert "eu01" in clients
+        assert isinstance(clients["eu01"], FakeIaasClient)
diff --git a/ui/.pre-commit-config.yaml b/ui/.pre-commit-config.yaml
index eab333ceea..3bc0c3b5e6 100644
--- a/ui/.pre-commit-config.yaml
+++ b/ui/.pre-commit-config.yaml
@@ -1,5 +1,10 @@
 orphan: true
 
+# Hooks run on commit only by default;
+# NOTE: default_stages does NOT override a hook's manifest stages, so fixers shipping pre-push in their
+# manifest need an explicit stages: ["pre-commit"] below to stay off push.
+default_stages: [pre-commit]
+
 repos:
   - repo: local
     hooks:
diff --git a/ui/.prettierignore b/ui/.prettierignore
index 5377d96f2d..8b679ff005 100644
--- a/ui/.prettierignore
+++ b/ui/.prettierignore
@@ -8,6 +8,7 @@ build/
 coverage/
 dist/
 esm/
+CHANGELOG.md
 
 # Generated files
 next-env.d.ts
diff --git a/ui/AGENTS.md b/ui/AGENTS.md
index 38af45860f..7c06cc56b1 100644
--- a/ui/AGENTS.md
+++ b/ui/AGENTS.md
@@ -14,40 +14,46 @@
 > - [`playwright`](../skills/playwright/SKILL.md) - Page Object Model, selectors
 > - [`vitest`](../skills/vitest/SKILL.md) - Unit testing with React Testing Library
 > - [`tdd`](../skills/tdd/SKILL.md) - TDD workflow (MANDATORY for UI tasks)
+> - [`prowler-tour`](../skills/prowler-tour/SKILL.md) - Keep product-tour definitions aligned with the UI
 
 ## Auto-invoke Skills
 
 When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 
-| Action                                                         | Skill               |
-| -------------------------------------------------------------- | ------------------- |
-| Add changelog entry for a PR or feature                        | `prowler-changelog` |
-| App Router / Server Actions                                    | `nextjs-16`         |
-| Building AI chat features                                      | `ai-sdk-5`          |
-| Committing changes                                             | `prowler-commit`    |
-| Create PR that requires changelog entry                        | `prowler-changelog` |
-| Creating Zod schemas                                           | `zod-4`             |
-| Creating a git commit                                          | `prowler-commit`    |
-| Creating/modifying Prowler UI components                       | `prowler-ui`        |
-| Fixing bug                                                     | `tdd`               |
-| Implementing feature                                           | `tdd`               |
-| Modifying component                                            | `tdd`               |
-| Refactoring code                                               | `tdd`               |
-| Review changelog format and conventions                        | `prowler-changelog` |
-| Testing hooks or utilities                                     | `vitest`            |
-| Update CHANGELOG.md in any component                           | `prowler-changelog` |
-| Using Zustand stores                                           | `zustand-5`         |
-| Working on Prowler UI structure (actions/adapters/types/hooks) | `prowler-ui`        |
-| Working on task                                                | `tdd`               |
-| Working with Prowler UI test helpers/pages                     | `prowler-test-ui`   |
-| Working with Tailwind classes                                  | `tailwind-4`        |
-| Writing Playwright E2E tests                                   | `playwright`        |
-| Writing Prowler UI E2E tests                                   | `prowler-test-ui`   |
-| Writing React component tests                                  | `vitest`            |
-| Writing React components                                       | `react-19`          |
-| Writing TypeScript types/interfaces                            | `typescript`        |
-| Writing Vitest tests                                           | `vitest`            |
-| Writing unit tests for UI                                      | `vitest`            |
+| Action                                                            | Skill               |
+| ----------------------------------------------------------------- | ------------------- |
+| Add changelog entry for a PR or feature                           | `prowler-changelog` |
+| Adding, updating, or removing a tour definition (\*.tour.ts)      | `prowler-tour`      |
+| App Router / Server Actions                                       | `nextjs-16`         |
+| Building AI chat features                                         | `ai-sdk-5`          |
+| Changing button labels or section headings on a tour-covered page | `prowler-tour`      |
+| Committing changes                                                | `prowler-commit`    |
+| Create PR that requires changelog entry                           | `prowler-changelog` |
+| Creating Zod schemas                                              | `zod-4`             |
+| Creating a git commit                                             | `prowler-commit`    |
+| Creating/modifying Prowler UI components                          | `prowler-ui`        |
+| Editing a UI file containing data-tour-id attributes              | `prowler-tour`      |
+| Fixing bug                                                        | `tdd`               |
+| Implementing feature                                              | `tdd`               |
+| Modifying component                                               | `tdd`               |
+| Refactoring code                                                  | `tdd`               |
+| Renaming or removing a data-tour-id attribute value               | `prowler-tour`      |
+| Restructuring routes or layouts covered by a tour                 | `prowler-tour`      |
+| Review changelog format and conventions                           | `prowler-changelog` |
+| Testing hooks or utilities                                        | `vitest`            |
+| Update CHANGELOG.md in any component                              | `prowler-changelog` |
+| Using Zustand stores                                              | `zustand-5`         |
+| Working on Prowler UI structure (actions/adapters/types/hooks)    | `prowler-ui`        |
+| Working on task                                                   | `tdd`               |
+| Working with Prowler UI test helpers/pages                        | `prowler-test-ui`   |
+| Working with Tailwind classes                                     | `tailwind-4`        |
+| Writing Playwright E2E tests                                      | `playwright`        |
+| Writing Prowler UI E2E tests                                      | `prowler-test-ui`   |
+| Writing React component tests                                     | `vitest`            |
+| Writing React components                                          | `react-19`          |
+| Writing TypeScript types/interfaces                               | `typescript`        |
+| Writing Vitest tests                                              | `vitest`            |
+| Writing unit tests for UI                                         | `vitest`            |
 
 ---
 
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 6a10c36dbb..dfa5565e93 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -2,12 +2,87 @@
 
 All notable changes to the **Prowler UI** are documented in this file.
 
-## [1.30.0] (Prowler UNRELEASED)
+## [1.31.0] (Prowler UNRELEASED)
+
+### 🚀 Added
+
+- Controlled `402` and `403` Server Action error messages for alert seed and mutation flows [(#11629)](https://github.com/prowler-cloud/prowler/pull/11629)
 
 ### 🔄 Changed
 
 - ESLint: typed flat config with `typescript-eslint` (type-aware via `projectService`) and `eslint-plugin-import-x`, replacing `eslint-plugin-prettier`, `eslint-plugin-simple-import-sort`, and `eslint-plugin-unused-imports` [(#11352)](https://github.com/prowler-cloud/prowler/pull/11352)
 
+### 🐞 Fixed
+
+- Attack Paths now shows distinct messages while a scan is queued, running, or building its graph — plus a separate "couldn't load scans" error — instead of always showing "No scans available" [(#11512)](https://github.com/prowler-cloud/prowler/pull/11512)
+- Radio button no longer shifts vertically when selected [(#11608)](https://github.com/prowler-cloud/prowler/pull/11608)
+- Handle rename DORA to DORA_2022_2554 to follow the naming <name>_<version> in compliance frameworks [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
+
+### 🔐 Security
+
+- Bump vulnerable `Next.js`, React, AI SDK, `postcss`, `hono`, `qs`, `esbuild`, and Alpine OpenSSL packages (`libcrypto3` and `libssl3`) [(#11581)](https://github.com/prowler-cloud/prowler/pull/11581)
+- Bump transitive `dompurify` from 3.4.2 to 3.4.10, patching XSS sanitization bypass advisories [(#11636)](https://github.com/prowler-cloud/prowler/pull/11636)
+
+---
+
+## [1.30.1] (Prowler v5.30.1)
+
+### 🐞 Fixed
+
+- Threat Map no longer shows an empty map for accounts that only have Okta or Google Workspace scans [(#11542)](https://github.com/prowler-cloud/prowler/pull/11542)
+- Compliance attributes requests now pass the selected scan, so multi-provider universal frameworks (e.g. CSA CCM) load the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
+
+### 🔄 Changed
+
+- Public SaaS config (Sentry, Google Tag Manager, API base/docs URL) now resolves at container runtime instead of build time; self-hosted deployments set the UI config through the new `UI_`-prefixed env vars (`UI_API_BASE_URL`, `UI_API_DOCS_URL`, `UI_GOOGLE_TAG_MANAGER_ID`, `UI_SENTRY_DSN`, `UI_SENTRY_ENVIRONMENT`), with the previous `NEXT_PUBLIC_*` names still honored as a deprecated fallback [(#11500)](https://github.com/prowler-cloud/prowler/pull/11500)
+
+### 🐞 Fixed
+
+- `ui/.env` template now lists only the canonical `UI_SENTRY_DSN` and `UI_SENTRY_ENVIRONMENT` names; the deprecated `NEXT_PUBLIC_SENTRY_DSN` and `NEXT_PUBLIC_SENTRY_ENVIRONMENT` entries have been removed [(#11500)](https://github.com/prowler-cloud/prowler/pull/11500)
+
+---
+
+## [1.30.0] (Prowler v5.30.0)
+
+### 🚀 Added
+
+- DISA Okta IDaaS STIG V1R2 compliance framework support with its dedicated mapper, details panel, and icon [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
+- DORA compliance framework support [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
+
+### 🔄 Changed
+
+- Renamed "Customer Support" to "Support Desk" in the side menu, showing it only in Prowler Cloud/Enterprise, while "Community Support" now shows only in Prowler OSS [(#11508)](https://github.com/prowler-cloud/prowler/pull/11508)
+- Compliance detail page now shows a "still loading" retry state while the API warms its compliance catalog, instead of rendering an empty page [(#11530)](https://github.com/prowler-cloud/prowler/pull/11530)
+
+### 🐞 Fixed
+
+- Risk Pipeline Sankey chart now adapts height and node spacing for dense provider datasets, keeping provider and severity labels readable [(#11527)](https://github.com/prowler-cloud/prowler/pull/11527)
+
+---
+
+## [1.29.3] (Prowler v5.29.3)
+
+### 🐞 Fixed
+
+- Finding drawer tabs now keep the active tab text and underline styling when tooltip state changes [(#11493)](https://github.com/prowler-cloud/prowler/pull/11493)
+
+---
+
+## [1.29.2] (Prowler v5.29.2)
+
+### 🔄 Changed
+
+- Account and provider-type selector triggers now show the provider icon, with a non-deduped icon stack [(#11424)](https://github.com/prowler-cloud/prowler/pull/11424)
+
+### 🐞 Fixed
+
+- Add Provider modal now closes without reloading the providers page [(#11424)](https://github.com/prowler-cloud/prowler/pull/11424)
+- Users page now shows the "Delete User" action only on the current user's row, matching the backend rule that a user can only delete their own account [(#11447)](https://github.com/prowler-cloud/prowler/pull/11447)
+
+### 🔐 Security
+
+- Vitest toolchain upgraded `4.0.18` → `4.1.8` to clear two critical `pnpm audit` advisories [(#11424)](https://github.com/prowler-cloud/prowler/pull/11424)
+
 ---
 
 ## [1.29.0] (Prowler v5.29.0)
@@ -25,6 +100,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 - Compliance page now loads the most recent scan when opened from the sidebar instead of showing the "no compliance data available" alert [(#11374)](https://github.com/prowler-cloud/prowler/pull/11374)
 - Invitation links now show specific expired, no-longer-valid, and invalid-token messages based on API error responses [(#11376)](https://github.com/prowler-cloud/prowler/pull/11376)
+- Jira dispatch and provider connection-test polling no longer show a false timeout for longer-running tasks; both poll windows now extend to 60 seconds [(#11519)](https://github.com/prowler-cloud/prowler/pull/11519)
 
 ### 🔐 Security
 
diff --git a/ui/Dockerfile b/ui/Dockerfile
index 047df1171b..86673ba046 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -3,8 +3,8 @@ FROM node:24.13.0-alpine@sha256:cd6fb7efa6490f039f3471a189214d5f548c11df1ff9e5b1
 
 LABEL maintainer="https://github.com/prowler-cloud"
 
-# Enable corepack for pnpm
-RUN corepack enable
+# Patch Alpine OpenSSL runtime packages before all stages inherit the base image.
+RUN apk upgrade --no-cache libcrypto3 libssl3 && corepack enable
 
 # Install dependencies only when needed
 FROM base AS deps
@@ -16,6 +16,7 @@ WORKDIR /app
 # Install dependencies based on the preferred package manager
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY scripts ./scripts
+ENV NODE_OPTIONS=--max-old-space-size=4096
 RUN corepack install && pnpm install --frozen-lockfile
 
 
@@ -35,12 +36,8 @@ RUN corepack install
 ENV NEXT_TELEMETRY_DISABLED=1
 ARG NEXT_PUBLIC_PROWLER_RELEASE_VERSION
 ENV NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${NEXT_PUBLIC_PROWLER_RELEASE_VERSION}
-ARG NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID
-ENV NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID=${NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID}
-ARG NEXT_PUBLIC_API_BASE_URL
-ENV NEXT_PUBLIC_API_BASE_URL=${NEXT_PUBLIC_API_BASE_URL}
-ARG NEXT_PUBLIC_API_DOCS_URL
-ENV NEXT_PUBLIC_API_DOCS_URL=${NEXT_PUBLIC_API_DOCS_URL}
+
+# GTM / API base+docs URLs are runtime container env (prod stage), not build ARGs.
 
 RUN pnpm run build
 
@@ -77,6 +74,12 @@ EXPOSE 3000
 
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
+# Runtime configuration is read by `node server.js` at container start and is
+# NOT baked into the image. Supply it via your orchestrator (docker-compose,
+# Helm/K8s):
+#   - required: UI_API_BASE_URL, AUTH_URL, AUTH_SECRET (missing ⇒ fail fast at boot)
+#   - optional: UI_API_DOCS_URL, UI_GOOGLE_TAG_MANAGER_ID, UI_SENTRY_DSN, UI_SENTRY_ENVIRONMENT
+#   - reserved: POSTHOG_KEY, POSTHOG_HOST, REO_DEV_CLIENT_ID (no consumer yet)
 # server.js is created by next build from the standalone output
 # https://nextjs.org/docs/pages/api-reference/next-config-js/output
 CMD ["node", "server.js"]
diff --git a/ui/__tests__/msw/handlers/attack-paths.ts b/ui/__tests__/msw/handlers/attack-paths.ts
index b17c6c0596..7c76fa574b 100644
--- a/ui/__tests__/msw/handlers/attack-paths.ts
+++ b/ui/__tests__/msw/handlers/attack-paths.ts
@@ -10,7 +10,7 @@ import type {
   QueryResultAttributes,
 } from "@/types/attack-paths";
 
-const API = process.env.NEXT_PUBLIC_API_BASE_URL!;
+const API = process.env.UI_API_BASE_URL;
 
 type JsonApiErrorBody = {
   errors: Array<{ detail: string; status: string }>;
diff --git a/ui/actions/compliances/compliances.ts b/ui/actions/compliances/compliances.ts
index d5f4fd4954..e06b06d29d 100644
--- a/ui/actions/compliances/compliances.ts
+++ b/ui/actions/compliances/compliances.ts
@@ -73,17 +73,33 @@ export const getComplianceOverviewMetadataInfo = async ({
   }
 };
 
-export const getComplianceAttributes = async (complianceId: string) => {
+export const getComplianceAttributes = async (
+  complianceId: string,
+  scanId?: string,
+) => {
   const headers = await getAuthHeaders({ contentType: false });
 
   try {
     const url = new URL(`${apiBaseUrl}/compliance-overviews/attributes`);
     url.searchParams.append("filter[compliance_id]", complianceId);
+    // Pass the scan so multi-provider universal frameworks (e.g. CSA CCM)
+    // resolve the check IDs for the scan's provider instead of defaulting to
+    // the first provider that declares the framework.
+    if (scanId) {
+      url.searchParams.append("filter[scan_id]", scanId);
+    }
 
     const response = await fetch(url.toString(), {
       headers,
     });
 
+    // The compliance catalog is still warming after a deploy/restart. Signal
+    // the page to render the "still loading" state instead of letting this
+    // become a thrown 5xx (which would be captured as a server error).
+    if (response.status === 503) {
+      return { warming: true as const, status: 503 };
+    }
+
     return handleApiResponse(response);
   } catch (error) {
     console.error("Error fetching compliance attributes:", error);
diff --git a/ui/actions/integrations/integrations.ts b/ui/actions/integrations/integrations.ts
index 40084a0da1..8945842fe4 100644
--- a/ui/actions/integrations/integrations.ts
+++ b/ui/actions/integrations/integrations.ts
@@ -286,7 +286,7 @@ const pollTaskUntilComplete = async (
   taskId: string,
 ): Promise<PollConnectionResult> => {
   const settled = await pollTaskUntilSettled<ConnectionTaskResult>(taskId, {
-    maxAttempts: 10,
+    maxAttempts: 20,
     delayMs: 3000,
   });
 
diff --git a/ui/actions/integrations/jira-dispatch.ts b/ui/actions/integrations/jira-dispatch.ts
index 72bfc1176d..9e3b25679f 100644
--- a/ui/actions/integrations/jira-dispatch.ts
+++ b/ui/actions/integrations/jira-dispatch.ts
@@ -148,7 +148,7 @@ export const pollJiraDispatchTask = async (
   { success: true; message: string } | { success: false; error: string }
 > => {
   const res = await pollTaskUntilSettled(taskId, {
-    maxAttempts: 10,
+    maxAttempts: 30,
     delayMs: 2000,
   });
   if (!res.ok) {
diff --git a/ui/actions/overview/regions/threat-map.adapter.test.ts b/ui/actions/overview/regions/threat-map.adapter.test.ts
new file mode 100644
index 0000000000..515825bb0a
--- /dev/null
+++ b/ui/actions/overview/regions/threat-map.adapter.test.ts
@@ -0,0 +1,62 @@
+import { describe, expect, it } from "vitest";
+
+import { adaptRegionsOverviewToThreatMap } from "./threat-map.adapter";
+import type { RegionsOverviewResponse } from "./types";
+
+function buildRegionsResponse(
+  rows: Array<{ providerType: string; region: string }>,
+): RegionsOverviewResponse {
+  return {
+    data: rows.map(({ providerType, region }, index) => ({
+      type: "regions-overview",
+      id: `region-${index}`,
+      attributes: {
+        provider_type: providerType,
+        region,
+        total: 10,
+        fail: 4,
+        muted: 0,
+        pass: 6,
+      },
+    })),
+    meta: { version: "v1" },
+  };
+}
+
+describe("adaptRegionsOverviewToThreatMap", () => {
+  it("maps okta regions to a global location", () => {
+    const response = buildRegionsResponse([
+      { providerType: "okta", region: "global" },
+    ]);
+
+    const result = adaptRegionsOverviewToThreatMap(response);
+
+    expect(result.locations).toHaveLength(1);
+    expect(result.locations[0]).toMatchObject({
+      providerType: "okta",
+      region: "global",
+      name: "Okta - Global",
+      totalFindings: 10,
+      failFindings: 4,
+    });
+    expect(result.regions).toEqual(["global"]);
+  });
+
+  it("maps googleworkspace regions to a global location", () => {
+    const response = buildRegionsResponse([
+      { providerType: "googleworkspace", region: "global" },
+    ]);
+
+    const result = adaptRegionsOverviewToThreatMap(response);
+
+    expect(result.locations).toHaveLength(1);
+    expect(result.locations[0]).toMatchObject({
+      providerType: "googleworkspace",
+      region: "global",
+      name: "Google Workspace - Global",
+      totalFindings: 10,
+      failFindings: 4,
+    });
+    expect(result.regions).toEqual(["global"]);
+  });
+});
diff --git a/ui/actions/overview/regions/threat-map.adapter.ts b/ui/actions/overview/regions/threat-map.adapter.ts
index 0b7852b56a..6ee0958aad 100644
--- a/ui/actions/overview/regions/threat-map.adapter.ts
+++ b/ui/actions/overview/regions/threat-map.adapter.ts
@@ -261,6 +261,19 @@ const ALIBABACLOUD_COORDINATES: Record<string, { lat: number; lng: number }> = {
   global: { lat: 30.3, lng: 120.2 }, // Global fallback (Hangzhou HQ)
 };
 
+// Okta is a SaaS identity platform without user-facing regions
+const OKTA_COORDINATES: Record<string, { lat: number; lng: number }> = {
+  global: { lat: 37.8, lng: -122.4 }, // Global fallback (San Francisco HQ)
+};
+
+// Google Workspace is a SaaS suite without user-facing regions
+const GOOGLEWORKSPACE_COORDINATES: Record<
+  string,
+  { lat: number; lng: number }
+> = {
+  global: { lat: 37.4, lng: -122.1 }, // Global fallback (Mountain View HQ)
+};
+
 const PROVIDER_COORDINATES: Record<
   string,
   Record<string, { lat: number; lng: number }>
@@ -277,6 +290,8 @@ const PROVIDER_COORDINATES: Record<
   oraclecloud: ORACLECLOUD_COORDINATES,
   mongodbatlas: MONGODBATLAS_COORDINATES,
   alibabacloud: ALIBABACLOUD_COORDINATES,
+  okta: OKTA_COORDINATES,
+  googleworkspace: GOOGLEWORKSPACE_COORDINATES,
 };
 
 // Returns [lng, lat] format for D3/GeoJSON compatibility
diff --git a/ui/actions/resources/resources.test.ts b/ui/actions/resources/resources.test.ts
index cbdb0b1296..d8c5d75456 100644
--- a/ui/actions/resources/resources.test.ts
+++ b/ui/actions/resources/resources.test.ts
@@ -28,6 +28,10 @@ import {
 vi.mock("@/lib", () => ({
   apiBaseUrl: "https://api.example.com/api/v1",
   getAuthHeaders: getAuthHeadersMock,
+  GENERIC_SERVER_ERROR_MESSAGE:
+    "Server is temporarily unavailable. Please try again in a few minutes.",
+  sanitizeErrorMessage: (message: string, fallback: string) =>
+    /<html\b|<\/?body\b|<\/?h1\b/i.test(message) ? fallback : message.trim(),
   composeSort,
   FG_FAIL_FIRST,
   FG_RECENT_LAST_SEEN,
@@ -167,6 +171,29 @@ describe("getResourceEvents", () => {
     });
   });
 
+  it("returns a generic error when a gateway returns HTML", async () => {
+    // Given
+    const mockResponse = new Response(
+      "<html><head><title>502 Bad Gateway</title></head><body><h1>502 Bad Gateway</h1></body></html>",
+      {
+        status: 502,
+        statusText: "Bad Gateway",
+        headers: { "content-type": "text/html" },
+      },
+    );
+    fetchMock.mockResolvedValue(mockResponse);
+
+    // When
+    const result = await getResourceEvents("resource-123");
+
+    // Then
+    expect(result).toEqual({
+      error:
+        "Server is temporarily unavailable. Please try again in a few minutes.",
+      status: 502,
+    });
+  });
+
   it("returns generic error when fetch throws", async () => {
     // Given
     fetchMock.mockRejectedValue(new Error("Network failure"));
diff --git a/ui/actions/resources/resources.ts b/ui/actions/resources/resources.ts
index 8af2576852..3ab84efa4f 100644
--- a/ui/actions/resources/resources.ts
+++ b/ui/actions/resources/resources.ts
@@ -4,7 +4,13 @@ import { redirect } from "next/navigation";
 
 import { getLatestFindings } from "@/actions/findings";
 import { listOrganizationsSafe } from "@/actions/organizations/organizations";
-import { apiBaseUrl, FINDINGS_FILTERED_SORT, getAuthHeaders } from "@/lib";
+import {
+  apiBaseUrl,
+  FINDINGS_FILTERED_SORT,
+  GENERIC_SERVER_ERROR_MESSAGE,
+  getAuthHeaders,
+  sanitizeErrorMessage,
+} from "@/lib";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 import { OrganizationResource } from "@/types/organizations";
@@ -193,22 +199,27 @@ export const getResourceEvents = async (
 
     if (!response.ok) {
       const rawText = await response.text().catch(() => "");
+      const contentType =
+        response.headers.get("content-type")?.toLowerCase() || "";
       const defaultError = "An error occurred while fetching events.";
+      const fallbackError = contentType.includes("text/html")
+        ? GENERIC_SERVER_ERROR_MESSAGE
+        : response.statusText || defaultError;
       try {
         const errorData = rawText ? JSON.parse(rawText) : null;
+        const errorMessage =
+          errorData?.errors?.[0]?.detail ||
+          errorData?.error ||
+          errorData?.message ||
+          rawText ||
+          fallbackError;
         return {
-          error:
-            errorData?.errors?.[0]?.detail ||
-            errorData?.error ||
-            errorData?.message ||
-            rawText ||
-            response.statusText ||
-            defaultError,
+          error: sanitizeErrorMessage(String(errorMessage), fallbackError),
           status: response.status,
         };
       } catch {
         return {
-          error: rawText || response.statusText || defaultError,
+          error: sanitizeErrorMessage(rawText || fallbackError, fallbackError),
           status: response.status,
         };
       }
diff --git a/ui/actions/scans/scans.test.ts b/ui/actions/scans/scans.test.ts
index ae82ba860d..a7f7fd0c7e 100644
--- a/ui/actions/scans/scans.test.ts
+++ b/ui/actions/scans/scans.test.ts
@@ -14,6 +14,8 @@ const {
 
 vi.mock("@/lib", () => ({
   apiBaseUrl: "https://api.example.com/api/v1",
+  GENERIC_SERVER_ERROR_MESSAGE:
+    "Server is temporarily unavailable. Please try again in a few minutes.",
   getAuthHeaders: getAuthHeadersMock,
   getErrorMessage: (error: unknown) =>
     error instanceof Error ? error.message : String(error),
@@ -28,7 +30,7 @@ vi.mock("@/lib/sentry-breadcrumbs", () => ({
   addScanOperation: vi.fn(),
 }));
 
-import { launchOrganizationScans } from "./scans";
+import { getExportsZip, launchOrganizationScans } from "./scans";
 
 describe("launchOrganizationScans", () => {
   beforeEach(() => {
@@ -69,3 +71,34 @@ describe("launchOrganizationScans", () => {
     expect(result.failureCount).toBe(0);
   });
 });
+
+describe("getExportsZip", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.stubGlobal("fetch", fetchMock);
+    getAuthHeadersMock.mockResolvedValue({ Authorization: "Bearer token" });
+  });
+
+  it("returns a generic server error when the report endpoint returns HTML", async () => {
+    // Given
+    fetchMock.mockResolvedValue(
+      new Response(
+        "<html><head><title>502 Bad Gateway</title></head><body><h1>502 Bad Gateway</h1></body></html>",
+        {
+          status: 502,
+          statusText: "Bad Gateway",
+          headers: { "content-type": "text/html" },
+        },
+      ),
+    );
+
+    // When
+    const result = await getExportsZip("scan-123");
+
+    // Then
+    expect(result).toEqual({
+      error:
+        "Server is temporarily unavailable. Please try again in a few minutes.",
+    });
+  });
+});
diff --git a/ui/actions/scans/scans.ts b/ui/actions/scans/scans.ts
index a121da3e50..5a6ddb7a29 100644
--- a/ui/actions/scans/scans.ts
+++ b/ui/actions/scans/scans.ts
@@ -3,7 +3,12 @@
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 
-import { apiBaseUrl, getAuthHeaders, getErrorMessage } from "@/lib";
+import {
+  apiBaseUrl,
+  GENERIC_SERVER_ERROR_MESSAGE,
+  getAuthHeaders,
+  getErrorMessage,
+} from "@/lib";
 import {
   COMPLIANCE_REPORT_DISPLAY_NAMES,
   type ComplianceReportType,
@@ -15,6 +20,7 @@ import {
 } from "@/lib/provider-filters";
 import { addScanOperation } from "@/lib/sentry-breadcrumbs";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
+import { SCAN_STATES } from "@/types/attack-paths";
 
 const ORGANIZATION_SCAN_CONCURRENCY_LIMIT = 5;
 export const getScans = async ({
@@ -64,6 +70,10 @@ export const getScansByState = async () => {
     "filter[provider_type__in]",
     sanitizeProviderTypesCsv(),
   );
+  // Only need to know whether at least one completed scan exists; filter server-side
+  // and cap to a single row so the answer is correct regardless of total scan count.
+  url.searchParams.append("filter[state]", SCAN_STATES.COMPLETED);
+  url.searchParams.append("page[size]", "1");
 
   try {
     const response = await fetch(url.toString(), {
@@ -157,18 +167,20 @@ export const scheduleDaily = async (formData: FormData) => {
 
   const url = new URL(`${apiBaseUrl}/schedules/daily`);
 
+  const body = {
+    data: {
+      type: "daily-schedules",
+      attributes: {
+        provider_id: providerId,
+      },
+    },
+  };
+
   try {
     const response = await fetch(url.toString(), {
       method: "POST",
       headers,
-      body: JSON.stringify({
-        data: {
-          type: "daily-schedules",
-          attributes: {
-            provider_id: providerId,
-          },
-        },
-      }),
+      body: JSON.stringify(body),
     });
 
     return handleApiResponse(response, "/scans");
@@ -244,6 +256,27 @@ export const launchOrganizationScans = async (
   return summary;
 };
 
+async function getScanReportErrorMessage(
+  response: Response,
+  fallbackMessage: string,
+): Promise<string> {
+  const contentType = response.headers.get("content-type")?.toLowerCase() || "";
+
+  if (contentType.includes("text/html")) {
+    return GENERIC_SERVER_ERROR_MESSAGE;
+  }
+
+  const errorData = await response.json().catch(() => null);
+
+  return (
+    errorData?.errors?.[0]?.detail ||
+    errorData?.errors?.detail ||
+    errorData?.error ||
+    errorData?.message ||
+    (response.status >= 500 ? GENERIC_SERVER_ERROR_MESSAGE : fallbackMessage)
+  );
+}
+
 export const updateScan = async (formData: FormData) => {
   const headers = await getAuthHeaders({ contentType: true });
 
@@ -295,11 +328,11 @@ export const getExportsZip = async (scanId: string) => {
     }
 
     if (!response.ok) {
-      const errorData = await response.json();
-
       throw new Error(
-        errorData?.errors?.detail ||
+        await getScanReportErrorMessage(
+          response,
           "Unable to fetch scan report. Contact support if the issue continues.",
+        ),
       );
     }
 
@@ -370,10 +403,11 @@ const _fetchScanBinary = async (
     }
 
     if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
       throw new Error(
-        errorData?.errors?.detail ||
+        await getScanReportErrorMessage(
+          response,
           `Unable to retrieve ${errorLabel}. Contact support if the issue continues.`,
+        ),
       );
     }
 
@@ -394,6 +428,27 @@ export const getComplianceCsv = async (scanId: string, complianceId: string) =>
     "compliance report",
   );
 
+/**
+ * Get the OCSF JSON export for a universal compliance framework.
+ *
+ * Only universal frameworks that declare an ``outputs`` block (today: DORA,
+ * CSA CCM 4.0) produce a per-framework OCSF artifact. For any other framework
+ * the backend returns 404; callers should gate this download via
+ * ``isOcsfSupported(framework)``.
+ *
+ * NOTE: this is a dedicated path (``compliance/{id}/ocsf``), not a query
+ * param. The API's JSON:API ``QueryParameterValidationFilter`` rejects any
+ * non-JSON:API query param with 400, so ``?type=`` / ``?format=`` is not an
+ * option — the format must be encoded in the route.
+ */
+export const getComplianceOcsf = async (scanId: string, complianceId: string) =>
+  _fetchScanBinary(
+    scanId,
+    `compliance/${complianceId}/ocsf`,
+    `scan-${scanId}-compliance-${complianceId}.ocsf.json`,
+    "compliance OCSF report",
+  );
+
 /**
  * Get a compliance PDF report for any supported framework.
  *
diff --git a/ui/actions/schedules/index.ts b/ui/actions/schedules/index.ts
new file mode 100644
index 0000000000..7e6e7b459a
--- /dev/null
+++ b/ui/actions/schedules/index.ts
@@ -0,0 +1 @@
+export * from "./schedules";
diff --git a/ui/actions/schedules/schedules.test.ts b/ui/actions/schedules/schedules.test.ts
new file mode 100644
index 0000000000..9e05799116
--- /dev/null
+++ b/ui/actions/schedules/schedules.test.ts
@@ -0,0 +1,103 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { SCHEDULE_FREQUENCY } from "@/types/schedules";
+
+const {
+  fetchMock,
+  getAuthHeadersMock,
+  handleApiErrorMock,
+  handleApiResponseMock,
+  revalidatePathMock,
+} = vi.hoisted(() => ({
+  fetchMock: vi.fn(),
+  getAuthHeadersMock: vi.fn(),
+  handleApiErrorMock: vi.fn(),
+  handleApiResponseMock: vi.fn(),
+  revalidatePathMock: vi.fn(),
+}));
+
+vi.mock("next/cache", () => ({
+  revalidatePath: revalidatePathMock,
+}));
+
+vi.mock("@/lib", () => ({
+  apiBaseUrl: "https://api.example.com/api/v1",
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
+vi.mock("@/lib/server-actions-helper", () => ({
+  handleApiError: handleApiErrorMock,
+  handleApiResponse: handleApiResponseMock,
+}));
+
+import { getSchedule, removeSchedule, updateSchedule } from "./schedules";
+
+const PROVIDER_ID = "1795f636-37e6-42f6-b158-d4faaa64e0fc";
+
+const payload = {
+  scan_enabled: true,
+  scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+  scan_hour: 12,
+  scan_timezone: "Europe/Madrid",
+  scan_interval_hours: null,
+  scan_day_of_week: null,
+  scan_day_of_month: null,
+};
+
+describe("schedule write actions revalidate only on success", () => {
+  beforeEach(() => {
+    vi.stubGlobal("fetch", fetchMock);
+    getAuthHeadersMock.mockResolvedValue({ Authorization: "Bearer token" });
+    fetchMock.mockResolvedValue(new Response(null, { status: 204 }));
+    handleApiErrorMock.mockReturnValue({ error: "Failed" });
+  });
+
+  it("revalidates /scans and /providers after a successful update", async () => {
+    handleApiResponseMock.mockResolvedValue({ success: true });
+
+    await updateSchedule(PROVIDER_ID, payload);
+
+    expect(revalidatePathMock).toHaveBeenCalledWith("/scans");
+    expect(revalidatePathMock).toHaveBeenCalledWith("/providers");
+  });
+
+  it("does not revalidate when the update returns an error result", async () => {
+    handleApiResponseMock.mockResolvedValue({ error: "Schedule rejected" });
+
+    await updateSchedule(PROVIDER_ID, payload);
+
+    expect(revalidatePathMock).not.toHaveBeenCalled();
+  });
+
+  it("revalidates /scans and /providers after a successful delete", async () => {
+    handleApiResponseMock.mockResolvedValue({ success: true });
+
+    await removeSchedule(PROVIDER_ID);
+
+    expect(revalidatePathMock).toHaveBeenCalledWith("/scans");
+    expect(revalidatePathMock).toHaveBeenCalledWith("/providers");
+  });
+
+  it("does not revalidate when the delete returns an error result", async () => {
+    handleApiResponseMock.mockResolvedValue({ error: "Not allowed" });
+
+    await removeSchedule(PROVIDER_ID);
+
+    expect(revalidatePathMock).not.toHaveBeenCalled();
+  });
+
+  it("rejects non-UUID provider ids without issuing a request", async () => {
+    const malicious = "../users/me";
+
+    expect(await getSchedule(malicious)).toEqual({
+      error: "Invalid provider id.",
+    });
+    expect(await updateSchedule(malicious, payload)).toEqual({
+      error: "Invalid provider id.",
+    });
+    expect(await removeSchedule(malicious)).toEqual({
+      error: "Invalid provider id.",
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/actions/schedules/schedules.ts b/ui/actions/schedules/schedules.ts
new file mode 100644
index 0000000000..c8e0d9993f
--- /dev/null
+++ b/ui/actions/schedules/schedules.ts
@@ -0,0 +1,128 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { z } from "zod";
+
+import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
+import type { ScheduleProps, ScheduleUpdatePayload } from "@/types/schedules";
+
+// SSRF guard: the id is interpolated into the request URL, so only UUIDs pass.
+const providerIdSchema = z.uuid();
+
+function parseProviderId(providerId: string): string | null {
+  const parsed = providerIdSchema.safeParse(providerId);
+  return parsed.success ? parsed.data : null;
+}
+
+function revalidateScheduleViews() {
+  revalidatePath("/scans");
+  revalidatePath("/providers");
+}
+
+export const getSchedule = async (providerId: string) => {
+  const id = parseProviderId(providerId);
+  if (!id) return { error: "Invalid provider id." };
+
+  const headers = await getAuthHeaders({ contentType: false });
+  const url = new URL(`${apiBaseUrl}/schedules/${id}`);
+  url.searchParams.set("include", "provider");
+
+  try {
+    const response = await fetch(url.toString(), { headers });
+
+    return handleApiResponse(response);
+  } catch (error) {
+    return handleApiError(error);
+  }
+};
+
+/**
+ * Lists every schedule (one per provider), following pagination — the backend
+ * has no multi-provider filter.
+ */
+export const getSchedules = async () => {
+  const headers = await getAuthHeaders({ contentType: false });
+  const schedules: ScheduleProps[] = [];
+  const MAX_PAGES = 20;
+
+  try {
+    for (let page = 1; page <= MAX_PAGES; page++) {
+      const url = new URL(`${apiBaseUrl}/schedules`);
+      url.searchParams.set("page[number]", String(page));
+      url.searchParams.set("page[size]", "100");
+
+      const response = await fetch(url.toString(), { headers });
+
+      const result = await handleApiResponse(response);
+      if (result?.error) return result;
+
+      schedules.push(...(result?.data ?? []));
+
+      const totalPages = result?.meta?.pagination?.pages ?? 1;
+      if (page >= totalPages) break;
+    }
+
+    return { data: schedules };
+  } catch (error) {
+    return handleApiError(error);
+  }
+};
+
+export const updateSchedule = async (
+  providerId: string,
+  payload: ScheduleUpdatePayload,
+) => {
+  const id = parseProviderId(providerId);
+  if (!id) return { error: "Invalid provider id." };
+
+  const headers = await getAuthHeaders({ contentType: true });
+  const url = new URL(`${apiBaseUrl}/schedules/${id}`);
+
+  const body = {
+    data: {
+      type: "schedules",
+      id,
+      attributes: payload,
+    },
+  };
+
+  try {
+    const response = await fetch(url.toString(), {
+      method: "PATCH",
+      headers,
+      body: JSON.stringify(body),
+    });
+
+    const result = await handleApiResponse(response);
+    if (!result?.error) {
+      revalidateScheduleViews();
+    }
+    return result;
+  } catch (error) {
+    return handleApiError(error);
+  }
+};
+
+export const removeSchedule = async (providerId: string) => {
+  const id = parseProviderId(providerId);
+  if (!id) return { error: "Invalid provider id." };
+
+  const headers = await getAuthHeaders({ contentType: true });
+  const url = new URL(`${apiBaseUrl}/schedules/${id}`);
+
+  try {
+    const response = await fetch(url.toString(), {
+      method: "DELETE",
+      headers,
+    });
+
+    const result = await handleApiResponse(response);
+    if (!result?.error) {
+      revalidateScheduleViews();
+    }
+    return result;
+  } catch (error) {
+    return handleApiError(error);
+  }
+};
diff --git a/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.test.ts b/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.test.ts
index d95966e680..41118bd6e2 100644
--- a/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.test.ts
+++ b/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.test.ts
@@ -14,7 +14,7 @@ const lastFetchCall = (): { url: string; init: RequestInit } => {
 describe("confirmAlertRecipient", () => {
   beforeEach(() => {
     vi.stubGlobal("fetch", fetchMock);
-    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://api.example.com/api/v1");
+    vi.stubEnv("UI_API_BASE_URL", "https://api.example.com/api/v1");
     fetchMock.mockResolvedValue(
       new Response(
         JSON.stringify({
@@ -104,7 +104,8 @@ describe("confirmAlertRecipient", () => {
   });
 
   it("returns the fallback message when the API base URL is missing", async () => {
-    // Given
+    // Given - neither the new name nor its legacy fallback is set
+    vi.stubEnv("UI_API_BASE_URL", "");
     vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "");
 
     // When
@@ -120,6 +121,21 @@ describe("confirmAlertRecipient", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
+  it("falls back to the deprecated NEXT_PUBLIC_API_BASE_URL when UI_API_BASE_URL is unset", async () => {
+    // Given - only the legacy name is configured
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com/api/v1");
+
+    // When
+    const result = await confirmAlertRecipient("token-1");
+
+    // Then
+    expect(result.ok).toBe(true);
+    expect(lastFetchCall().url).toBe(
+      "https://legacy.example.com/api/v1/alerts/recipients/confirm?token=token-1",
+    );
+  });
+
   it("returns the fallback message when the request fails", async () => {
     // Given
     fetchMock.mockRejectedValueOnce(new Error("network down"));
diff --git a/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.ts b/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.ts
index b567bb4124..19e9216339 100644
--- a/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.ts
+++ b/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.ts
@@ -1,3 +1,5 @@
+import { readEnv } from "@/lib/runtime-env";
+
 interface AlertConfirmApiResponse {
   state?: string;
   message?: string;
@@ -41,7 +43,7 @@ const toState = (payload: unknown): string => {
 export const confirmAlertRecipient = async (
   token?: string,
 ): Promise<AlertConfirmResult> => {
-  const apiBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL;
+  const apiBaseUrl = readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL");
   if (!apiBaseUrl) {
     return {
       ok: false,
diff --git a/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.test.ts b/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.test.ts
index 8a595fa63e..508625b4be 100644
--- a/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.test.ts
+++ b/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.test.ts
@@ -14,7 +14,7 @@ const lastFetchCall = (): { url: string; init: RequestInit } => {
 describe("unsubscribeAlertRecipient", () => {
   beforeEach(() => {
     vi.stubGlobal("fetch", fetchMock);
-    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://api.example.com/api/v1");
+    vi.stubEnv("UI_API_BASE_URL", "https://api.example.com/api/v1");
     fetchMock.mockResolvedValue(
       new Response(
         JSON.stringify({
@@ -102,4 +102,37 @@ describe("unsubscribeAlertRecipient", () => {
       "https://api.example.com/api/v1/alerts/recipients/unsubscribe",
     );
   });
+
+  it("returns the fallback message when the API base URL is missing", async () => {
+    // Given - neither the new name nor its legacy fallback is set
+    vi.stubEnv("UI_API_BASE_URL", "");
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "");
+
+    // When
+    const result = await unsubscribeAlertRecipient("token-1");
+
+    // Then
+    expect(result).toEqual({
+      ok: false,
+      state: "missing_api_base_url",
+      message:
+        "We could not process this unsubscribe link. Please try again later.",
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("falls back to the deprecated NEXT_PUBLIC_API_BASE_URL when UI_API_BASE_URL is unset", async () => {
+    // Given - only the legacy name is configured
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com/api/v1");
+
+    // When
+    const result = await unsubscribeAlertRecipient("token-1");
+
+    // Then
+    expect(result.ok).toBe(true);
+    expect(lastFetchCall().url).toBe(
+      "https://legacy.example.com/api/v1/alerts/recipients/unsubscribe?token=token-1",
+    );
+  });
 });
diff --git a/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.ts b/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.ts
index af64165a1e..8c3a4e2a79 100644
--- a/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.ts
+++ b/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.ts
@@ -1,3 +1,5 @@
+import { readEnv } from "@/lib/runtime-env";
+
 interface AlertUnsubscribeApiResponse {
   state?: string;
   message?: string;
@@ -41,7 +43,7 @@ const toState = (payload: unknown): string => {
 export const unsubscribeAlertRecipient = async (
   token?: string,
 ): Promise<AlertUnsubscribeResult> => {
-  const apiBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL;
+  const apiBaseUrl = readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL");
   if (!apiBaseUrl) {
     return {
       ok: false,
diff --git a/ui/app/(auth)/layout.tsx b/ui/app/(auth)/layout.tsx
index 07fe3a60c3..79a4ce4e89 100644
--- a/ui/app/(auth)/layout.tsx
+++ b/ui/app/(auth)/layout.tsx
@@ -2,12 +2,15 @@ import "@/styles/globals.css";
 
 import { GoogleTagManager } from "@next/third-parties/google";
 import { Metadata, Viewport } from "next";
+import { connection } from "next/server";
 import { ReactNode, Suspense } from "react";
 
+import { RuntimePublicConfig } from "@/components/runtime-config/runtime-public-config";
 import { NavigationProgress, Toaster } from "@/components/ui";
 import { fontSans } from "@/config/fonts";
 import { siteConfig } from "@/config/site";
 import { cn } from "@/lib";
+import { readEnv } from "@/lib/runtime-env";
 
 import { Providers } from "../providers";
 
@@ -29,10 +32,27 @@ export const viewport: Viewport = {
   ],
 };
 
-export default function AuthLayout({ children }: { children: ReactNode }) {
+export default async function AuthLayout({
+  children,
+}: {
+  children: ReactNode;
+}) {
+  // Force dynamic rendering so the read below resolves from the container env
+  // at request time rather than being snapshotted at build (independent of the
+  // <RuntimePublicConfig/> island's own connection() call).
+  await connection();
+
+  // Server-side runtime read. Empty/unset id ⇒ GoogleTagManager is not mounted
+  const gtmId = readEnv(
+    "UI_GOOGLE_TAG_MANAGER_ID",
+    "NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID",
+  );
+
   return (
     <html suppressHydrationWarning lang="en">
-      <head />
+      <head>
+        <RuntimePublicConfig />
+      </head>
       <body
         suppressHydrationWarning
         className={cn(
@@ -46,9 +66,7 @@ export default function AuthLayout({ children }: { children: ReactNode }) {
           </Suspense>
           {children}
           <Toaster />
-          <GoogleTagManager
-            gtmId={process.env.NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID || ""}
-          />
+          {gtmId && <GoogleTagManager gtmId={gtmId} />}
         </Providers>
       </body>
     </html>
diff --git a/ui/app/(prowler)/_overview/_components/accounts-selector.test.tsx b/ui/app/(prowler)/_overview/_components/accounts-selector.test.tsx
index 626e0985da..19c63cf3d2 100644
--- a/ui/app/(prowler)/_overview/_components/accounts-selector.test.tsx
+++ b/ui/app/(prowler)/_overview/_components/accounts-selector.test.tsx
@@ -1,4 +1,4 @@
-import { render, screen } from "@testing-library/react";
+import { render, screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { describe, expect, it, vi } from "vitest";
 
@@ -57,7 +57,7 @@ vi.mock("@/components/shadcn/select/multiselect", () => ({
     );
   },
   MultiSelectTrigger: ({ children }: { children: React.ReactNode }) => (
-    <div>{children}</div>
+    <div data-testid="trigger">{children}</div>
   ),
   MultiSelectValue: ({ placeholder }: { placeholder: string }) => (
     <span>{placeholder}</span>
@@ -220,4 +220,45 @@ describe("AccountsSelector", () => {
 
     expect(multiSelectSpy).toHaveBeenLastCalledWith({ open: false });
   });
+
+  it("shows the provider icon next to the name in the trigger for a single selection", async () => {
+    render(
+      <AccountsSelector
+        providers={providers}
+        onBatchChange={vi.fn()}
+        selectedValues={["provider-1"]}
+      />,
+    );
+
+    const trigger = screen.getByTestId("trigger");
+    expect(await within(trigger).findByText("AWS")).toBeInTheDocument();
+    expect(within(trigger).getByText("Production AWS")).toBeInTheDocument();
+  });
+
+  it("renders one icon per selected account without deduping by provider type", async () => {
+    const secondAws = {
+      ...providers[0],
+      id: "provider-2",
+      attributes: {
+        ...providers[0].attributes,
+        uid: "999999999999",
+        alias: "Staging AWS",
+      },
+    };
+
+    render(
+      <AccountsSelector
+        providers={[providers[0], secondAws]}
+        onBatchChange={vi.fn()}
+        selectedValues={["provider-1", "provider-2"]}
+      />,
+    );
+
+    const trigger = screen.getByTestId("trigger");
+    // Two AWS accounts -> two AWS icons in the trigger (no dedupe).
+    expect(await within(trigger).findAllByText("AWS")).toHaveLength(2);
+    expect(
+      within(trigger).getByText("2 Providers selected"),
+    ).toBeInTheDocument();
+  });
 });
diff --git a/ui/app/(prowler)/_overview/_components/accounts-selector.tsx b/ui/app/(prowler)/_overview/_components/accounts-selector.tsx
index a37807e793..0c389febb7 100644
--- a/ui/app/(prowler)/_overview/_components/accounts-selector.tsx
+++ b/ui/app/(prowler)/_overview/_components/accounts-selector.tsx
@@ -1,26 +1,12 @@
 "use client";
 
 import { useSearchParams } from "next/navigation";
-import { ReactNode, useState } from "react";
+import { useState } from "react";
 
 import {
-  AlibabaCloudProviderBadge,
-  AWSProviderBadge,
-  AzureProviderBadge,
-  CloudflareProviderBadge,
-  GCPProviderBadge,
-  GitHubProviderBadge,
-  GoogleWorkspaceProviderBadge,
-  IacProviderBadge,
-  ImageProviderBadge,
-  KS8ProviderBadge,
-  M365ProviderBadge,
-  MongoDBAtlasProviderBadge,
-  OktaProviderBadge,
-  OpenStackProviderBadge,
-  OracleCloudProviderBadge,
-  VercelProviderBadge,
-} from "@/components/icons/providers-badge";
+  ProviderTypeIcon,
+  ProviderTypeIconStack,
+} from "@/components/icons/providers-badge/provider-type-icon";
 import { Badge } from "@/components/shadcn";
 import {
   MultiSelect,
@@ -45,25 +31,6 @@ const ACCOUNT_SELECTOR_FILTER = {
 type AccountSelectorFilter =
   (typeof ACCOUNT_SELECTOR_FILTER)[keyof typeof ACCOUNT_SELECTOR_FILTER];
 
-const PROVIDER_ICON: Record<ProviderType, ReactNode> = {
-  aws: <AWSProviderBadge width={18} height={18} />,
-  azure: <AzureProviderBadge width={18} height={18} />,
-  gcp: <GCPProviderBadge width={18} height={18} />,
-  kubernetes: <KS8ProviderBadge width={18} height={18} />,
-  m365: <M365ProviderBadge width={18} height={18} />,
-  github: <GitHubProviderBadge width={18} height={18} />,
-  googleworkspace: <GoogleWorkspaceProviderBadge width={18} height={18} />,
-  iac: <IacProviderBadge width={18} height={18} />,
-  image: <ImageProviderBadge width={18} height={18} />,
-  oraclecloud: <OracleCloudProviderBadge width={18} height={18} />,
-  mongodbatlas: <MongoDBAtlasProviderBadge width={18} height={18} />,
-  alibabacloud: <AlibabaCloudProviderBadge width={18} height={18} />,
-  cloudflare: <CloudflareProviderBadge width={18} height={18} />,
-  openstack: <OpenStackProviderBadge width={18} height={18} />,
-  vercel: <VercelProviderBadge width={18} height={18} />,
-  okta: <OktaProviderBadge width={18} height={18} />,
-};
-
 /** Common props shared by both batch and instant modes. */
 interface AccountsSelectorBaseProps {
   providers: ProviderProps[];
@@ -158,10 +125,36 @@ export function AccountsSelector({
     if (selectedIds.length === 1) {
       const p = providers.find((pr) => getProviderValue(pr) === selectedIds[0]);
       const name = p ? p.attributes.alias || p.attributes.uid : selectedIds[0];
-      return <span className="truncate">{name}</span>;
+      return (
+        <span className="flex min-w-0 items-center gap-2">
+          {p && (
+            <span aria-hidden="true">
+              <ProviderTypeIcon type={p.attributes.provider} />
+            </span>
+          )}
+          <span className="truncate">{name}</span>
+        </span>
+      );
     }
+    // One icon per selected account (no dedupe): two accounts of the same
+    // provider show two icons, disambiguated by the UID tooltip on hover.
+    const items = selectedIds
+      .map((selectedId) =>
+        providers.find((pr) => getProviderValue(pr) === selectedId),
+      )
+      .filter((p): p is ProviderProps => Boolean(p))
+      .map((p) => ({
+        key: p.id,
+        type: p.attributes.provider as ProviderType,
+        tooltip: p.attributes.uid,
+      }));
     return (
-      <span className="truncate">{selectedIds.length} Providers selected</span>
+      <span className="flex min-w-0 items-center gap-2">
+        <ProviderTypeIconStack items={items} />
+        <span className="truncate">
+          {selectedIds.length} Providers selected
+        </span>
+      </span>
     );
   };
 
@@ -208,7 +201,6 @@ export function AccountsSelector({
                 const isDisabled = disabledValuesSet.has(value);
                 const displayName = p.attributes.alias || p.attributes.uid;
                 const providerType = p.attributes.provider as ProviderType;
-                const icon = PROVIDER_ICON[providerType];
                 const searchKeywords = [
                   displayName,
                   p.attributes.alias,
@@ -228,7 +220,9 @@ export function AccountsSelector({
                       if (closeOnSelect) setSelectorOpen(false);
                     }}
                   >
-                    <span aria-hidden="true">{icon}</span>
+                    <span aria-hidden="true">
+                      <ProviderTypeIcon type={providerType} />
+                    </span>
                     <span className="flex min-w-0 flex-1 items-center gap-2">
                       <span className="truncate">{displayName}</span>
                       {isDisabled && <Badge variant="tag">Disconnected</Badge>}
diff --git a/ui/app/(prowler)/_overview/_components/provider-type-selector.test.tsx b/ui/app/(prowler)/_overview/_components/provider-type-selector.test.tsx
index 5cd94a3087..b2c05b336d 100644
--- a/ui/app/(prowler)/_overview/_components/provider-type-selector.test.tsx
+++ b/ui/app/(prowler)/_overview/_components/provider-type-selector.test.tsx
@@ -1,4 +1,4 @@
-import { render, screen } from "@testing-library/react";
+import { render, screen, within } from "@testing-library/react";
 import { describe, expect, it, vi } from "vitest";
 
 import { ProviderTypeSelector } from "./provider-type-selector";
@@ -39,7 +39,7 @@ vi.mock("@/components/shadcn/select/multiselect", () => ({
     <div>{children}</div>
   ),
   MultiSelectTrigger: ({ children }: { children: React.ReactNode }) => (
-    <div>{children}</div>
+    <div data-testid="trigger">{children}</div>
   ),
   MultiSelectValue: ({ placeholder }: { placeholder: string }) => (
     <span>{placeholder}</span>
@@ -145,4 +145,26 @@ describe("ProviderTypeSelector", () => {
     ).toHaveAttribute("aria-disabled", "true");
     expect(screen.getByText("All selected")).toBeInTheDocument();
   });
+
+  it("shows one icon per selected type and a count in the trigger", async () => {
+    const azure = {
+      ...providers[0],
+      id: "provider-2",
+      attributes: { ...providers[0].attributes, provider: "azure" as const },
+    };
+
+    render(
+      <ProviderTypeSelector
+        providers={[providers[0], azure]}
+        onBatchChange={vi.fn()}
+        selectedValues={["aws", "azure"]}
+      />,
+    );
+
+    const trigger = screen.getByTestId("trigger");
+    expect(await within(trigger).findByText("AWS")).toBeInTheDocument();
+    expect(
+      within(trigger).getByText("2 Provider Types selected"),
+    ).toBeInTheDocument();
+  });
 });
diff --git a/ui/app/(prowler)/_overview/_components/provider-type-selector.tsx b/ui/app/(prowler)/_overview/_components/provider-type-selector.tsx
index 15d069b49d..e78412eeeb 100644
--- a/ui/app/(prowler)/_overview/_components/provider-type-selector.tsx
+++ b/ui/app/(prowler)/_overview/_components/provider-type-selector.tsx
@@ -1,8 +1,12 @@
 "use client";
 
 import { useSearchParams } from "next/navigation";
-import { type ComponentType, lazy, Suspense } from "react";
 
+import {
+  PROVIDER_TYPE_DATA,
+  ProviderTypeIcon,
+  ProviderTypeIconStack,
+} from "@/components/icons/providers-badge/provider-type-icon";
 import {
   MultiSelect,
   MultiSelectContent,
@@ -14,163 +18,6 @@ import {
 import { useUrlFilters } from "@/hooks/use-url-filters";
 import { type ProviderProps, ProviderType } from "@/types/providers";
 
-const AWSProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.AWSProviderBadge,
-  })),
-);
-const AzureProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.AzureProviderBadge,
-  })),
-);
-const GCPProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.GCPProviderBadge,
-  })),
-);
-const KS8ProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.KS8ProviderBadge,
-  })),
-);
-const M365ProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.M365ProviderBadge,
-  })),
-);
-const GitHubProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.GitHubProviderBadge,
-  })),
-);
-const IacProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.IacProviderBadge,
-  })),
-);
-const ImageProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.ImageProviderBadge,
-  })),
-);
-const OracleCloudProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.OracleCloudProviderBadge,
-  })),
-);
-const MongoDBAtlasProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.MongoDBAtlasProviderBadge,
-  })),
-);
-const AlibabaCloudProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.AlibabaCloudProviderBadge,
-  })),
-);
-const CloudflareProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.CloudflareProviderBadge,
-  })),
-);
-const OpenStackProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.OpenStackProviderBadge,
-  })),
-);
-const GoogleWorkspaceProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.GoogleWorkspaceProviderBadge,
-  })),
-);
-const VercelProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.VercelProviderBadge,
-  })),
-);
-const OktaProviderBadge = lazy(() =>
-  import("@/components/icons/providers-badge").then((m) => ({
-    default: m.OktaProviderBadge,
-  })),
-);
-
-type IconProps = { width: number; height: number };
-
-const IconPlaceholder = ({ width, height }: IconProps) => (
-  <div style={{ width, height }} />
-);
-
-const PROVIDER_DATA: Record<
-  ProviderType,
-  { label: string; icon: ComponentType<IconProps> }
-> = {
-  aws: {
-    label: "Amazon Web Services",
-    icon: AWSProviderBadge,
-  },
-  azure: {
-    label: "Microsoft Azure",
-    icon: AzureProviderBadge,
-  },
-  gcp: {
-    label: "Google Cloud Platform",
-    icon: GCPProviderBadge,
-  },
-  kubernetes: {
-    label: "Kubernetes",
-    icon: KS8ProviderBadge,
-  },
-  m365: {
-    label: "Microsoft 365",
-    icon: M365ProviderBadge,
-  },
-  github: {
-    label: "GitHub",
-    icon: GitHubProviderBadge,
-  },
-  googleworkspace: {
-    label: "Google Workspace",
-    icon: GoogleWorkspaceProviderBadge,
-  },
-  iac: {
-    label: "Infrastructure as Code",
-    icon: IacProviderBadge,
-  },
-  image: {
-    label: "Container Registry",
-    icon: ImageProviderBadge,
-  },
-  oraclecloud: {
-    label: "Oracle Cloud Infrastructure",
-    icon: OracleCloudProviderBadge,
-  },
-  mongodbatlas: {
-    label: "MongoDB Atlas",
-    icon: MongoDBAtlasProviderBadge,
-  },
-  alibabacloud: {
-    label: "Alibaba Cloud",
-    icon: AlibabaCloudProviderBadge,
-  },
-  cloudflare: {
-    label: "Cloudflare",
-    icon: CloudflareProviderBadge,
-  },
-  openstack: {
-    label: "OpenStack",
-    icon: OpenStackProviderBadge,
-  },
-  vercel: {
-    label: "Vercel",
-    icon: VercelProviderBadge,
-  },
-  okta: {
-    label: "Okta",
-    icon: OktaProviderBadge,
-  },
-};
-
 /** Common props shared by both batch and instant modes. */
 interface ProviderTypeSelectorBaseProps {
   providers: ProviderProps[];
@@ -247,34 +94,38 @@ export const ProviderTypeSelector = ({
         .map((p) => p.attributes.provider),
     ),
   )
-    .filter((type): type is ProviderType => type in PROVIDER_DATA)
+    .filter((type): type is ProviderType => type in PROVIDER_TYPE_DATA)
     .sort((a, b) =>
-      PROVIDER_DATA[a].label.localeCompare(PROVIDER_DATA[b].label),
+      PROVIDER_TYPE_DATA[a].label.localeCompare(PROVIDER_TYPE_DATA[b].label),
     );
 
-  const renderIcon = (providerType: ProviderType) => {
-    const IconComponent = PROVIDER_DATA[providerType].icon;
-    return (
-      <Suspense fallback={<IconPlaceholder width={24} height={24} />}>
-        <IconComponent width={24} height={24} />
-      </Suspense>
-    );
-  };
-
   const selectedLabel = () => {
     if (selectedTypes.length === 0) return null;
     if (selectedTypes.length === 1) {
       const providerType = selectedTypes[0] as ProviderType;
       return (
         <span className="flex min-w-0 items-center gap-2">
-          {renderIcon(providerType)}
-          <span className="truncate">{PROVIDER_DATA[providerType].label}</span>
+          <span aria-hidden="true">
+            <ProviderTypeIcon type={providerType} />
+          </span>
+          <span className="truncate">
+            {PROVIDER_TYPE_DATA[providerType].label}
+          </span>
         </span>
       );
     }
     return (
-      <span className="min-w-0 truncate">
-        {selectedTypes.length} Provider Types selected
+      <span className="flex min-w-0 items-center gap-2">
+        <ProviderTypeIconStack
+          items={(selectedTypes as ProviderType[]).map((type) => ({
+            key: type,
+            type,
+            tooltip: PROVIDER_TYPE_DATA[type].label,
+          }))}
+        />
+        <span className="min-w-0 truncate">
+          {selectedTypes.length} Provider Types selected
+        </span>
       </span>
     );
   };
@@ -329,12 +180,17 @@ export const ProviderTypeSelector = ({
                 <MultiSelectItem
                   key={providerType}
                   value={providerType}
-                  badgeLabel={PROVIDER_DATA[providerType].label}
-                  keywords={[providerType, PROVIDER_DATA[providerType].label]}
-                  aria-label={`${PROVIDER_DATA[providerType].label} Provider Type`}
+                  badgeLabel={PROVIDER_TYPE_DATA[providerType].label}
+                  keywords={[
+                    providerType,
+                    PROVIDER_TYPE_DATA[providerType].label,
+                  ]}
+                  aria-label={`${PROVIDER_TYPE_DATA[providerType].label} Provider Type`}
                 >
-                  <span aria-hidden="true">{renderIcon(providerType)}</span>
-                  <span>{PROVIDER_DATA[providerType].label}</span>
+                  <span aria-hidden="true">
+                    <ProviderTypeIcon type={providerType} size={24} />
+                  </span>
+                  <span>{PROVIDER_TYPE_DATA[providerType].label}</span>
                 </MultiSelectItem>
               ))}
             </>
diff --git a/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
index be336be2a7..026ba439f1 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
@@ -14,6 +14,7 @@ import {
 } from "@/app/(prowler)/alerts/_types";
 import type { ProviderProps } from "@/types/providers";
 
+import { ALERTS_PERMISSION_ERROR } from "../../_lib/alert-errors";
 import { AlertFormModal } from "../alert-form-modal";
 
 const recipientsActionMocks = vi.hoisted(() => ({
@@ -701,6 +702,53 @@ describe("AlertFormModal", () => {
     expect(errorMessage).toHaveClass("text-text-error-primary");
   });
 
+  it("should clear the preview error when save shows the form error", async () => {
+    // Given
+    const user = userEvent.setup();
+    alertsActionMocks.seedAlertRule.mockResolvedValue({
+      error: "No alert-compatible filters",
+    });
+    mockRecipientsList();
+    renderCreateModal({ editingAlert: createEditingAlert() });
+
+    // When
+    await user.click(screen.getByRole("button", { name: /^test$/i }));
+    expect(await screen.findByText("Test result")).toBeVisible();
+    await user.click(screen.getByRole("button", { name: /^save$/i }));
+
+    // Then
+    await waitFor(() =>
+      expect(screen.queryByText("Test result")).not.toBeInTheDocument(),
+    );
+    expect(
+      screen.getAllByText(
+        "Apply at least one alert-compatible Findings filter.",
+      ),
+    ).toHaveLength(1);
+  });
+
+  it("should show the manage alerts permission error when save seed is forbidden", async () => {
+    // Given
+    const user = userEvent.setup();
+    alertsActionMocks.seedAlertRule.mockResolvedValue({
+      error: "You do not have permission to perform this action.",
+      status: 403,
+    });
+    mockRecipientsList();
+    renderCreateModal({ editingAlert: createEditingAlert() });
+
+    // When
+    await user.click(screen.getByRole("button", { name: /^save$/i }));
+
+    // Then
+    expect(await screen.findByText(ALERTS_PERMISSION_ERROR)).toBeVisible();
+    expect(
+      screen.queryByText(
+        "Apply at least one alert-compatible Findings filter.",
+      ),
+    ).not.toBeInTheDocument();
+  });
+
   it("should hydrate advanced edit mode filters and normalize them on save", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
index 1ee2c67302..c8a6c9fb61 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
@@ -1,6 +1,6 @@
 import { render, screen, waitFor } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { isValidElement, type ReactNode } from "react";
+import { isValidElement, type ReactNode, useState } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import {
@@ -8,7 +8,12 @@ import {
   ALERT_TRIGGER_KINDS,
   type AlertRule,
 } from "@/app/(prowler)/alerts/_types";
+import type {
+  AlertFormSubmitResult,
+  AlertFormValues,
+} from "@/app/(prowler)/alerts/_types/alert-form";
 
+import { ALERTS_PERMISSION_ERROR } from "../../_lib/alert-errors";
 import { AlertsManager } from "../alerts-manager";
 
 const actionMocks = vi.hoisted(() => ({
@@ -96,12 +101,32 @@ vi.mock("../alert-form-modal", () => ({
     open,
     editingAlert,
     onOpenChange,
+    onSubmit,
   }: {
     open: boolean;
     editingAlert?: AlertRule | null;
     onOpenChange: (open: boolean) => void;
-  }) =>
-    open ? (
+    onSubmit: (values: AlertFormValues) => Promise<AlertFormSubmitResult>;
+  }) => {
+    const [error, setError] = useState<string | null>(null);
+
+    const submit = async () => {
+      const result = await onSubmit({
+        name: "Updated alert",
+        description: "",
+        method: "email",
+        frequency: ALERT_TRIGGER_KINDS.AFTER_SCAN,
+        condition: {
+          op: ALERT_AGGREGATE_OPS.ANY,
+          filter: { severity: ["critical"] },
+        },
+        recipientEmails: [],
+        enabled: true,
+      });
+      setError(result.ok ? null : (result.error ?? null));
+    };
+
+    return open ? (
       <div
         role="dialog"
         aria-label={editingAlert ? "Edit Alert" : "Create Alert"}
@@ -109,9 +134,14 @@ vi.mock("../alert-form-modal", () => ({
         <button type="button" onClick={() => onOpenChange(false)}>
           Close modal
         </button>
+        <button type="button" onClick={submit}>
+          Submit alert
+        </button>
         {editingAlert?.attributes.name}
+        {error && <p>{error}</p>}
       </div>
-    ) : null,
+    ) : null;
+  },
 }));
 
 vi.mock("../alerts-empty-state", () => ({
@@ -259,6 +289,38 @@ describe("AlertsManager", () => {
     });
   });
 
+  it("shows a manage alerts permission message for edit 403 errors", async () => {
+    // Given
+    const user = userEvent.setup();
+    const alert = makeAlert(true);
+    actionMocks.updateAlert.mockResolvedValue({
+      error: "You do not have permission to perform this action.",
+      status: 403,
+    });
+    render(
+      <AlertsManager
+        alerts={[alert]}
+        loadError={null}
+        providers={[]}
+        completedScanIds={[]}
+        scanDetails={[]}
+        uniqueRegions={[]}
+        uniqueServices={[]}
+        uniqueResourceTypes={[]}
+        uniqueCategories={[]}
+        uniqueGroups={[]}
+        initialEditingAlert={alert}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button", { name: /submit alert/i }));
+
+    // Then
+    expect(await screen.findByText(ALERTS_PERMISSION_ERROR)).toBeVisible();
+    expect(toastMock).not.toHaveBeenCalled();
+  });
+
   it("shows a success toast after disabling an alert", async () => {
     // Given
     const user = userEvent.setup();
@@ -281,6 +343,32 @@ describe("AlertsManager", () => {
     );
   });
 
+  it("shows a manage alerts permission toast for disable 403 errors", async () => {
+    // Given
+    const user = userEvent.setup();
+    const alert = makeAlert(true);
+    actionMocks.disableAlert.mockResolvedValue({
+      error: "You do not have permission to perform this action.",
+      status: 403,
+    });
+    renderManager([alert]);
+
+    // When
+    await user.click(
+      screen.getByRole("button", { name: /actions for enabled alert/i }),
+    );
+    await user.click(screen.getByRole("menuitem", { name: /disable/i }));
+
+    // Then
+    await waitFor(() =>
+      expect(toastMock).toHaveBeenCalledWith({
+        variant: "destructive",
+        title: "Alert update failed",
+        description: ALERTS_PERMISSION_ERROR,
+      }),
+    );
+  });
+
   it("shows a success toast after enabling an alert", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx b/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
index e3529d4056..8a9effd890 100644
--- a/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
+++ b/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
@@ -54,6 +54,7 @@ import {
   getEmptyAlertFormDefaults,
   getFindingsFiltersFromAlertCondition,
 } from "../_lib/alert-adapter";
+import { getAlertMutationError } from "../_lib/alert-errors";
 import { alertFormSchema } from "../_lib/alert-form-schema";
 import type {
   AlertFormSubmitResult,
@@ -408,7 +409,7 @@ const AlertFormModalContent = ({
     if (seedResult?.error) {
       setPreview({
         status: "error",
-        error: ALERT_SEED_ERROR,
+        error: getAlertMutationError(seedResult, ALERT_SEED_ERROR),
       });
       return;
     }
@@ -451,7 +452,10 @@ const AlertFormModalContent = ({
       ? await seedAlertRule(pendingFilters)
       : null;
     if (seedResult?.error) {
-      setErrors({ root: ALERT_SEED_ERROR });
+      setPreview(null);
+      setErrors({
+        root: getAlertMutationError(seedResult, ALERT_SEED_ERROR),
+      });
       return;
     }
 
diff --git a/ui/app/(prowler)/alerts/_components/alerts-manager.tsx b/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
index 2b995a179d..15d98299c5 100644
--- a/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
+++ b/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
@@ -23,6 +23,7 @@ import type { MetaDataProps, ScanEntity } from "@/types";
 import type { ProviderProps } from "@/types/providers";
 
 import { toAlertPayload } from "../_lib/alert-adapter";
+import { getAlertMutationError } from "../_lib/alert-errors";
 import type {
   AlertFormSubmitResult,
   AlertFormValues,
@@ -108,7 +109,12 @@ export const AlertsManager = ({
     }
     const payload = toAlertPayload(values);
     const result = await updateAlert(editingAlert.id, payload);
-    if (result?.error) return { ok: false, error: result.error };
+    if (result?.error) {
+      return {
+        ok: false,
+        error: getAlertMutationError(result),
+      };
+    }
     toast({
       title: "Alert updated",
       description: result.data.attributes.name,
@@ -127,7 +133,7 @@ export const AlertsManager = ({
       toast({
         variant: "destructive",
         title: "Alert update failed",
-        description: result.error,
+        description: getAlertMutationError(result),
       });
       return;
     }
@@ -147,7 +153,7 @@ export const AlertsManager = ({
       toast({
         variant: "destructive",
         title: "Alert delete failed",
-        description: result.error,
+        description: getAlertMutationError(result),
       });
       return;
     }
diff --git a/ui/app/(prowler)/alerts/_lib/alert-errors.ts b/ui/app/(prowler)/alerts/_lib/alert-errors.ts
new file mode 100644
index 0000000000..a921338066
--- /dev/null
+++ b/ui/app/(prowler)/alerts/_lib/alert-errors.ts
@@ -0,0 +1,25 @@
+import {
+  ACTION_ERROR_STATUS,
+  getActionErrorMessage,
+} from "@/lib/action-errors";
+
+export const ALERTS_PERMISSION_ERROR =
+  "You don't have permission to manage alerts. Ask an administrator to update your role.";
+
+interface AlertActionErrorResult {
+  error: string;
+  status?: number;
+}
+
+export const getAlertMutationError = (
+  result: AlertActionErrorResult,
+  fallback = result.error,
+): string =>
+  getActionErrorMessage(
+    { ...result, error: fallback },
+    {
+      messages: {
+        [ACTION_ERROR_STATUS.FORBIDDEN]: ALERTS_PERMISSION_ERROR,
+      },
+    },
+  );
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.test.tsx
new file mode 100644
index 0000000000..f95aa99870
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.test.tsx
@@ -0,0 +1,65 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { ATTACK_PATHS_VIEW_STATES } from "../_lib/get-attack-paths-view-state";
+
+import { AttackPathsStatusPanel } from "./attack-paths-status-panel";
+
+describe("AttackPathsStatusPanel", () => {
+  it("renders the no-scans message with a link to Scan Jobs", () => {
+    render(
+      <AttackPathsStatusPanel state={ATTACK_PATHS_VIEW_STATES.NO_SCANS} />,
+    );
+    expect(screen.getByText(/no scans available/i)).toBeInTheDocument();
+    expect(
+      screen.getByRole("link", { name: /go to scan jobs/i }),
+    ).toHaveAttribute("href", "/scans");
+  });
+
+  it("renders the scan-pending message", () => {
+    render(
+      <AttackPathsStatusPanel state={ATTACK_PATHS_VIEW_STATES.SCAN_PENDING} />,
+    );
+    expect(screen.getByText(/scan in progress/i)).toBeInTheDocument();
+  });
+
+  it("renders the graph-building message with progress", () => {
+    render(
+      <AttackPathsStatusPanel
+        state={ATTACK_PATHS_VIEW_STATES.GRAPH_BUILDING}
+        progress={45}
+      />,
+    );
+    expect(
+      screen.getByText(/preparing attack paths data/i),
+    ).toBeInTheDocument();
+    expect(screen.getByText(/45%/)).toBeInTheDocument();
+  });
+
+  it("renders the no-graph-data message", () => {
+    render(
+      <AttackPathsStatusPanel state={ATTACK_PATHS_VIEW_STATES.NO_GRAPH_DATA} />,
+    );
+    expect(screen.getByText(/no attack paths data/i)).toBeInTheDocument();
+  });
+
+  it("renders the error message and calls onRetry when Retry is clicked", () => {
+    const onRetry = vi.fn();
+    render(
+      <AttackPathsStatusPanel
+        state={ATTACK_PATHS_VIEW_STATES.ERROR}
+        onRetry={onRetry}
+      />,
+    );
+    expect(screen.getByText(/couldn.t load scans/i)).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: /retry/i }));
+    expect(onRetry).toHaveBeenCalledOnce();
+  });
+
+  it("renders nothing for the ready state", () => {
+    const { container } = render(
+      <AttackPathsStatusPanel state={ATTACK_PATHS_VIEW_STATES.READY} />,
+    );
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.tsx
new file mode 100644
index 0000000000..89db0dbfd2
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.tsx
@@ -0,0 +1,87 @@
+import Link from "next/link";
+
+import { Button } from "@/components/shadcn";
+import { StatusAlert } from "@/components/shared/status-alert";
+
+import {
+  ATTACK_PATHS_VIEW_STATES,
+  type AttackPathsViewState,
+} from "../_lib/get-attack-paths-view-state";
+
+interface AttackPathsStatusPanelProps {
+  state: AttackPathsViewState;
+  progress?: number;
+  onRetry?: () => void;
+}
+
+/**
+ * Full-page status message shown whenever the Attack Paths graph is not yet
+ * queryable. The page renders the normal workflow instead once `state` is
+ * `READY` (this component renders nothing for `READY`/`LOADING`).
+ */
+export const AttackPathsStatusPanel = ({
+  state,
+  progress = 0,
+  onRetry,
+}: AttackPathsStatusPanelProps) => {
+  if (state === ATTACK_PATHS_VIEW_STATES.ERROR) {
+    return (
+      <StatusAlert
+        variant="error"
+        title="Couldn't load scans"
+        descriptionClassName="flex flex-col items-start gap-3"
+      >
+        <span>Something went wrong loading your scans.</span>
+        {onRetry ? (
+          <Button variant="outline" size="sm" onClick={onRetry}>
+            Retry
+          </Button>
+        ) : null}
+      </StatusAlert>
+    );
+  }
+
+  if (state === ATTACK_PATHS_VIEW_STATES.NO_SCANS) {
+    return (
+      <StatusAlert variant="info" title="No scans available">
+        <span>
+          You need to run a scan before you can analyze attack paths.{" "}
+          <Link href="/scans" className="font-medium underline">
+            Go to Scan Jobs
+          </Link>
+        </span>
+      </StatusAlert>
+    );
+  }
+
+  if (state === ATTACK_PATHS_VIEW_STATES.SCAN_PENDING) {
+    return (
+      <StatusAlert variant="info" title="Scan in progress">
+        <span>
+          Your scan is queued. Attack Paths will be available once it completes.
+        </span>
+      </StatusAlert>
+    );
+  }
+
+  if (state === ATTACK_PATHS_VIEW_STATES.GRAPH_BUILDING) {
+    return (
+      <StatusAlert variant="info" title="Preparing Attack Paths data">
+        <span>
+          We&apos;re building the graph from your latest scan ({progress}%).
+          This will be ready shortly.
+        </span>
+      </StatusAlert>
+    );
+  }
+
+  if (state === ATTACK_PATHS_VIEW_STATES.NO_GRAPH_DATA) {
+    return (
+      <StatusAlert variant="info" title="No Attack Paths data">
+        <span>This scan didn&apos;t produce Attack Paths data.</span>
+      </StatusAlert>
+    );
+  }
+
+  return null;
+};
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-execution-error.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-execution-error.tsx
index 084bcf6e16..b451cf58f6 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-execution-error.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-execution-error.tsx
@@ -1,6 +1,4 @@
-import { CircleAlert } from "lucide-react";
-
-import { Alert, AlertDescription, AlertTitle } from "@/components/shadcn";
+import { StatusAlert } from "@/components/shared/status-alert";
 
 interface QueryExecutionErrorProps {
   error: string;
@@ -14,17 +12,17 @@ export const QueryExecutionError = ({
   description,
 }: QueryExecutionErrorProps) => {
   return (
-    <Alert variant="error">
-      <CircleAlert className="size-4" />
-      <AlertTitle>{title}</AlertTitle>
-      <AlertDescription className="w-full gap-3">
-        {description ? <p>{description}</p> : null}
-        <div className="bg-bg-neutral-primary/70 border-border-neutral-secondary w-full rounded-md border px-3 py-2">
-          <pre className="text-text-error-primary font-mono text-xs break-words whitespace-pre-wrap">
-            {error}
-          </pre>
-        </div>
-      </AlertDescription>
-    </Alert>
+    <StatusAlert
+      variant="error"
+      title={title}
+      descriptionClassName="w-full gap-3"
+    >
+      {description ? <p>{description}</p> : null}
+      <div className="bg-bg-neutral-primary/70 border-border-neutral-secondary w-full rounded-md border px-3 py-2">
+        <pre className="text-text-error-primary font-mono text-xs break-words whitespace-pre-wrap">
+          {error}
+        </pre>
+      </div>
+    </StatusAlert>
   );
 };
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx
index 4aec4b97d3..5ec29558ff 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx
@@ -58,6 +58,7 @@ vi.mock("@/components/ui/table", () => ({
     data,
     metadata,
     controlledPage,
+    getRowAttributes,
   }: {
     columns: Array<{
       id?: string;
@@ -74,6 +75,10 @@ vi.mock("@/components/ui/table", () => ({
       };
     };
     controlledPage: number;
+    getRowAttributes?: (row: {
+      index: number;
+      original: AttackPathScan;
+    }) => Record<string, string | undefined>;
   }) => (
     <div>
       <span>{metadata.pagination.count} Total Entries</span>
@@ -95,8 +100,8 @@ vi.mock("@/components/ui/table", () => ({
           </tr>
         </thead>
         <tbody>
-          {data.map((row) => (
-            <tr key={row.id}>
+          {data.map((row, index) => (
+            <tr key={row.id} {...getRowAttributes?.({ index, original: row })}>
               {columns.map((column, index) => (
                 <td key={column.id ?? index}>
                   {column.cell
@@ -176,6 +181,20 @@ describe("ScanListTable", () => {
     );
   });
 
+  it("anchors the attack paths scan tour to the first visible scan row", () => {
+    render(
+      <ScanListTable scans={[createScan(1), createScan(2), createScan(3)]} />,
+    );
+
+    const firstRow = screen
+      .getAllByRole("radio", {
+        name: "Select scan",
+      })[0]
+      .closest("tr");
+
+    expect(firstRow).toHaveAttribute("data-tour-id", "attack-paths-scan-list");
+  });
+
   it("enables the radio button for a failed scan when graph data is ready", async () => {
     const user = userEvent.setup();
     const failedScan: AttackPathScan = {
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx
index 00a330810f..dd532f9ed6 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx
@@ -295,6 +295,9 @@ export const ScanListTable = ({ scans }: ScanListTableProps) => {
             handleSelectScan(row.original.id);
           }
         }}
+        getRowAttributes={(row) =>
+          row.index === 0 ? { "data-tour-id": "attack-paths-scan-list" } : {}
+        }
         enableRowSelection
         rowSelection={getSelectedRowSelection(paginatedScans, selectedScanId)}
       />
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/index.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/index.ts
index eec8e5f81a..c30edb519c 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/index.ts
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/index.ts
@@ -1,3 +1,4 @@
+export { useAttackPathScans } from "./use-attack-path-scans";
 export { useGraphState } from "./use-graph-state";
 export { useQueryBuilder } from "./use-query-builder";
 export { useWizardState } from "./use-wizard-state";
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts
new file mode 100644
index 0000000000..5957e175d7
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts
@@ -0,0 +1,102 @@
+"use client";
+
+import { useRef, useState } from "react";
+
+import { getAttackPathScans } from "@/actions/attack-paths";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import type { AttackPathScan } from "@/types/attack-paths";
+
+export interface UseAttackPathScansOptions {
+  /**
+   * Invoked once the initial load resolves with no scan whose graph data is
+   * ready (including empty results or a fetch failure). The page passes a
+   * redirect only during onboarding replay; an established user gets `undefined`
+   * and stays on the page.
+   */
+  onNoReadyScan?: () => void;
+}
+
+export interface UseAttackPathScansResult {
+  scans: AttackPathScan[];
+  scansLoading: boolean;
+  loadError: boolean;
+  refreshScans: () => Promise<void>;
+  retryLoadScans: () => Promise<void>;
+}
+
+/**
+ * `useData`-style hook owning the Attack Paths scan list. The direct
+ * `useEffect` (via `useMountEffect`) lives here, not in the component: the
+ * project forbids `useEffect` in components, but a reusable data hook is the
+ * sanctioned place for a mount-time fetch when no fetching library is wired up.
+ */
+export function useAttackPathScans(
+  options: UseAttackPathScansOptions = {},
+): UseAttackPathScansResult {
+  const { onNoReadyScan } = options;
+
+  const [scans, setScans] = useState<AttackPathScan[]>([]);
+  const [scansLoading, setScansLoading] = useState(true);
+  const [loadError, setLoadError] = useState(false);
+  const mountedRef = useRef(true);
+
+  // Silent background refresh for auto-refresh: never flips loading/error, so it
+  // can't disrupt the visible view if it fails.
+  const refreshScans = async () => {
+    try {
+      const scansData = await getAttackPathScans();
+      if (scansData?.data) {
+        setScans(scansData.data);
+      }
+    } catch (error) {
+      console.error("Failed to refresh scans:", error);
+    }
+  };
+
+  // Full (re)load: drives loading + error state. Runs on mount and is reused by
+  // the error view's Retry action. A successful empty result (`{ data: [] }`) is
+  // not an error; only a missing payload or a thrown request is.
+  const loadScans = async () => {
+    setScansLoading(true);
+    setLoadError(false);
+    try {
+      const scansData = await getAttackPathScans();
+      if (!mountedRef.current) return;
+      if (scansData?.data) {
+        setScans(scansData.data);
+        if (!scansData.data.some((scan) => scan.attributes.graph_data_ready)) {
+          onNoReadyScan?.();
+        }
+      } else {
+        setScans([]);
+        setLoadError(true);
+        onNoReadyScan?.();
+      }
+    } catch (error) {
+      if (!mountedRef.current) return;
+      console.error("Failed to load scans:", error);
+      setScans([]);
+      setLoadError(true);
+      onNoReadyScan?.();
+    } finally {
+      if (mountedRef.current) setScansLoading(false);
+    }
+  };
+
+  useMountEffect(() => {
+    mountedRef.current = true;
+    void loadScans();
+
+    return () => {
+      mountedRef.current = false;
+    };
+  });
+
+  return {
+    scans,
+    scansLoading,
+    loadError,
+    refreshScans,
+    retryLoadScans: loadScans,
+  };
+}
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.test.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.test.ts
new file mode 100644
index 0000000000..c6722021ed
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.test.ts
@@ -0,0 +1,152 @@
+import { describe, expect, it } from "vitest";
+
+import type { AttackPathScan, ScanState } from "@/types/attack-paths";
+
+import {
+  ATTACK_PATHS_VIEW_STATES,
+  getAttackPathsViewState,
+  getGraphBuildingProgress,
+  isScanInFlight,
+} from "./get-attack-paths-view-state";
+
+const scan = (
+  state: ScanState,
+  graph_data_ready: boolean,
+  progress = 0,
+): AttackPathScan => ({
+  type: "attack-paths-scans",
+  id: `${state}-${String(graph_data_ready)}-${progress}`,
+  attributes: {
+    state,
+    progress,
+    graph_data_ready,
+    provider_alias: "Provider",
+    provider_type: "aws",
+    provider_uid: "123456789012",
+    inserted_at: "2026-04-21T10:00:00Z",
+    started_at: "2026-04-21T10:00:00Z",
+    completed_at: null,
+    duration: null,
+  },
+  relationships: {
+    provider: { data: { type: "providers", id: "p" } },
+    scan: { data: { type: "scans", id: "s" } },
+    task: { data: { type: "tasks", id: "t" } },
+  },
+});
+
+describe("getAttackPathsViewState", () => {
+  it("returns loading while scans are loading, regardless of other inputs", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: true,
+        loadError: true,
+        scans: [],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.LOADING);
+  });
+
+  it("returns error on load failure (error wins over empty scans)", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: true,
+        scans: [],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.ERROR);
+  });
+
+  it("returns no-scans for an empty list", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.NO_SCANS);
+  });
+
+  it("returns ready when any provider has a queryable graph", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("executing", false, 50), scan("completed", true, 100)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.READY);
+  });
+
+  it("returns graph-building when none ready and some scan is executing (wins over scheduled)", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("scheduled", false), scan("executing", false, 30)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.GRAPH_BUILDING);
+  });
+
+  it("returns scan-pending when none ready and some scan is scheduled/available", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("scheduled", false)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.SCAN_PENDING);
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("available", false)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.SCAN_PENDING);
+  });
+
+  it("returns no-graph-data when none ready and all scans are terminal", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("completed", false), scan("failed", false)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.NO_GRAPH_DATA);
+  });
+});
+
+describe("isScanInFlight", () => {
+  it("is true for an available scan (created, not yet scheduled)", () => {
+    expect(isScanInFlight([scan("available", false)])).toBe(true);
+  });
+
+  it("is true for scheduled and executing scans", () => {
+    expect(isScanInFlight([scan("scheduled", false)])).toBe(true);
+    expect(isScanInFlight([scan("executing", false, 40)])).toBe(true);
+  });
+
+  it("is false when every scan is in a terminal state", () => {
+    expect(
+      isScanInFlight([scan("completed", true), scan("failed", false)]),
+    ).toBe(false);
+  });
+
+  it("is false for an empty list", () => {
+    expect(isScanInFlight([])).toBe(false);
+  });
+});
+
+describe("getGraphBuildingProgress", () => {
+  it("returns the max progress among executing scans", () => {
+    expect(
+      getGraphBuildingProgress([
+        scan("executing", false, 30),
+        scan("executing", false, 70),
+        scan("scheduled", false, 99),
+      ]),
+    ).toBe(70);
+  });
+
+  it("returns 0 when no scan is executing", () => {
+    expect(getGraphBuildingProgress([scan("scheduled", false, 50)])).toBe(0);
+  });
+});
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.ts
new file mode 100644
index 0000000000..0e734304f8
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.ts
@@ -0,0 +1,65 @@
+import type { AttackPathScan, ScanState } from "@/types/attack-paths";
+import { SCAN_STATES } from "@/types/attack-paths";
+
+// In-flight = scan still progressing toward a graph. AVAILABLE is the default
+// state of a new scan. Shared by the deriver and polling so they can't diverge.
+const IN_FLIGHT_SCAN_STATES: ScanState[] = [
+  SCAN_STATES.AVAILABLE,
+  SCAN_STATES.SCHEDULED,
+  SCAN_STATES.EXECUTING,
+];
+
+export const isScanInFlight = (scans: AttackPathScan[]): boolean =>
+  scans.some((s) => IN_FLIGHT_SCAN_STATES.includes(s.attributes.state));
+
+export const ATTACK_PATHS_VIEW_STATES = {
+  LOADING: "loading",
+  ERROR: "error",
+  NO_SCANS: "no-scans",
+  SCAN_PENDING: "scan-pending",
+  GRAPH_BUILDING: "graph-building",
+  NO_GRAPH_DATA: "no-graph-data",
+  READY: "ready",
+} as const;
+
+export type AttackPathsViewState =
+  (typeof ATTACK_PATHS_VIEW_STATES)[keyof typeof ATTACK_PATHS_VIEW_STATES];
+
+interface GetAttackPathsViewStateInput {
+  scansLoading: boolean;
+  loadError: boolean;
+  scans: AttackPathScan[];
+}
+
+/**
+ * Single source of truth for what the Attack Paths page shows. The full-page
+ * message owns every "not queryable yet" state; the workflow renders only once
+ * at least one provider's graph is ready.
+ */
+export const getAttackPathsViewState = ({
+  scansLoading,
+  loadError,
+  scans,
+}: GetAttackPathsViewStateInput): AttackPathsViewState => {
+  if (scansLoading) return ATTACK_PATHS_VIEW_STATES.LOADING;
+  if (loadError) return ATTACK_PATHS_VIEW_STATES.ERROR;
+  if (scans.length === 0) return ATTACK_PATHS_VIEW_STATES.NO_SCANS;
+
+  if (scans.some((s) => s.attributes.graph_data_ready)) {
+    return ATTACK_PATHS_VIEW_STATES.READY;
+  }
+  if (scans.some((s) => s.attributes.state === SCAN_STATES.EXECUTING)) {
+    return ATTACK_PATHS_VIEW_STATES.GRAPH_BUILDING;
+  }
+  // EXECUTING returned above; an in-flight scan here is AVAILABLE/SCHEDULED.
+  if (isScanInFlight(scans)) {
+    return ATTACK_PATHS_VIEW_STATES.SCAN_PENDING;
+  }
+  return ATTACK_PATHS_VIEW_STATES.NO_GRAPH_DATA;
+};
+
+/** Highest progress among scans whose graph is actively building. */
+export const getGraphBuildingProgress = (scans: AttackPathScan[]): number =>
+  scans
+    .filter((s) => s.attributes.state === SCAN_STATES.EXECUTING)
+    .reduce((max, s) => Math.max(max, s.attributes.progress), 0);
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx
index 9e455a4b6d..bc2cf36331 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx
@@ -75,6 +75,31 @@ describe("loading the page", () => {
   });
 });
 
+describe("waiting states", () => {
+  test("a pending scan shows the scan-in-progress message", async ({
+    mountWith,
+  }) => {
+    const graph = await mountWith(fixtures.scanPending());
+    expect(await graph.emptyStateMessage()).toMatch(/scan in progress/i);
+  });
+
+  test("a building graph shows the preparing message with progress", async ({
+    mountWith,
+  }) => {
+    const graph = await mountWith(fixtures.graphBuilding());
+    const message = await graph.emptyStateMessage();
+    expect(message).toMatch(/preparing attack paths data/i);
+    expect(message).toMatch(/45%/);
+  });
+
+  test("a completed scan with no graph shows the no-data message", async ({
+    mountWith,
+  }) => {
+    const graph = await mountWith(fixtures.noGraphData());
+    expect(await graph.emptyStateMessage()).toMatch(/no attack paths data/i);
+  });
+});
+
 describe("running a query", () => {
   test("the graph renders with a background, a minimap, and a viewport", async ({
     mountWith,
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts
index 37e2170355..41089af527 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts
@@ -143,6 +143,52 @@ export const emptyScans = (): PageFixture => ({
   queryResult: null,
 });
 
+export const scanPending = (): PageFixture => ({
+  scans: [
+    buildScan(TYPICAL_SCAN_ID, {
+      state: "scheduled",
+      progress: 0,
+      graph_data_ready: false,
+      completed_at: null,
+      duration: null,
+    }),
+  ],
+  scanId: TYPICAL_SCAN_ID,
+  queries: [],
+  queryId: DEFAULT_QUERY_ID,
+  queryResult: null,
+});
+
+export const graphBuilding = (): PageFixture => ({
+  scans: [
+    buildScan(TYPICAL_SCAN_ID, {
+      state: "executing",
+      progress: 45,
+      graph_data_ready: false,
+      completed_at: null,
+      duration: null,
+    }),
+  ],
+  scanId: TYPICAL_SCAN_ID,
+  queries: [],
+  queryId: DEFAULT_QUERY_ID,
+  queryResult: null,
+});
+
+export const noGraphData = (): PageFixture => ({
+  scans: [
+    buildScan(TYPICAL_SCAN_ID, {
+      state: "completed",
+      progress: 100,
+      graph_data_ready: false,
+    }),
+  ],
+  scanId: TYPICAL_SCAN_ID,
+  queries: [],
+  queryId: DEFAULT_QUERY_ID,
+  queryResult: null,
+});
+
 export const emptyGraph = (): PageFixture => ({
   scans: [buildScan(TYPICAL_SCAN_ID)],
   scanId: TYPICAL_SCAN_ID,
@@ -269,6 +315,9 @@ export const edgeCases = (): PageFixture => {
 export const fixtures = {
   typical,
   emptyScans,
+  scanPending,
+  graphBuilding,
+  noGraphData,
   emptyGraph,
   singleNode,
   findingsOnly,
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.test.tsx
deleted file mode 100644
index 8b91c3fb6e..0000000000
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.test.tsx
+++ /dev/null
@@ -1,19 +0,0 @@
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { describe, expect, it } from "vitest";
-
-describe("AttackPathsPage", () => {
-  const currentDir = path.dirname(fileURLToPath(import.meta.url));
-  const filePath = path.join(currentDir, "attack-paths-page.tsx");
-  const source = readFileSync(filePath, "utf8");
-
-  it("keeps the page description without rendering a duplicate Attack Paths heading", () => {
-    // Then
-    expect(source).not.toContain(">\n          Attack Paths\n        </h2>");
-    expect(source).toContain(
-      "Select a scan, build a query, and visualize Attack Paths in your",
-    );
-  });
-});
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
index 992fdee5ef..a103a326be 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
@@ -1,8 +1,7 @@
 "use client";
 
-import { ArrowLeft, Info, Maximize2 } from "lucide-react";
-import Link from "next/link";
-import { useSearchParams } from "next/navigation";
+import { ArrowLeft, Maximize2 } from "lucide-react";
+import { usePathname, useRouter, useSearchParams } from "next/navigation";
 import { Suspense, useEffect, useRef, useState } from "react";
 import { FormProvider } from "react-hook-form";
 
@@ -10,19 +9,14 @@ import {
   buildAttackPathQueries,
   executeCustomQuery,
   executeQuery,
-  getAttackPathScans,
   getAvailableQueries,
 } from "@/actions/attack-paths";
 import { adaptQueryResultToGraphData } from "@/actions/attack-paths/query-result.adapter";
 import { FindingDetailDrawer } from "@/components/findings/table";
+import { PageReady } from "@/components/onboarding";
 import { useFindingDetails } from "@/components/resources/table/use-finding-details";
 import { AutoRefresh } from "@/components/scans";
-import {
-  Alert,
-  AlertDescription,
-  AlertTitle,
-  Button,
-} from "@/components/shadcn";
+import { Button } from "@/components/shadcn";
 import {
   Dialog,
   DialogContent,
@@ -31,11 +25,21 @@ import {
   DialogTitle,
   DialogTrigger,
 } from "@/components/shadcn/dialog";
+import { StatusAlert } from "@/components/shared/status-alert";
 import { useToast } from "@/components/ui";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { isCloud } from "@/lib/shared/env";
+import { attackPathsEmptyTour } from "@/lib/tours/attack-paths-empty.tour";
+import {
+  attackPathsTour,
+  type AttackPathsTourTarget,
+  pickDemoQuery,
+  pickDemoScan,
+} from "@/lib/tours/attack-paths.tour";
+import { advanceActiveTour, useDriverTour } from "@/lib/tours/use-driver-tour";
 import type {
   AttackPathQuery,
   AttackPathQueryError,
-  AttackPathScan,
   GraphNode,
 } from "@/types/attack-paths";
 import { ATTACK_PATH_QUERY_IDS, SCAN_STATES } from "@/types/attack-paths";
@@ -52,24 +56,42 @@ import {
   QuerySelector,
   ScanListTable,
 } from "./_components";
+import { AttackPathsStatusPanel } from "./_components/attack-paths-status-panel";
 import type { GraphHandle } from "./_components/graph/attack-path-graph";
+import { useAttackPathScans } from "./_hooks/use-attack-path-scans";
 import { useGraphState } from "./_hooks/use-graph-state";
 import { useQueryBuilder } from "./_hooks/use-query-builder";
 import { exportGraphAsPNG } from "./_lib";
+import {
+  ATTACK_PATHS_VIEW_STATES,
+  getAttackPathsViewState,
+  getGraphBuildingProgress,
+  isScanInFlight,
+} from "./_lib/get-attack-paths-view-state";
+
+const SCROLL_CONTAINER_CLASS =
+  "minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4";
 
-/**
- * Attack Paths
- * Allows users to select a scan, build a query, and visualize the attack path graph
- */
 export default function AttackPathsPage() {
   const searchParams = useSearchParams();
+  const pathname = usePathname();
+  const router = useRouter();
   const scanId = searchParams.get("scanId");
+  // Onboarding tours are Cloud-only.
+  const onboardingEnabled = isCloud();
+  const isAttackPathsReplay =
+    onboardingEnabled && searchParams.get("onboarding") === "attack-paths";
   const graphState = useGraphState();
   const finding = useFindingDetails();
   const { toast } = useToast();
 
-  const [scansLoading, setScansLoading] = useState(true);
-  const [scans, setScans] = useState<AttackPathScan[]>([]);
+  const { scans, scansLoading, loadError, refreshScans, retryLoadScans } =
+    useAttackPathScans({
+      onNoReadyScan: isAttackPathsReplay
+        ? () => router.push("/scans?onboarding=view-first-scan")
+        : undefined,
+    });
+
   const [queriesLoading, setQueriesLoading] = useState(true);
   const [queriesError, setQueriesError] = useState<string | null>(null);
   const [isFullscreenOpen, setIsFullscreenOpen] = useState(false);
@@ -81,10 +103,64 @@ export default function AttackPathsPage() {
 
   const [queries, setQueries] = useState<AttackPathQuery[]>([]);
 
-  // Use custom hook for query builder form state and validation
   const queryBuilder = useQueryBuilder(queries);
 
-  // Reset graph state when component mounts
+  const hasReadyScan = scans.some((scan) => scan.attributes.graph_data_ready);
+  const hasNoScans = scans.length === 0;
+
+  useDriverTour(attackPathsEmptyTour, {
+    // Gate on !loadError: the empty-scans CTA anchor only renders in the
+    // NO_SCANS view-state, not in the ERROR state (which also has scans === []).
+    enabled: onboardingEnabled && !scansLoading && !loadError && hasNoScans,
+  });
+
+  const { start: startAttackPathsTour } = useDriverTour<AttackPathsTourTarget>(
+    attackPathsTour,
+    {
+      enabled: onboardingEnabled && !scansLoading && hasReadyScan,
+      autoOpen: !isAttackPathsReplay,
+      // Page owns tour auto-open; OnboardingSequenceBanner is the sole Continue/Skip control.
+      // pickDemoScan/pickDemoQuery policy lives in attack-paths.tour.ts.
+      stepHandlers: {
+        "scan-list": {
+          onNext: async ({ waitForStep }) => {
+            const selected = pickDemoScan(scans);
+            if (!selected) return;
+            const params = new URLSearchParams(searchParams.toString());
+            params.set("scanId", selected.id);
+            router.push(`${pathname}?${params.toString()}`);
+            await waitForStep("query-selector");
+          },
+        },
+        "query-selector": {
+          onNext: async ({ waitForStep }) => {
+            const selected = pickDemoQuery(queries);
+            if (!selected) return;
+            queryBuilder.handleQueryChange(selected.id);
+            await waitForStep("execute-button");
+          },
+        },
+      },
+    },
+  );
+
+  // Onboarding replay entry: start the tour once and strip the `onboarding`
+  // param. Invoked from <AttackPathsReplayTrigger>, which mounts only when the
+  // replay conditions hold — so `useMountEffect` fires it exactly once and the
+  // old `replayStartedRef` run-once guard is gone.
+  const startAttackPathsReplay = () => {
+    startAttackPathsTour();
+
+    const params = new URLSearchParams(searchParams.toString());
+    params.delete("onboarding");
+    const query = params.toString();
+    window.history.replaceState(
+      null,
+      "",
+      query ? `${pathname}?${query}` : pathname,
+    );
+  };
+
   useEffect(() => {
     if (!hasResetRef.current) {
       hasResetRef.current = true;
@@ -92,39 +168,14 @@ export default function AttackPathsPage() {
     }
   }, [graphState]);
 
-  // Reset graph state when scan changes
   useEffect(() => {
     graphState.resetGraph();
   }, [scanId]); // eslint-disable-line react-hooks/exhaustive-deps -- reset on scanId change only
 
-  // Load available scans on mount
-  useEffect(() => {
-    const loadScans = async () => {
-      setScansLoading(true);
-      try {
-        const scansData = await getAttackPathScans();
-        if (scansData?.data) {
-          setScans(scansData.data);
-        } else {
-          setScans([]);
-        }
-      } catch (error) {
-        console.error("Failed to load scans:", error);
-        setScans([]);
-      } finally {
-        setScansLoading(false);
-      }
-    };
+  // Poll while a scan is in flight so the page auto-advances when the graph is ready.
+  const hasScanInFlight = isScanInFlight(scans);
 
-    loadScans();
-  }, []);
-
-  // Check if there's an executing scan for auto-refresh
-  const hasExecutingScan = scans.some(
-    (scan) =>
-      scan.attributes.state === SCAN_STATES.EXECUTING ||
-      scan.attributes.state === SCAN_STATES.SCHEDULED,
-  );
+  const viewState = getAttackPathsViewState({ scansLoading, loadError, scans });
 
   // Detect if the selected scan is showing data from a previous cycle
   const selectedScan = scans.find((scan) => scan.id === scanId);
@@ -133,19 +184,6 @@ export default function AttackPathsPage() {
     selectedScan.attributes.graph_data_ready &&
     selectedScan.attributes.state !== SCAN_STATES.COMPLETED;
 
-  // Callback to refresh scans (used by AutoRefresh component)
-  const refreshScans = async () => {
-    try {
-      const scansData = await getAttackPathScans();
-      if (scansData?.data) {
-        setScans(scansData.data);
-      }
-    } catch (error) {
-      console.error("Failed to refresh scans:", error);
-    }
-  };
-
-  // Load available queries on mount
   useEffect(() => {
     const loadQueries = async () => {
       if (!scanId) {
@@ -205,7 +243,6 @@ export default function AttackPathsPage() {
       return;
     }
 
-    // Validate form before executing query
     const isValid = await queryBuilder.form.trigger();
     if (!isValid) {
       showErrorToast(
@@ -215,6 +252,9 @@ export default function AttackPathsPage() {
       return;
     }
 
+    // The tour's execute step is autoAdvance: the real Execute click moves it forward.
+    advanceActiveTour();
+
     graphState.startLoading();
     graphState.setError(null);
 
@@ -257,7 +297,6 @@ export default function AttackPathsPage() {
           variant: "default",
         });
 
-        // Scroll to graph after successful query execution
         setTimeout(() => {
           graphContainerRef.current?.scrollIntoView({
             behavior: "smooth",
@@ -297,13 +336,9 @@ export default function AttackPathsPage() {
       }
 
       findingNavigationInFlightRef.current = true;
-      // Findings skip the intermediate node-details modal. The finding drawer
-      // is the useful destination, so open it directly from the graph click.
+      // Open finding drawer directly, bypassing the node-details modal.
       graphState.enterFilteredView(node.id);
-      // enterFilteredView stores the filtered node as selected so the graph can
-      // highlight it. Clear the selection right after for findings so the node
-      // details modal does not open before the finding drawer.
-      graphState.selectNode(null);
+      graphState.selectNode(null); // clear so node-details modal doesn't open first
       void handleViewFinding(String(node.properties?.id || node.id));
       return;
     }
@@ -368,14 +403,19 @@ export default function AttackPathsPage() {
 
   return (
     <div className="flex flex-col gap-6">
-      {/* Auto-refresh scans when there's an executing scan */}
       <AutoRefresh
-        hasExecutingScan={hasExecutingScan}
+        hasExecutingScan={hasScanInFlight}
         onRefresh={refreshScans}
       />
 
-      {/* Page introduction */}
-      <div>
+      {isAttackPathsReplay && !scansLoading && hasReadyScan && (
+        <AttackPathsReplayTrigger onReplay={startAttackPathsReplay} />
+      )}
+
+      {/* Enables the navbar replay icon once the initial scan load resolves. */}
+      {!scansLoading && <PageReady />}
+
+      <div data-tour-id="attack-paths-intro">
         <p className="text-text-neutral-secondary text-sm">
           Select a scan, build a query, and visualize Attack Paths in your
           infrastructure.
@@ -386,48 +426,44 @@ export default function AttackPathsPage() {
         </p>
       </div>
 
-      {scansLoading ? (
-        <div className="minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4">
+      {viewState === ATTACK_PATHS_VIEW_STATES.LOADING ? (
+        <div className={SCROLL_CONTAINER_CLASS}>
           <p className="text-sm">Loading scans...</p>
         </div>
-      ) : scans.length === 0 ? (
-        <Alert variant="info">
-          <Info className="size-4" />
-          <AlertTitle>No scans available</AlertTitle>
-          <AlertDescription>
-            <span>
-              You need to run a scan before you can analyze attack paths.{" "}
-              <Link href="/scans" className="font-medium underline">
-                Go to Scan Jobs
-              </Link>
-            </span>
-          </AlertDescription>
-        </Alert>
+      ) : viewState === ATTACK_PATHS_VIEW_STATES.NO_SCANS ? (
+        // Keep the empty-scans tour anchor: attackPathsEmptyTour targets
+        // data-tour-id="attack-paths-empty-scans-cta". The panel's NO_SCANS
+        // render is the same "No scans available" + Go to Scan Jobs CTA.
+        <div data-tour-id="attack-paths-empty-scans-cta">
+          <AttackPathsStatusPanel state={viewState} />
+        </div>
+      ) : viewState !== ATTACK_PATHS_VIEW_STATES.READY ? (
+        <AttackPathsStatusPanel
+          state={viewState}
+          progress={getGraphBuildingProgress(scans)}
+          onRetry={retryLoadScans}
+        />
       ) : (
         <>
-          {/* Scans Table */}
           <Suspense fallback={<div>Loading scans...</div>}>
             <ScanListTable scans={scans} />
           </Suspense>
 
-          {/* Banner: viewing data from a previous scan cycle */}
           {isViewingPreviousCycleData && (
-            <Alert variant="info">
-              <Info className="size-4" />
-              <AlertTitle>Viewing data from a previous scan</AlertTitle>
-              <AlertDescription>
-                This scan is currently{" "}
-                {selectedScan.attributes.state === SCAN_STATES.EXECUTING
-                  ? `running (${selectedScan.attributes.progress}%)`
-                  : selectedScan.attributes.state}
-                . The graph data shown is from the last completed cycle.
-              </AlertDescription>
-            </Alert>
+            <StatusAlert
+              variant="info"
+              title="Viewing data from a previous scan"
+            >
+              This scan is currently{" "}
+              {selectedScan.attributes.state === SCAN_STATES.EXECUTING
+                ? `running (${selectedScan.attributes.progress}%)`
+                : selectedScan.attributes.state}
+              . The graph data shown is from the last completed cycle.
+            </StatusAlert>
           )}
 
-          {/* Query Builder Section - shown only after selecting a scan */}
           {scanId && (
-            <div className="minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4">
+            <div className={SCROLL_CONTAINER_CLASS}>
               {queriesLoading ? (
                 <p className="text-sm">Loading queries...</p>
               ) : queriesError ? (
@@ -438,11 +474,13 @@ export default function AttackPathsPage() {
               ) : (
                 <>
                   <FormProvider {...queryBuilder.form}>
-                    <QuerySelector
-                      queries={queries}
-                      selectedQueryId={queryBuilder.selectedQuery}
-                      onQueryChange={queryBuilder.handleQueryChange}
-                    />
+                    <div data-tour-id="attack-paths-query-selector">
+                      <QuerySelector
+                        queries={queries}
+                        selectedQueryId={queryBuilder.selectedQuery}
+                        onQueryChange={queryBuilder.handleQueryChange}
+                      />
+                    </div>
 
                     {queryBuilder.selectedQueryData && (
                       <QueryDescription
@@ -457,7 +495,10 @@ export default function AttackPathsPage() {
                     )}
                   </FormProvider>
 
-                  <div className="flex justify-end gap-3">
+                  <div
+                    data-tour-id="attack-paths-execute-button"
+                    className="flex justify-end gap-3"
+                  >
                     <ExecuteButton
                       isLoading={graphState.loading}
                       isDisabled={
@@ -476,19 +517,17 @@ export default function AttackPathsPage() {
             </div>
           )}
 
-          {/* Graph Visualization (Full Width) */}
           {(graphState.loading ||
             (graphState.data &&
               graphState.data.nodes &&
               graphState.data.nodes.length > 0)) && (
-            <div className="minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4">
+            <div className={SCROLL_CONTAINER_CLASS}>
               {graphState.loading ? (
                 <GraphLoading />
               ) : graphState.data &&
                 graphState.data.nodes &&
                 graphState.data.nodes.length > 0 ? (
                 <>
-                  {/* Info message and controls */}
                   <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
                     {graphState.isFilteredView ? (
                       <div className="flex items-center gap-3">
@@ -537,7 +576,6 @@ export default function AttackPathsPage() {
                       </div>
                     )}
 
-                    {/* Graph controls and fullscreen button together */}
                     <div className="flex items-center gap-2">
                       <GraphControls
                         onZoomIn={() => graphRef.current?.zoomIn()}
@@ -546,7 +584,6 @@ export default function AttackPathsPage() {
                         onExport={() => handleGraphExport("main")}
                       />
 
-                      {/* Fullscreen button */}
                       <div className="border-border-neutral-primary bg-bg-neutral-tertiary flex gap-1 rounded-lg border p-1">
                         <Dialog
                           open={isFullscreenOpen}
@@ -604,7 +641,6 @@ export default function AttackPathsPage() {
                     </div>
                   </div>
 
-                  {/* Graph in the middle */}
                   <div
                     ref={graphContainerRef}
                     className="h-[calc(100vh-22rem)]"
@@ -619,7 +655,6 @@ export default function AttackPathsPage() {
                     />
                   </div>
 
-                  {/* Legend below */}
                   <div className="flex justify-center overflow-x-auto">
                     <GraphLegend
                       data={graphState.data}
@@ -647,3 +682,26 @@ export default function AttackPathsPage() {
     </div>
   );
 }
+
+interface AttackPathsReplayTriggerProps {
+  onReplay: () => void;
+}
+
+// Conditional-mount trigger: the parent renders this only when the replay
+// should start. The microtask keeps driver.js/flushSync outside React's
+// mount lifecycle while still running before the next browser task.
+function AttackPathsReplayTrigger({ onReplay }: AttackPathsReplayTriggerProps) {
+  useMountEffect(() => {
+    let cancelled = false;
+
+    queueMicrotask(() => {
+      if (!cancelled) onReplay();
+    });
+
+    return () => {
+      cancelled = true;
+    };
+  });
+
+  return null;
+}
diff --git a/ui/app/(prowler)/attack-paths/layout.tsx b/ui/app/(prowler)/attack-paths/layout.tsx
index 5ff93faab2..3a9a90b6d1 100644
--- a/ui/app/(prowler)/attack-paths/layout.tsx
+++ b/ui/app/(prowler)/attack-paths/layout.tsx
@@ -6,7 +6,11 @@ export default function AttackPathsLayout({
   children: React.ReactNode;
 }) {
   return (
-    <ContentLayout title="Attack Paths" icon="lucide:git-branch">
+    <ContentLayout
+      title="Attack Paths"
+      icon="lucide:git-branch"
+      onboardingAction={{ flowId: "attack-paths" }}
+    >
       {children}
     </ContentLayout>
   );
diff --git a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
index 71e7870f8d..f5d42f8bc8 100644
--- a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
+++ b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
@@ -13,6 +13,7 @@ import {
   ClientAccordionWrapper,
   ComplianceDownloadContainer,
   ComplianceHeader,
+  ComplianceWarming,
   RequirementsStatusCard,
   RequirementsStatusCardSkeleton,
   // SectionsFailureRateCard,
@@ -86,12 +87,22 @@ export default async function ComplianceDetail({
           "filter[scan_id]": selectedScanId ?? undefined,
         },
       }),
-      getComplianceAttributes(complianceId),
+      getComplianceAttributes(complianceId, selectedScanId ?? undefined),
       selectedScanId
         ? getScan(selectedScanId, { include: "provider" })
         : Promise.resolve(null),
     ]);
 
+  // The compliance catalog is still warming after a deploy/restart. Show the
+  // "still loading" state with a Try Again instead of rendering an empty page.
+  if (attributesData?.warming) {
+    return (
+      <ContentLayout title={pageTitle}>
+        <ComplianceWarming />
+      </ContentLayout>
+    );
+  }
+
   if (selectedScanResponse?.data) {
     const scan = selectedScanResponse.data;
     const providerId = scan.relationships?.provider?.data?.id;
diff --git a/ui/app/(prowler)/compliance/page.tsx b/ui/app/(prowler)/compliance/page.tsx
index a67509bed1..d4ee609a0c 100644
--- a/ui/app/(prowler)/compliance/page.tsx
+++ b/ui/app/(prowler)/compliance/page.tsx
@@ -46,16 +46,26 @@ export default async function Compliance({
   });
 
   if (!scansData?.data) {
-    return <NoScansAvailable />;
+    return (
+      <ContentLayout
+        title="Compliance"
+        icon="lucide:shield-check"
+        onboardingAction={{
+          flowId: "view-compliance",
+          fallbackFlowId: "view-first-scan",
+          useFallback: true,
+        }}
+      >
+        <NoScansAvailable />
+      </ContentLayout>
+    );
   }
 
-  // Process scans with provider information from included data
   const expandedScansData: ExpandedScanData[] = scansData.data
     .filter((scan: ScanProps) => scan.relationships?.provider?.data?.id)
     .map((scan: ScanProps) => {
       const providerId = scan.relationships!.provider!.data!.id;
 
-      // Find the provider data in the included array
       const providerData = scansData.included?.find(
         (item: { type: string; id: string }) =>
           item.type === "providers" && item.id === providerId,
@@ -76,15 +86,20 @@ export default async function Compliance({
     })
     .filter(Boolean) as ExpandedScanData[];
 
-  // Use scanId from URL, or select the first scan if not provided
   const scanIdParam = resolvedSearchParams.scanId;
   const scanIdFromUrl = Array.isArray(scanIdParam)
     ? scanIdParam[0]
     : scanIdParam;
   const selectedScanId: string | null =
     scanIdFromUrl || expandedScansData[0]?.id || null;
+  const onboardingAction = selectedScanId
+    ? { flowId: "view-compliance" }
+    : {
+        flowId: "view-compliance",
+        fallbackFlowId: "view-first-scan",
+        useFallback: true,
+      };
 
-  // Find the selected scan
   const selectedScan = expandedScansData.find(
     (scan) => scan.id === selectedScanId,
   );
@@ -100,7 +115,6 @@ export default async function Compliance({
       }
     : undefined;
 
-  // Fetch metadata if we have a selected scan
   const metadataInfoData = selectedScanId
     ? await getComplianceOverviewMetadataInfo({
         filters: {
@@ -111,7 +125,6 @@ export default async function Compliance({
 
   const uniqueRegions = metadataInfoData?.data?.attributes?.regions || [];
 
-  // Fetch ThreatScore data from API if we have a selected scan
   let threatScoreData = null;
   if (selectedScanId && typeof selectedScanId === "string") {
     const threatScoreResponse = await getThreatScore({
@@ -128,10 +141,13 @@ export default async function Compliance({
   }
 
   return (
-    <ContentLayout title="Compliance" icon="lucide:shield-check">
+    <ContentLayout
+      title="Compliance"
+      icon="lucide:shield-check"
+      onboardingAction={onboardingAction}
+    >
       {selectedScanId ? (
         <>
-          {/* Row 1: Filters */}
           <div className="mb-6">
             <ComplianceFilters
               scans={expandedScansData}
@@ -140,7 +156,6 @@ export default async function Compliance({
             />
           </div>
 
-          {/* Row 2: ThreatScore card — full width, horizontal */}
           {threatScoreData &&
             typeof selectedScanId === "string" &&
             selectedScan && (
@@ -155,7 +170,6 @@ export default async function Compliance({
               </div>
             )}
 
-          {/* Row 3: Compliance grid with client-side search */}
           <Suspense
             key={searchParamsKey}
             fallback={
@@ -189,7 +203,6 @@ const SSRComplianceGrid = async ({
 }) => {
   const regionFilter = searchParams["filter[region__in]"]?.toString() || "";
 
-  // Only fetch compliance data if we have a valid scanId
   const compliancesData =
     scanId && scanId.trim() !== ""
       ? await getCompliancesOverview({
@@ -207,7 +220,6 @@ const SSRComplianceGrid = async ({
       a.attributes.framework.localeCompare(b.attributes.framework),
     );
 
-  // Check if the response contains no data
   if (
     !compliancesData ||
     !compliancesData.data ||
@@ -225,7 +237,6 @@ const SSRComplianceGrid = async ({
     );
   }
 
-  // Handle errors returned by the API
   if (compliancesData?.errors?.length > 0) {
     return (
       <Alert variant="info">
@@ -235,10 +246,7 @@ const SSRComplianceGrid = async ({
     );
   }
 
-  // Compute the set of latest CIS variants per provider once, so each card
-  // can gate its PDF button without re-parsing on every render. The backend
-  // only generates a CIS PDF for the latest version per provider, so any
-  // other CIS card must not expose the PDF download button.
+  // Backend only generates CIS PDFs for the latest version per provider.
   const latestCisIds = pickLatestCisPerProvider(
     compliancesData.data.map(
       (compliance: ComplianceOverviewData) => compliance.id,
diff --git a/ui/app/(prowler)/findings/page.tsx b/ui/app/(prowler)/findings/page.tsx
index 7ff9780292..65e8eca9cd 100644
--- a/ui/app/(prowler)/findings/page.tsx
+++ b/ui/app/(prowler)/findings/page.tsx
@@ -59,7 +59,6 @@ export default async function Findings({
     filters: resolvedFilters,
   });
 
-  // Extract unique regions, services, categories, groups from the new endpoint
   const uniqueRegions = metadataInfoData?.data?.attributes?.regions || [];
   const uniqueServices = metadataInfoData?.data?.attributes?.services || [];
   const uniqueResourceTypes =
@@ -67,7 +66,6 @@ export default async function Findings({
   const uniqueCategories = metadataInfoData?.data?.attributes?.categories || [];
   const uniqueGroups = metadataInfoData?.data?.attributes?.groups || [];
 
-  // Extract scan UUIDs with "completed" state and more than one resource
   const completedScans = scansData?.data?.filter(
     (scan: ScanProps) =>
       scan.attributes.state === "completed" &&
@@ -76,6 +74,14 @@ export default async function Findings({
 
   const completedScanIds =
     completedScans?.map((scan: ScanProps) => scan.id) || [];
+  const onboardingAction =
+    completedScanIds.length > 0
+      ? { flowId: "explore-findings" }
+      : {
+          flowId: "explore-findings",
+          fallbackFlowId: "view-first-scan",
+          useFallback: true,
+        };
 
   const scanDetails = createScanDetailsMapping(
     completedScans || [],
@@ -84,7 +90,11 @@ export default async function Findings({
   const alertsEnabled = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
 
   return (
-    <ContentLayout title="Findings" icon="lucide:tag">
+    <ContentLayout
+      title="Findings"
+      icon="lucide:tag"
+      onboardingAction={onboardingAction}
+    >
       <FilterTransitionWrapper>
         <div className="mb-6">
           <FindingsFilters
@@ -146,9 +156,8 @@ const SSRDataTable = async ({
     pageSize,
   });
 
-  // Transform API response to FindingGroupRow[]
   const groups = adaptFindingGroupsResponse(findingGroupsData);
-  // Key resets all client state (selection, drill-down) when data changes
+  // Key resets client state (selection, drill-down) when data changes.
   const groupKey = groups.map((g) => g.id).join(",");
 
   return (
diff --git a/ui/app/(prowler)/layout.tsx b/ui/app/(prowler)/layout.tsx
index 958dfc80d6..2554ab02b9 100644
--- a/ui/app/(prowler)/layout.tsx
+++ b/ui/app/(prowler)/layout.tsx
@@ -2,16 +2,25 @@ import "@/styles/globals.css";
 
 import * as Sentry from "@sentry/nextjs";
 import { Metadata, Viewport } from "next";
-import { ReactNode } from "react";
+import { ReactNode, Suspense } from "react";
 
 import { getProviders } from "@/actions/providers";
+import { getScansByState } from "@/actions/scans/scans";
+import {
+  OnboardingCheckpointWatcher,
+  OnboardingGate,
+  OnboardingSequenceBanner,
+} from "@/components/onboarding";
+import { RuntimePublicConfig } from "@/components/runtime-config/runtime-public-config";
 import MainLayout from "@/components/ui/main-layout/main-layout";
 import { NavigationProgress } from "@/components/ui/navigation-progress";
 import { Toaster } from "@/components/ui/toast";
 import { fontSans } from "@/config/fonts";
 import { siteConfig } from "@/config/site";
+import { isCloud } from "@/lib/shared/env";
 import { cn } from "@/lib/utils";
 import { StoreInitializer } from "@/store/ui/store-initializer";
+import { SCAN_STATES } from "@/types/attack-paths";
 
 import { Providers } from "../providers";
 
@@ -41,12 +50,36 @@ export default async function RootLayout({
 }: {
   children: ReactNode;
 }) {
-  const providersData = await getProviders({ page: 1, pageSize: 1 });
-  const hasProviders = !!(providersData?.data && providersData.data.length > 0);
+  // Onboarding is Cloud-only; skip its fetches and orchestrators in OSS.
+  const onboardingEnabled = isCloud();
+
+  // Fail-open: unknown scan state is treated as "has data" so the banner never blocks
+  // progression on a fetch error.
+  let hasCompletedScan = true;
+  // Tri-state: true = has providers, false = zero providers, undefined = fetch failed (gate fails open).
+  let hasProviders: boolean | undefined = false;
+
+  if (onboardingEnabled) {
+    const [providersData, scansByState] = await Promise.all([
+      getProviders({ page: 1, pageSize: 1 }),
+      getScansByState(),
+    ]);
+    hasCompletedScan = Array.isArray(scansByState?.data)
+      ? scansByState.data.some(
+          (scan: { attributes?: { state?: string } }) =>
+            scan.attributes?.state === SCAN_STATES.COMPLETED,
+        )
+      : true;
+    hasProviders = Array.isArray(providersData?.data)
+      ? providersData.data.length > 0
+      : undefined;
+  }
 
   return (
     <html suppressHydrationWarning lang="en">
-      <head />
+      <head>
+        <RuntimePublicConfig />
+      </head>
       <body
         suppressHydrationWarning
         className={cn(
@@ -55,8 +88,22 @@ export default async function RootLayout({
         )}
       >
         <Providers themeProps={{ attribute: "class", defaultTheme: "dark" }}>
-          <NavigationProgress />
-          <StoreInitializer values={{ hasProviders }} />
+          {/* Suspense contains the useSearchParams() CSR bailout so statically
+              prerendered pages don't fail the build (matches the auth layout). */}
+          <Suspense>
+            <NavigationProgress />
+          </Suspense>
+          {/* Store uses boolean; gate receives tri-state to fail open on fetch errors. */}
+          <StoreInitializer values={{ hasProviders: hasProviders ?? false }} />
+          {onboardingEnabled && (
+            <>
+              <OnboardingGate hasProviders={hasProviders} />
+              {/* Single mount point so the watcher survives post-connect navigation. */}
+              <OnboardingCheckpointWatcher />
+              {/* Persistent banner shown only while a guided sequence is active. */}
+              <OnboardingSequenceBanner hasCompletedScan={hasCompletedScan} />
+            </>
+          )}
           <MainLayout>{children}</MainLayout>
           <Toaster />
         </Providers>
diff --git a/ui/app/(prowler)/providers/page.tsx b/ui/app/(prowler)/providers/page.tsx
index 0ec08e5e11..e6186df10a 100644
--- a/ui/app/(prowler)/providers/page.tsx
+++ b/ui/app/(prowler)/providers/page.tsx
@@ -22,12 +22,22 @@ export default async function Providers({
   const activeTab = getProviderTab(resolvedSearchParams.tab);
   const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
 
-  // Exclude `tab` from the Suspense key so switching tabs doesn't re-suspend
-  const { tab: _, ...paramsWithoutTab } = resolvedSearchParams || {};
-  const searchParamsKey = JSON.stringify(paramsWithoutTab);
+  // Exclude `tab` and `onboarding` from the key: tab switches must not re-suspend,
+  // and `onboarding` is ephemeral (stripped via history.replaceState) — keeping it
+  // would remount ProvidersAccountsView and reset the wizard mid-flow.
+  const {
+    tab: _tab,
+    onboarding: _onboarding,
+    ...stableParams
+  } = resolvedSearchParams || {};
+  const searchParamsKey = JSON.stringify(stableParams);
 
   return (
-    <ContentLayout title="Providers" icon="lucide:cloud-cog">
+    <ContentLayout
+      title="Providers"
+      icon="lucide:cloud-cog"
+      onboardingAction={{ flowId: "add-provider" }}
+    >
       {isCloudEnvironment && <CliImportBanner className="mb-6" />}
       <FilterTransitionWrapper>
         <ProviderPageTabs
@@ -58,15 +68,10 @@ const ProvidersTableFallback = () => {
   return (
     <div className="flex flex-col gap-6">
       <div className="flex flex-wrap items-center gap-4">
-        {/* ProviderTypeSelector */}
         <Skeleton className="h-[52px] min-w-[200px] flex-1 rounded-lg md:max-w-[280px]" />
-        {/* Organizations filter */}
         <Skeleton className="h-[52px] max-w-[240px] min-w-[180px] flex-1 rounded-lg" />
-        {/* Provider Groups filter */}
         <Skeleton className="h-[52px] max-w-[240px] min-w-[180px] flex-1 rounded-lg" />
-        {/* Status filter */}
         <Skeleton className="h-[52px] max-w-[240px] min-w-[180px] flex-1 rounded-lg" />
-        {/* Action buttons */}
         <div className="ml-auto flex flex-wrap gap-4">
           <Skeleton className="h-9 w-[160px] rounded-md" />
           <Skeleton className="h-9 w-[120px] rounded-md" />
diff --git a/ui/app/(prowler)/providers/providers-page.utils.test.ts b/ui/app/(prowler)/providers/providers-page.utils.test.ts
index 335b672af2..b5dcd6d844 100644
--- a/ui/app/(prowler)/providers/providers-page.utils.test.ts
+++ b/ui/app/(prowler)/providers/providers-page.utils.test.ts
@@ -14,16 +14,26 @@ const scansActionsMock = vi.hoisted(() => ({
   getScans: vi.fn(),
 }));
 
+const schedulesActionsMock = vi.hoisted(() => ({
+  getSchedules: vi.fn(),
+}));
+
 vi.mock("@/actions/providers", () => providersActionsMock);
 vi.mock(
   "@/actions/organizations/organizations",
   () => organizationsActionsMock,
 );
 vi.mock("@/actions/scans", () => scansActionsMock);
+vi.mock("@/actions/schedules", () => schedulesActionsMock);
 
 import { SearchParamsProps } from "@/types";
 import { ProvidersApiResponse } from "@/types/providers";
 import { ProvidersProviderRow } from "@/types/providers-table";
+import {
+  SCHEDULE_FREQUENCY,
+  type ScheduleAttributes,
+  type ScheduleProps,
+} from "@/types/schedules";
 
 import {
   buildProvidersTableRows,
@@ -156,6 +166,33 @@ const toProviderRow = (
   },
 });
 
+const buildSchedule = (
+  providerId: string,
+  overrides: Partial<ScheduleAttributes> = {},
+): ScheduleProps => ({
+  type: "schedules",
+  id: providerId,
+  attributes: {
+    scan_enabled: true,
+    scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+    scan_hour: 9,
+    scan_timezone: "Europe/Madrid",
+    scan_interval_hours: null,
+    scan_day_of_week: null,
+    scan_day_of_month: null,
+    ...overrides,
+  },
+  relationships: {
+    provider: { data: { type: "providers", id: providerId } },
+  },
+});
+
+const findProviderRow = (
+  rows: { id: string }[],
+  providerId: string,
+): ProvidersProviderRow | undefined =>
+  rows.find((row) => row.id === providerId) as ProvidersProviderRow | undefined;
+
 describe("buildProvidersTableRows", () => {
   it("returns a flat providers table for OSS", () => {
     // Given
@@ -751,4 +788,98 @@ describe("loadProvidersAccountsViewData", () => {
       viewData.rows.every((row) => row.rowType === PROVIDERS_ROW_TYPE.PROVIDER),
     ).toBe(true);
   });
+
+  it("surfaces the real cadence (not a hardcoded label) from a configured schedule with no materialized scan yet", async () => {
+    // Given — provider-1 has a WEEKLY schedule but the backend has not yet
+    // created a Scan row (the gap between configuring and the first fire).
+    providersActionsMock.getProviders.mockResolvedValue(providersResponse);
+    providersActionsMock.getAllProviders.mockResolvedValue(providersResponse);
+    scansActionsMock.getScans.mockResolvedValue({ data: [] });
+    schedulesActionsMock.getSchedules.mockResolvedValue({
+      data: [
+        buildSchedule("provider-1", {
+          scan_frequency: SCHEDULE_FREQUENCY.WEEKLY,
+          scan_hour: 9,
+          scan_day_of_week: 1,
+        }),
+      ],
+    });
+
+    // When
+    const viewData = await loadProvidersAccountsViewData({
+      searchParams: {} satisfies SearchParamsProps,
+      isCloud: false,
+    });
+
+    // Then — the row carries the Weekly cadence, not "Daily".
+    const providerRow = findProviderRow(viewData.rows, "provider-1");
+    expect(providerRow?.hasSchedule).toBe(true);
+    expect(providerRow?.scheduleSummary?.cadence).toBe("Weekly on Monday");
+    expect(findProviderRow(viewData.rows, "provider-2")?.hasSchedule).toBe(
+      false,
+    );
+    expect(
+      findProviderRow(viewData.rows, "provider-2")?.scheduleSummary,
+    ).toBeUndefined();
+  });
+
+  it("ignores paused or unconfigured schedules", async () => {
+    // Given — provider-1 paused (disabled), provider-2 never configured.
+    providersActionsMock.getProviders.mockResolvedValue(providersResponse);
+    providersActionsMock.getAllProviders.mockResolvedValue(providersResponse);
+    scansActionsMock.getScans.mockResolvedValue({ data: [] });
+    schedulesActionsMock.getSchedules.mockResolvedValue({
+      data: [
+        buildSchedule("provider-1", { scan_enabled: false, scan_hour: 9 }),
+        buildSchedule("provider-2", { scan_enabled: true, scan_hour: null }),
+      ],
+    });
+
+    // When
+    const viewData = await loadProvidersAccountsViewData({
+      searchParams: {} satisfies SearchParamsProps,
+      isCloud: false,
+    });
+
+    // Then
+    expect(findProviderRow(viewData.rows, "provider-1")?.hasSchedule).toBe(
+      false,
+    );
+    expect(findProviderRow(viewData.rows, "provider-2")?.hasSchedule).toBe(
+      false,
+    );
+  });
+
+  it("falls back to scan-based detection when /schedules is unavailable (OSS)", async () => {
+    // Given — /schedules errors, but provider-1 has a materialized scheduled scan.
+    providersActionsMock.getProviders.mockResolvedValue(providersResponse);
+    providersActionsMock.getAllProviders.mockResolvedValue(providersResponse);
+    scansActionsMock.getScans.mockResolvedValue({
+      data: [
+        {
+          type: "scans",
+          id: "scan-1",
+          attributes: { trigger: "scheduled", state: "scheduled" },
+          relationships: {
+            provider: { data: { type: "providers", id: "provider-1" } },
+          },
+        },
+      ],
+    });
+    schedulesActionsMock.getSchedules.mockResolvedValue({ error: "Not found" });
+
+    // When
+    const viewData = await loadProvidersAccountsViewData({
+      searchParams: {} satisfies SearchParamsProps,
+      isCloud: false,
+    });
+
+    // Then — scan-based path still flags the provider; no throw from the error.
+    expect(findProviderRow(viewData.rows, "provider-1")?.hasSchedule).toBe(
+      true,
+    );
+    expect(findProviderRow(viewData.rows, "provider-2")?.hasSchedule).toBe(
+      false,
+    );
+  });
 });
diff --git a/ui/app/(prowler)/providers/providers-page.utils.ts b/ui/app/(prowler)/providers/providers-page.utils.ts
index db79452709..a37d6eb510 100644
--- a/ui/app/(prowler)/providers/providers-page.utils.ts
+++ b/ui/app/(prowler)/providers/providers-page.utils.ts
@@ -4,10 +4,16 @@ import {
 } from "@/actions/organizations/organizations";
 import { getAllProviders, getProviders } from "@/actions/providers";
 import { getScans } from "@/actions/scans";
+import { getSchedules } from "@/actions/schedules";
 import {
   extractFiltersAndQuery,
   extractSortAndKey,
 } from "@/lib/helper-filters";
+import {
+  buildProviderScheduleSummary,
+  buildSchedulesByProviderId,
+  isScheduleConfigured,
+} from "@/lib/schedules";
 import {
   FilterEntity,
   FilterOption,
@@ -27,7 +33,8 @@ import {
   ProvidersTableRow,
   ProvidersTableRowsInput,
 } from "@/types/providers-table";
-import { SCAN_TRIGGER, ScanProps } from "@/types/scans";
+import { SCAN_TRIGGER, ScanProps, ScanScheduleSummary } from "@/types/scans";
+import { ScheduleAttributes } from "@/types/schedules";
 
 const PROVIDERS_STATUS_MAPPING = [
   {
@@ -127,22 +134,46 @@ const buildScheduledProviderIds = (scans: ScanProps[]): Set<string> => {
   return scheduled;
 };
 
+// A schedule is backed by the Provider row itself, so its `/schedules` entry
+// exists before the first scheduled Scan is materialized — only enabled,
+// configured ones carry a displayable cadence summary.
+const buildProviderScheduleSummaryFor = (
+  attributes: ScheduleAttributes | undefined,
+  now: Date,
+): ScanScheduleSummary | undefined =>
+  attributes && attributes.scan_enabled && isScheduleConfigured(attributes)
+    ? buildProviderScheduleSummary(attributes, now)
+    : undefined;
+
 const enrichProviders = (
-  providersResponse?: ProvidersApiResponse,
-  scheduledProviderIds?: Set<string>,
+  providersResponse: ProvidersApiResponse | undefined,
+  scanScheduledProviderIds: Set<string>,
+  schedulesByProviderId: Record<string, ScheduleAttributes>,
 ): ProvidersProviderRow[] => {
   const providerGroupLookup = createProviderGroupLookup(providersResponse);
+  const now = new Date();
 
-  return (providersResponse?.data ?? []).map((provider) => ({
-    ...provider,
-    rowType: PROVIDERS_ROW_TYPE.PROVIDER,
-    groupNames:
-      provider.relationships.provider_groups.data.map(
-        (providerGroup: { id: string }) =>
-          providerGroupLookup.get(providerGroup.id) ?? "Unknown Group",
-      ) ?? [],
-    hasSchedule: scheduledProviderIds?.has(provider.id) ?? false,
-  }));
+  return (providersResponse?.data ?? []).map((provider) => {
+    const scheduleSummary = buildProviderScheduleSummaryFor(
+      schedulesByProviderId[provider.id],
+      now,
+    );
+
+    return {
+      ...provider,
+      rowType: PROVIDERS_ROW_TYPE.PROVIDER,
+      groupNames:
+        provider.relationships.provider_groups.data.map(
+          (providerGroup: { id: string }) =>
+            providerGroupLookup.get(providerGroup.id) ?? "Unknown Group",
+        ) ?? [],
+      // A fired scheduled scan OR a configured schedule that hasn't fired yet.
+      hasSchedule:
+        scanScheduledProviderIds.has(provider.id) ||
+        scheduleSummary !== undefined,
+      scheduleSummary,
+    };
+  });
 };
 
 const createOrganizationRow = ({
@@ -453,6 +484,7 @@ export async function loadProvidersAccountsViewData({
     providersResponse,
     allProvidersResponse,
     scansResponse,
+    schedulesResponse,
     organizationsResponse,
     organizationUnitsResponse,
   ] = await Promise.all([
@@ -468,7 +500,7 @@ export async function loadProvidersAccountsViewData({
     // Unfiltered fetch for ProviderTypeSelector — only needs distinct types;
     // TODO: Replace with a dedicated lightweight endpoint when available.
     resolveActionResult(getAllProviders()),
-    // Fetch active scheduled scans to determine daily schedule per provider
+    // Fetch active scheduled scans to flag providers whose schedule has fired.
     resolveActionResult(
       getScans({
         pageSize: 500,
@@ -478,6 +510,9 @@ export async function loadProvidersAccountsViewData({
         },
       }),
     ),
+    // Fetch configured schedules to also flag providers whose schedule has not
+    // fired yet (best-effort: absent in OSS, where the helper yields no ids).
+    resolveActionResult(getSchedules()),
     isCloud
       ? listOrganizationsSafe()
       : Promise.resolve(emptyOrganizationsResponse),
@@ -486,13 +521,18 @@ export async function loadProvidersAccountsViewData({
       : Promise.resolve(emptyOrganizationUnitsResponse),
   ]);
 
-  const scheduledProviderIds = buildScheduledProviderIds(
+  const scanScheduledProviderIds = buildScheduledProviderIds(
     scansResponse?.data ?? [],
   );
+  const schedulesByProviderId = buildSchedulesByProviderId(schedulesResponse);
 
   const orgs = organizationsResponse?.data ?? [];
   const ous = organizationUnitsResponse?.data ?? [];
-  const providers = enrichProviders(providersResponse, scheduledProviderIds);
+  const providers = enrichProviders(
+    providersResponse,
+    scanScheduledProviderIds,
+    schedulesByProviderId,
+  );
 
   const rows = buildProvidersTableRows({
     isCloud,
diff --git a/ui/app/(prowler)/scans/page.test.ts b/ui/app/(prowler)/scans/page.test.ts
new file mode 100644
index 0000000000..3ea7bcfa7c
--- /dev/null
+++ b/ui/app/(prowler)/scans/page.test.ts
@@ -0,0 +1,23 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+describe("scans page onboarding", () => {
+  const currentDir = path.dirname(fileURLToPath(import.meta.url));
+  const pagePath = path.join(currentDir, "page.tsx");
+  const source = readFileSync(pagePath, "utf8");
+
+  it("redirects the scan tour replay to add-provider when providers are missing or disconnected", () => {
+    expect(source).toContain('redirect("/providers?onboarding=add-provider")');
+    expect(source).toContain(
+      'resolvedSearchParams.onboarding === "view-first-scan"',
+    );
+  });
+
+  it("passes the scan onboarding action to the page header when the tour can run", () => {
+    expect(source).toContain('flowId: "view-first-scan"');
+    expect(source).toContain("onboardingAction={onboardingAction}");
+  });
+});
diff --git a/ui/app/(prowler)/scans/page.tsx b/ui/app/(prowler)/scans/page.tsx
index 94f4ae0880..876dfa592e 100644
--- a/ui/app/(prowler)/scans/page.tsx
+++ b/ui/app/(prowler)/scans/page.tsx
@@ -1,11 +1,16 @@
+import { redirect } from "next/navigation";
 import { Suspense } from "react";
 
 import { getAllProviders } from "@/actions/providers";
 import { getScans } from "@/actions/scans";
+import { getSchedules } from "@/actions/schedules";
 import { auth } from "@/auth.config";
+import { PageReady } from "@/components/onboarding";
 import { ScansPageShell } from "@/components/scans/scans-page-shell";
 import { ScansProvidersEmptyState } from "@/components/scans/scans-providers-empty-state";
 import {
+  appendPendingScheduleRowsToPage,
+  getProviderIdsFromScans,
   getScanJobsTab,
   getScanJobsTabFilters,
   getScanJobsUserFilters,
@@ -13,14 +18,43 @@ import {
 import { SkeletonTableScans } from "@/components/scans/table";
 import { ScanJobsTable } from "@/components/scans/table/scan-jobs-table";
 import { ContentLayout } from "@/components/ui";
+import {
+  buildProviderScheduleSummary,
+  buildSchedulesByProviderId,
+  isScheduleConfigured,
+} from "@/lib/schedules";
 import {
   ProviderProps,
   SCAN_JOBS_TAB,
+  SCAN_TRIGGER,
   ScanProps,
   SearchParamsProps,
 } from "@/types";
 
 const ACTIVE_SCAN_COUNT_PAGE_SIZE = 1;
+// Pending schedule rows are derived from provider schedules, but must honor the
+// same provider filters as real scan rows. Keep these filter keys typed locally
+// without narrowing the global SearchParamsProps shape used by Next pages.
+const PENDING_ROW_PROVIDER_FILTER = {
+  PROVIDER_UID_IN: "provider_uid__in",
+  PROVIDER_UID: "provider_uid",
+  PROVIDER_TYPE_IN: "provider_type__in",
+  PROVIDER_TYPE: "provider_type",
+} as const;
+
+type PendingRowProviderFilter =
+  (typeof PENDING_ROW_PROVIDER_FILTER)[keyof typeof PENDING_ROW_PROVIDER_FILTER];
+type PendingRowProviderFilterParam = `filter[${PendingRowProviderFilter}]`;
+
+const PROVIDER_UID_FILTER_KEYS = [
+  `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_UID_IN}]`,
+  `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_UID}]`,
+] as const satisfies ReadonlyArray<PendingRowProviderFilterParam>;
+
+const PROVIDER_TYPE_FILTER_KEYS = [
+  `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_TYPE_IN}]`,
+  `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_TYPE}]`,
+] as const satisfies ReadonlyArray<PendingRowProviderFilterParam>;
 
 const getFilterSearchQuery = (
   filters: Record<string, string | string[]>,
@@ -31,6 +65,47 @@ const getFilterSearchQuery = (
   return value ?? "";
 };
 
+const parseCsvParam = (value?: string | string[]): string[] => {
+  const rawValue = Array.isArray(value) ? value.join(",") : value;
+  if (!rawValue) return [];
+
+  return rawValue
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+};
+
+const getFirstSearchParam = (
+  searchParams: SearchParamsProps,
+  keys: ReadonlyArray<PendingRowProviderFilterParam>,
+): string | string[] | undefined => {
+  for (const key of keys) {
+    const value = searchParams[key];
+    if (value !== undefined) return value;
+  }
+
+  return undefined;
+};
+
+/** Applies the table's provider filters to synthetic pending-schedule rows. */
+const filterProvidersForPendingRows = (
+  providers: ProviderProps[],
+  searchParams: SearchParamsProps,
+): ProviderProps[] => {
+  const uids = parseCsvParam(
+    getFirstSearchParam(searchParams, PROVIDER_UID_FILTER_KEYS),
+  );
+  const types = parseCsvParam(
+    getFirstSearchParam(searchParams, PROVIDER_TYPE_FILTER_KEYS),
+  );
+
+  return providers.filter(
+    (provider) =>
+      (uids.length === 0 || uids.includes(provider.attributes.uid)) &&
+      (types.length === 0 || types.includes(provider.attributes.provider)),
+  );
+};
+
 const getActiveScanCount = async (
   searchParams: SearchParamsProps,
 ): Promise<number> => {
@@ -51,6 +126,40 @@ const getActiveScanCount = async (
   return scansData && "meta" in scansData ? scansData.meta.pagination.count : 0;
 };
 
+/**
+ * A provider can already have a real scheduled scan on a different page.
+ * Current-page rows are not enough to decide whether a schedule needs a
+ * synthetic Pending row, so fetch all scheduled scan provider ids when the
+ * backend paginated result is larger than the current slice.
+ */
+const getCoveredScheduledProviderIds = async ({
+  currentScans,
+  realScanCount,
+  query,
+  filters,
+}: {
+  currentScans: ScanProps[];
+  realScanCount: number;
+  query: string;
+  filters: Record<string, string | string[]>;
+}): Promise<Set<string>> => {
+  if (realScanCount === 0 || currentScans.length === realScanCount) {
+    return getProviderIdsFromScans(currentScans);
+  }
+
+  const allScheduledScansData = await getScans({
+    query,
+    page: 1,
+    pageSize: realScanCount,
+    filters,
+    include: "provider",
+  });
+
+  return getProviderIdsFromScans(
+    (allScheduledScansData?.data ?? []) as ScanProps[],
+  );
+};
+
 export default async function Scans({
   searchParams,
 }: {
@@ -69,19 +178,45 @@ export default async function Scans({
   const thereIsNoProviders = providers.length === 0;
   const thereIsNoProvidersConnected =
     !thereIsNoProviders && connectedProviders.length === 0;
+  const missingScanPrerequisite =
+    thereIsNoProviders || thereIsNoProvidersConnected;
+
+  if (
+    missingScanPrerequisite &&
+    resolvedSearchParams.onboarding === "view-first-scan"
+  ) {
+    redirect("/providers?onboarding=add-provider");
+  }
 
   const hasManageScansPermission = Boolean(
     session?.user?.permissions?.manage_scans,
   );
-  const activeScanCount =
-    thereIsNoProviders || thereIsNoProvidersConnected
-      ? 0
-      : await getActiveScanCount(resolvedSearchParams);
+  const activeScanCount = missingScanPrerequisite
+    ? 0
+    : await getActiveScanCount(resolvedSearchParams);
+  const onboardingAction = missingScanPrerequisite
+    ? {
+        flowId: "view-first-scan",
+        fallbackFlowId: "add-provider",
+        useFallback: true,
+      }
+    : { flowId: "view-first-scan" };
 
   return (
-    <ContentLayout title="Scan Jobs" icon="lucide:timer">
-      {thereIsNoProviders || thereIsNoProvidersConnected ? (
-        <ScansProvidersEmptyState thereIsNoProviders={thereIsNoProviders} />
+    <ContentLayout
+      title="Scan Jobs"
+      icon="lucide:timer"
+      onboardingAction={onboardingAction}
+    >
+      {missingScanPrerequisite ? (
+        <>
+          {/* The populated branch mounts <PageReady/> inside ScansPageShell to
+              enable the navbar tour icon. The empty branch must mark the route
+              ready too, otherwise the icon (which falls back to the add-provider
+              flow here) stays hidden for users with no connected provider. */}
+          <PageReady />
+          <ScansProvidersEmptyState thereIsNoProviders={thereIsNoProviders} />
+        </>
       ) : (
         <ScansPageShell
           providers={providers}
@@ -95,7 +230,10 @@ export default async function Scans({
               />
             }
           >
-            <SSRDataTableScans searchParams={resolvedSearchParams} />
+            <SSRDataTableScans
+              searchParams={resolvedSearchParams}
+              providers={providers}
+            />
           </Suspense>
         </ScansPageShell>
       )}
@@ -105,8 +243,10 @@ export default async function Scans({
 
 const SSRDataTableScans = async ({
   searchParams,
+  providers,
 }: {
   searchParams: SearchParamsProps;
+  providers: ProviderProps[];
 }) => {
   const tab = getScanJobsTab(searchParams.tab);
 
@@ -142,7 +282,7 @@ const SSRDataTableScans = async ({
   const included = scansData?.included;
   const meta = scansData && "meta" in scansData ? scansData.meta : undefined;
 
-  const expandedScansData =
+  const expandedScansData: ScanProps[] =
     scans?.map((scan: ScanProps) => {
       const providerId = scan.relationships?.provider?.data?.id;
 
@@ -163,10 +303,60 @@ const SSRDataTableScans = async ({
       };
     }) || [];
 
+  const needsSchedules =
+    tab === SCAN_JOBS_TAB.SCHEDULED ||
+    expandedScansData.some(
+      (scan) => scan.attributes.trigger === SCAN_TRIGGER.SCHEDULED,
+    );
+  const schedulesResult = needsSchedules ? await getSchedules() : null;
+
+  // Schedules are keyed by provider id so real scheduled scan rows can display
+  // cadence/next-run info, and schedule-only providers can become Pending rows.
+  const schedulesByProviderId = buildSchedulesByProviderId(schedulesResult);
+
+  const scansWithSchedule = expandedScansData.map((scan) => {
+    if (scan.attributes.trigger !== SCAN_TRIGGER.SCHEDULED) return scan;
+
+    const providerId = scan.relationships?.provider?.data?.id;
+    const schedule = providerId ? schedulesByProviderId[providerId] : undefined;
+    if (!schedule || !isScheduleConfigured(schedule)) return scan;
+
+    return {
+      ...scan,
+      providerSchedule: buildProviderScheduleSummary(schedule, new Date()),
+    };
+  });
+
+  let tableData = scansWithSchedule;
+  let tableMeta = meta;
+  if (tab === SCAN_JOBS_TAB.SCHEDULED) {
+    // The backend paginates real scans only. Pending schedule rows are generated
+    // client-side, so reconcile both sources before passing data/meta to the table.
+    const coveredProviderIds = await getCoveredScheduledProviderIds({
+      currentScans: scansWithSchedule,
+      realScanCount: meta?.pagination?.count ?? scansWithSchedule.length,
+      query,
+      filters,
+    });
+    const scheduledTable = appendPendingScheduleRowsToPage({
+      scans: scansWithSchedule,
+      meta,
+      page,
+      pageSize,
+      providers: filterProvidersForPendingRows(providers, searchParams),
+      schedulesByProviderId,
+      coveredProviderIds,
+      now: new Date(),
+    });
+
+    tableData = scheduledTable.data;
+    tableMeta = scheduledTable.meta;
+  }
+
   return (
     <ScanJobsTable
-      data={expandedScansData}
-      meta={meta}
+      data={tableData}
+      meta={tableMeta}
       tab={tab}
       hasFilters={hasUserFilters}
     />
diff --git a/ui/app/(prowler)/users/page.tsx b/ui/app/(prowler)/users/page.tsx
index 4b26c0baf2..fa1e838872 100644
--- a/ui/app/(prowler)/users/page.tsx
+++ b/ui/app/(prowler)/users/page.tsx
@@ -109,6 +109,9 @@ const SSRDataTable = async ({
       roles,
       canBeExpelled,
       currentTenantId: canBeExpelled ? currentTenantId : undefined,
+      // Users may only delete their own account; gate the delete action so the
+      // UI matches the backend rule and never offers an action that would fail.
+      isCurrentUser: user.id === currentUserId,
     };
   });
 
diff --git a/ui/app/instrumentation.client.ts b/ui/app/instrumentation.client.ts
deleted file mode 100644
index a9abf3f345..0000000000
--- a/ui/app/instrumentation.client.ts
+++ /dev/null
@@ -1,121 +0,0 @@
-"use client";
-
-/**
- * Client-side Sentry instrumentation
- *
- * This file is automatically loaded by Next.js in the browser via the instrumentation hook.
- * It configures Sentry for client-side error tracking and performance monitoring.
- *
- * For server-side configuration, see: instrumentation.ts
- * For runtime-specific configs, see: sentry/sentry.server.config.ts and sentry/sentry.edge.config.ts
- */
-
-import * as Sentry from "@sentry/nextjs";
-
-const SENTRY_DSN = process.env.NEXT_PUBLIC_SENTRY_DSN;
-
-// Only initialize Sentry in the browser (not during SSR)
-if (typeof window !== "undefined" && SENTRY_DSN) {
-  const isDevelopment = process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT === "local";
-
-  /**
-   * Initialize Sentry error tracking and performance monitoring
-   *
-   * This setup includes:
-   * - Performance monitoring with Web Vitals tracking (LCP, FID, CLS, INP)
-   * - Long task detection for UI-blocking operations
-   * - beforeSend hook to filter noise
-   */
-  Sentry.init({
-    // 📍 DSN - Data Source Name (identifies your Sentry project)
-    dsn: SENTRY_DSN,
-
-    // 🌍 Environment - Separate dev errors from production
-    environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT || "local",
-
-    // 📦 Release - Track which version has the error
-    release: process.env.NEXT_PUBLIC_PROWLER_RELEASE_VERSION,
-
-    // 🐛 Debug - Detailed logs in development console
-    debug: isDevelopment,
-
-    // 📊 Sample Rates - Performance monitoring
-    // 100% in dev (test everything), 50% in production (balance visibility with costs)
-    tracesSampleRate: isDevelopment ? 1.0 : 0.5,
-    profilesSampleRate: isDevelopment ? 1.0 : 0.5,
-
-    // 🔌 Integrations - browserTracingIntegration is client-only
-    integrations: [
-      // 📊 Performance Monitoring: Core Web Vitals + RUM
-      // Tracks LCP, FID, CLS, INP
-      // Real User Monitoring captures actual user experience, not synthetic tests
-      Sentry.browserTracingIntegration({
-        enableLongTask: true, // Detect tasks that block UI (>50ms)
-        enableInp: true, // Interaction to Next Paint (Core Web Vital)
-      }),
-    ],
-
-    // 🎣 beforeSend Hook - Filter or modify events before sending to Sentry
-    ignoreErrors: [
-      // Browser extensions
-      "top.GLOBALS",
-      // Random network errors
-      "Network request failed",
-      "NetworkError",
-      "Failed to fetch",
-      // User canceled actions
-      "AbortError",
-      "Non-Error promise rejection captured",
-      // NextAuth expected errors
-      "NEXT_REDIRECT",
-      // ResizeObserver errors (common browser quirk, not real bugs)
-      "ResizeObserver",
-    ],
-
-    beforeSend(event, hint) {
-      // Filter out noise: ResizeObserver errors (common browser quirk, not real bugs)
-      if (event.message?.includes("ResizeObserver")) {
-        return null; // Don't send to Sentry
-      }
-
-      // Filter out non-actionable errors
-      if (event.exception) {
-        const error = hint.originalException;
-
-        // Don't send cancelled requests
-        if (
-          error &&
-          typeof error === "object" &&
-          "name" in error &&
-          error.name === "AbortError"
-        ) {
-          return null;
-        }
-
-        // Add additional context for API errors
-        if (
-          error &&
-          typeof error === "object" &&
-          "message" in error &&
-          typeof error.message === "string" &&
-          error.message.includes("Request failed")
-        ) {
-          event.tags = {
-            ...event.tags,
-            error_type: "api_error",
-          };
-        }
-      }
-
-      return event; // Send to Sentry
-    },
-  });
-
-  // 👤 Set user context (identifies who experienced the error)
-  // In production, this will be updated after authentication
-  if (isDevelopment) {
-    Sentry.setUser({
-      id: "dev-user",
-    });
-  }
-}
diff --git a/ui/app/providers.tsx b/ui/app/providers.tsx
index 7bda5d45fe..41157df06c 100644
--- a/ui/app/providers.tsx
+++ b/ui/app/providers.tsx
@@ -1,8 +1,5 @@
 "use client";
 
-// Import Sentry client-side initialization
-import "@/app/instrumentation.client";
-
 import { HeroUIProvider } from "@heroui/system";
 import { useRouter } from "next/navigation";
 import { SessionProvider } from "next-auth/react";
diff --git a/ui/components/compliance/compliance-card.tsx b/ui/components/compliance/compliance-card.tsx
index 82b96e0d9c..f22a2a403a 100644
--- a/ui/components/compliance/compliance-card.tsx
+++ b/ui/components/compliance/compliance-card.tsx
@@ -10,6 +10,7 @@ import {
   TooltipContent,
   TooltipTrigger,
 } from "@/components/shadcn/tooltip";
+import { buildComplianceDetailPath } from "@/lib/compliance/compliance-detail-url";
 import { getReportTypeForCompliance } from "@/lib/compliance/compliance-report-types";
 import {
   getScoreIndicatorClass,
@@ -70,20 +71,15 @@ export const ComplianceCard: React.FC<ComplianceCardProps> = ({
   };
 
   const navigateToDetail = () => {
-    const formattedTitleForUrl = encodeURIComponent(title);
-    const path = `/compliance/${formattedTitleForUrl}`;
-    const params = new URLSearchParams();
-
-    params.set("complianceId", id);
-    params.set("version", version);
-    params.set("scanId", scanId);
-
-    const regionFilter = searchParams.get("filter[region__in]");
-    if (regionFilter) {
-      params.set("filter[region__in]", regionFilter);
-    }
-
-    router.push(`${path}?${params.toString()}`);
+    router.push(
+      buildComplianceDetailPath({
+        title,
+        complianceId: id,
+        version,
+        scanId,
+        regionFilter: searchParams.get("filter[region__in]"),
+      }),
+    );
   };
 
   return (
diff --git a/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx b/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx
index 363eba2b10..2cb022a174 100644
--- a/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx
@@ -85,7 +85,7 @@ export const ASDEssentialEightCustomDetails = ({
           <ComplianceBadge
             label="Maturity Level"
             value={maturityLevel}
-            color="purple"
+            variant="secondary"
           />
         )}
 
@@ -93,7 +93,7 @@ export const ASDEssentialEightCustomDetails = ({
           <ComplianceBadge
             label="Assessment"
             value={assessmentStatus}
-            color="blue"
+            variant="info"
           />
         )}
 
@@ -101,7 +101,7 @@ export const ASDEssentialEightCustomDetails = ({
           <ComplianceBadge
             label="Cloud Applicability"
             value={cloudApplicability}
-            color="orange"
+            variant="secondary"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx b/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx
index 96ed16a8f1..00aa51e4c5 100644
--- a/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx
@@ -52,7 +52,7 @@ export const AWSWellArchitectedCustomDetails = ({
           <ComplianceBadge
             label="Question ID"
             value={requirement.well_architected_question_id as string}
-            color="indigo"
+            variant="tag"
           />
         )}
 
@@ -60,7 +60,7 @@ export const AWSWellArchitectedCustomDetails = ({
           <ComplianceBadge
             label="Practice ID"
             value={requirement.well_architected_practice_id as string}
-            color="indigo"
+            variant="tag"
           />
         )}
 
@@ -68,7 +68,7 @@ export const AWSWellArchitectedCustomDetails = ({
           <ComplianceBadge
             label="Assessment"
             value={requirement.assessment_method as string}
-            color="blue"
+            variant="info"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/ccc-details.tsx b/ui/components/compliance/compliance-custom-details/ccc-details.tsx
index 309358264d..e3db174280 100644
--- a/ui/components/compliance/compliance-custom-details/ccc-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/ccc-details.tsx
@@ -1,4 +1,4 @@
-import { cn } from "@/lib";
+import { Badge } from "@/components/shadcn/badge/badge";
 import { CCC_MAPPING_SECTIONS, CCC_TEXT_SECTIONS } from "@/lib/compliance/ccc";
 import { Requirement } from "@/types/compliance";
 
@@ -46,7 +46,7 @@ export const CCCCustomDetails = ({ requirement }: CCCDetailsProps) => {
           <ComplianceBadge
             label="Family"
             value={requirement.family_name as string}
-            color="purple"
+            variant="secondary"
           />
         </ComplianceBadgeContainer>
       )}
@@ -68,15 +68,9 @@ export const CCCCustomDetails = ({ requirement }: CCCDetailsProps) => {
                 </span>
                 <div className="flex flex-wrap gap-2">
                   {mapping.Identifiers.map((identifier, idx) => (
-                    <span
-                      key={idx}
-                      className={cn(
-                        "inline-flex items-center rounded-md px-2 py-1 text-xs font-medium ring-1 ring-inset",
-                        section.colorClasses,
-                      )}
-                    >
+                    <Badge key={idx} variant={section.variant}>
                       {identifier}
-                    </span>
+                    </Badge>
                   ))}
                 </div>
               </div>
diff --git a/ui/components/compliance/compliance-custom-details/cis-details.tsx b/ui/components/compliance/compliance-custom-details/cis-details.tsx
index c46f061188..25823038d5 100644
--- a/ui/components/compliance/compliance-custom-details/cis-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/cis-details.tsx
@@ -41,7 +41,7 @@ export const CISCustomDetails = ({ requirement }: CISDetailsProps) => {
           <ComplianceBadge
             label="Profile"
             value={requirement.profile as string}
-            color="purple"
+            variant="secondary"
           />
         )}
 
@@ -49,7 +49,7 @@ export const CISCustomDetails = ({ requirement }: CISDetailsProps) => {
           <ComplianceBadge
             label="Assessment"
             value={requirement.assessment_status as string}
-            color="blue"
+            variant="info"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/csa-details.tsx b/ui/components/compliance/compliance-custom-details/csa-details.tsx
index 738e4a8aab..81dbcc158a 100644
--- a/ui/components/compliance/compliance-custom-details/csa-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/csa-details.tsx
@@ -1,4 +1,4 @@
-import { cn } from "@/lib";
+import { Badge } from "@/components/shadcn/badge/badge";
 import { CSA_MAPPING_SECTIONS } from "@/lib/compliance/csa";
 import { Requirement } from "@/types/compliance";
 
@@ -36,28 +36,28 @@ export const CSACustomDetails = ({ requirement }: CSADetailsProps) => {
           <ComplianceBadge
             label="CCM Lite"
             value={requirement.ccm_lite as string}
-            color={requirement.ccm_lite === "Yes" ? "green" : "gray"}
+            variant={requirement.ccm_lite === "Yes" ? "success" : "secondary"}
           />
         )}
         {requirement.iaas && (
           <ComplianceBadge
             label="IaaS"
             value={requirement.iaas as string}
-            color="blue"
+            variant="info"
           />
         )}
         {requirement.paas && (
           <ComplianceBadge
             label="PaaS"
             value={requirement.paas as string}
-            color="blue"
+            variant="info"
           />
         )}
         {requirement.saas && (
           <ComplianceBadge
             label="SaaS"
             value={requirement.saas as string}
-            color="blue"
+            variant="info"
           />
         )}
       </ComplianceBadgeContainer>
@@ -72,15 +72,9 @@ export const CSACustomDetails = ({ requirement }: CSADetailsProps) => {
                 </span>
                 <div className="flex flex-wrap gap-2">
                   {mapping.Identifiers.map((identifier, idx) => (
-                    <span
-                      key={idx}
-                      className={cn(
-                        "inline-flex items-center rounded-md px-2 py-1 text-xs font-medium ring-1 ring-inset",
-                        section.colorClasses,
-                      )}
-                    >
+                    <Badge key={idx} variant={section.variant}>
                       {identifier}
-                    </span>
+                    </Badge>
                   ))}
                 </div>
               </div>
diff --git a/ui/components/compliance/compliance-custom-details/dora-details.tsx b/ui/components/compliance/compliance-custom-details/dora-details.tsx
new file mode 100644
index 0000000000..f27412be5b
--- /dev/null
+++ b/ui/components/compliance/compliance-custom-details/dora-details.tsx
@@ -0,0 +1,49 @@
+import { Requirement } from "@/types/compliance";
+
+import {
+  ComplianceBadge,
+  ComplianceBadgeContainer,
+  ComplianceDetailContainer,
+  ComplianceDetailSection,
+  ComplianceDetailText,
+} from "./shared-components";
+
+interface DORADetailsProps {
+  requirement: Requirement;
+}
+
+export const DORACustomDetails = ({ requirement }: DORADetailsProps) => {
+  return (
+    <ComplianceDetailContainer>
+      {requirement.description && (
+        <ComplianceDetailSection title="Description">
+          <ComplianceDetailText>{requirement.description}</ComplianceDetailText>
+        </ComplianceDetailSection>
+      )}
+
+      <ComplianceBadgeContainer>
+        {requirement.pillar && (
+          <ComplianceBadge
+            label="Pillar"
+            value={requirement.pillar as string}
+            variant="tag"
+          />
+        )}
+        {requirement.article && (
+          <ComplianceBadge
+            label="Article"
+            value={requirement.article as string}
+            variant="tag"
+          />
+        )}
+        {requirement.article_title && (
+          <ComplianceBadge
+            label="Article Title"
+            value={requirement.article_title as string}
+            variant="tag"
+          />
+        )}
+      </ComplianceBadgeContainer>
+    </ComplianceDetailContainer>
+  );
+};
diff --git a/ui/components/compliance/compliance-custom-details/ens-details.tsx b/ui/components/compliance/compliance-custom-details/ens-details.tsx
index 9e947cea14..2950c495cd 100644
--- a/ui/components/compliance/compliance-custom-details/ens-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/ens-details.tsx
@@ -28,7 +28,7 @@ export const ENSCustomDetails = ({
           <ComplianceBadge
             label="Type"
             value={translateType(requirement.type as string)}
-            color="orange"
+            variant="secondary"
           />
         )}
 
@@ -36,7 +36,7 @@ export const ENSCustomDetails = ({
           <ComplianceBadge
             label="Level"
             value={requirement.nivel as string}
-            color="red"
+            variant="error"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/generic-details.tsx b/ui/components/compliance/compliance-custom-details/generic-details.tsx
index caa3fec05d..323e3d9a99 100644
--- a/ui/components/compliance/compliance-custom-details/generic-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/generic-details.tsx
@@ -26,7 +26,7 @@ export const GenericCustomDetails = ({
           <ComplianceBadge
             label="Item ID"
             value={requirement.item_id as string}
-            color="indigo"
+            variant="tag"
           />
         )}
 
@@ -34,7 +34,7 @@ export const GenericCustomDetails = ({
           <ComplianceBadge
             label="Service"
             value={requirement.service as string}
-            color="blue"
+            variant="info"
           />
         )}
 
@@ -42,7 +42,7 @@ export const GenericCustomDetails = ({
           <ComplianceBadge
             label="Type"
             value={requirement.type as string}
-            color="orange"
+            variant="secondary"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/mitre-details.tsx b/ui/components/compliance/compliance-custom-details/mitre-details.tsx
index 8fa7fa276d..53fc583f2c 100644
--- a/ui/components/compliance/compliance-custom-details/mitre-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/mitre-details.tsx
@@ -37,7 +37,7 @@ export const MITRECustomDetails = ({
           <ComplianceBadge
             label="Technique ID"
             value={requirement.technique_id as string}
-            color="indigo"
+            variant="tag"
           />
         )}
       </ComplianceBadgeContainer>
@@ -81,17 +81,17 @@ export const MITRECustomDetails = ({
                   <ComplianceBadge
                     label="Service"
                     value={service.service}
-                    color="blue"
+                    variant="info"
                   />
                   <ComplianceBadge
                     label="Category"
                     value={service.category}
-                    color="indigo"
+                    variant="tag"
                   />
                   <ComplianceBadge
                     label="Coverage"
                     value={service.value}
-                    color="orange"
+                    variant="secondary"
                   />
                 </div>
                 {service.comment && (
diff --git a/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx b/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx
new file mode 100644
index 0000000000..0869b7f390
--- /dev/null
+++ b/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx
@@ -0,0 +1,65 @@
+import { Severity, SeverityBadge } from "@/components/ui/table";
+import { Requirement } from "@/types/compliance";
+
+import {
+  ComplianceBadge,
+  ComplianceBadgeContainer,
+  ComplianceChipContainer,
+  ComplianceDetailContainer,
+  ComplianceDetailSection,
+  ComplianceDetailText,
+} from "./shared-components";
+
+export const OktaIDaaSStigCustomDetails = ({
+  requirement,
+}: {
+  requirement: Requirement;
+}) => {
+  const severity = requirement.severity as string | undefined;
+  const stigId = requirement.stig_id as string | undefined;
+  const ruleId = requirement.rule_id as string | undefined;
+  const cci = requirement.cci as string[] | undefined;
+  const checkText = requirement.check_text as string | undefined;
+  const fixText = requirement.fix_text as string | undefined;
+
+  return (
+    <ComplianceDetailContainer>
+      <ComplianceBadgeContainer>
+        {severity && (
+          <div className="flex items-center gap-2">
+            <span className="text-muted-foreground text-sm font-medium">
+              Severity:
+            </span>
+            <SeverityBadge severity={severity.toLowerCase() as Severity} />
+          </div>
+        )}
+        {stigId && (
+          <ComplianceBadge label="STIG ID" value={stigId} variant="tag" />
+        )}
+        {ruleId && (
+          <ComplianceBadge label="Rule ID" value={ruleId} variant="tag" />
+        )}
+      </ComplianceBadgeContainer>
+
+      {requirement.description && (
+        <ComplianceDetailSection title="Description">
+          <ComplianceDetailText>{requirement.description}</ComplianceDetailText>
+        </ComplianceDetailSection>
+      )}
+
+      <ComplianceChipContainer title="CCI" items={cci || []} />
+
+      {checkText && (
+        <ComplianceDetailSection title="Check">
+          <ComplianceDetailText>{checkText}</ComplianceDetailText>
+        </ComplianceDetailSection>
+      )}
+
+      {fixText && (
+        <ComplianceDetailSection title="Fix">
+          <ComplianceDetailText>{fixText}</ComplianceDetailText>
+        </ComplianceDetailSection>
+      )}
+    </ComplianceDetailContainer>
+  );
+};
diff --git a/ui/components/compliance/compliance-custom-details/shared-components.tsx b/ui/components/compliance/compliance-custom-details/shared-components.tsx
index d5c69499af..22ba330d57 100644
--- a/ui/components/compliance/compliance-custom-details/shared-components.tsx
+++ b/ui/components/compliance/compliance-custom-details/shared-components.tsx
@@ -1,4 +1,12 @@
-import { cn } from "@/lib/utils";
+import { VariantProps } from "class-variance-authority";
+
+import { Badge, badgeVariants } from "@/components/shadcn/badge/badge";
+
+// Variants come straight from the canonical shadcn Badge so compliance panels
+// share the same badge vocabulary (and tokens) as the rest of the app.
+export type ComplianceBadgeVariant = NonNullable<
+  VariantProps<typeof badgeVariants>["variant"]
+>;
 
 export const ComplianceDetailContainer = ({
   children,
@@ -43,55 +51,28 @@ export const ComplianceBadgeContainer = ({
   return <div className="flex flex-wrap items-center gap-3">{children}</div>;
 };
 
-type BadgeColor =
-  | "red" // Risk/Level/Severity
-  | "blue" // Assessment/Method
-  | "orange" // Type/Category
-  | "green" // Weight/Score (positive)
-  | "purple" // Profile
-  | "indigo" // IDs/References
-  | "gray"; // Additional Info/Neutral
-
 export const ComplianceBadge = ({
   label,
   value,
-  color,
+  variant,
   conditional = false,
 }: {
   label: string;
   value: string | number;
-  color: BadgeColor;
+  variant: ComplianceBadgeVariant;
   conditional?: boolean;
 }) => {
-  const actualColor = conditional && Number(value) === 0 ? "gray" : color;
-
-  const colorClasses = {
-    red: "bg-red-50 text-red-700 ring-red-600/10 dark:bg-red-400/10 dark:text-red-400 dark:ring-red-400/20",
-    blue: "bg-blue-50 text-blue-700 ring-blue-600/10 dark:bg-blue-400/10 dark:text-blue-400 dark:ring-blue-400/20",
-    orange:
-      "bg-orange-50 text-orange-700 ring-orange-600/10 dark:bg-orange-400/10 dark:text-orange-400 dark:ring-orange-400/20",
-    green:
-      "bg-green-50 text-green-700 ring-green-600/10 dark:bg-green-400/10 dark:text-green-400 dark:ring-green-400/20",
-    purple:
-      "bg-purple-50 text-purple-700 ring-purple-600/10 dark:bg-purple-400/10 dark:text-purple-400 dark:ring-purple-400/20",
-    indigo:
-      "bg-indigo-50 text-indigo-700 ring-indigo-600/10 dark:bg-indigo-400/10 dark:text-indigo-400 dark:ring-indigo-400/20",
-    gray: "bg-gray-50 text-gray-600 ring-gray-500/10 dark:bg-gray-400/10 dark:text-gray-400 dark:ring-gray-400/20",
-  };
+  // A "conditional" metric badge with a zero value drops to a neutral variant
+  // so empty scores don't read as a meaningful (e.g. positive) result.
+  const actualVariant: ComplianceBadgeVariant =
+    conditional && Number(value) === 0 ? "secondary" : variant;
 
   return (
     <div className="flex items-center gap-2">
       <span className="text-muted-foreground text-sm font-medium">
         {label}:
       </span>
-      <span
-        className={cn(
-          "inline-flex items-center rounded-md px-2 py-1 text-xs font-medium ring-1 ring-inset",
-          colorClasses[actualColor],
-        )}
-      >
-        {value}
-      </span>
+      <Badge variant={actualVariant}>{value}</Badge>
     </div>
   );
 };
@@ -132,12 +113,9 @@ export const ComplianceChipContainer = ({
     <ComplianceDetailSection title={title}>
       <div className="flex flex-wrap gap-2">
         {items.map((item: string, index: number) => (
-          <span
-            key={index}
-            className="inline-flex items-center rounded-md bg-gray-50 px-2 py-1 text-xs font-medium text-gray-600 ring-1 ring-gray-500/10 ring-inset dark:bg-gray-400/10 dark:text-gray-400 dark:ring-gray-400/20"
-          >
+          <Badge key={index} variant="tag">
             {item}
-          </span>
+          </Badge>
         ))}
       </div>
     </ComplianceDetailSection>
diff --git a/ui/components/compliance/compliance-custom-details/threat-details.tsx b/ui/components/compliance/compliance-custom-details/threat-details.tsx
index 822612234d..542583ff0e 100644
--- a/ui/components/compliance/compliance-custom-details/threat-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/threat-details.tsx
@@ -34,7 +34,7 @@ export const ThreatCustomDetails = ({
           <ComplianceBadge
             label="Risk Level"
             value={requirement.levelOfRisk}
-            color="red"
+            variant="error"
           />
         )}
 
@@ -42,7 +42,7 @@ export const ThreatCustomDetails = ({
           <ComplianceBadge
             label="Weight"
             value={requirement.weight}
-            color="green"
+            variant="success"
           />
         )}
 
@@ -50,7 +50,7 @@ export const ThreatCustomDetails = ({
           <ComplianceBadge
             label="Score"
             value={requirement.score}
-            color="green"
+            variant="success"
             conditional={true}
           />
         )}
@@ -61,13 +61,13 @@ export const ThreatCustomDetails = ({
               <ComplianceBadge
                 label="Findings"
                 value={`${requirement.passedFindings}/${requirement.totalFindings}`}
-                color="blue"
+                variant="info"
               />
               {requirement.totalFindings > 0 && (
                 <ComplianceBadge
                   label="Pass Rate"
                   value={`${Math.round((requirement.passedFindings / requirement.totalFindings) * 100)}%`}
-                  color="green"
+                  variant="success"
                   conditional={true}
                 />
               )}
diff --git a/ui/components/compliance/compliance-download-container.test.tsx b/ui/components/compliance/compliance-download-container.test.tsx
index 81774b686f..31c68fb1fc 100644
--- a/ui/components/compliance/compliance-download-container.test.tsx
+++ b/ui/components/compliance/compliance-download-container.test.tsx
@@ -6,15 +6,19 @@ import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const { downloadComplianceCsvMock, downloadCompliancePdfMock } = vi.hoisted(
-  () => ({
-    downloadComplianceCsvMock: vi.fn(),
-    downloadCompliancePdfMock: vi.fn(),
-  }),
-);
+const {
+  downloadComplianceCsvMock,
+  downloadComplianceOcsfMock,
+  downloadCompliancePdfMock,
+} = vi.hoisted(() => ({
+  downloadComplianceCsvMock: vi.fn(),
+  downloadComplianceOcsfMock: vi.fn(),
+  downloadCompliancePdfMock: vi.fn(),
+}));
 
 vi.mock("@/lib/helper", () => ({
   downloadComplianceCsv: downloadComplianceCsvMock,
+  downloadComplianceOcsf: downloadComplianceOcsfMock,
   downloadCompliancePdf: downloadCompliancePdfMock,
 }));
 
@@ -131,4 +135,51 @@ describe("ComplianceDownloadContainer", () => {
       {},
     );
   });
+
+  it("should hide the OCSF action for frameworks without OCSF support", async () => {
+    const user = userEvent.setup();
+
+    render(
+      <ComplianceDownloadContainer
+        compact
+        presentation="dropdown"
+        scanId="scan-1"
+        complianceId="compliance-1"
+      />,
+    );
+
+    await user.click(
+      screen.getByRole("button", { name: "Open compliance export actions" }),
+    );
+
+    expect(screen.queryByText("Download OCSF report")).not.toBeInTheDocument();
+  });
+
+  it("should surface and trigger the OCSF download for universal frameworks", async () => {
+    const user = userEvent.setup();
+
+    render(
+      <ComplianceDownloadContainer
+        compact
+        presentation="dropdown"
+        scanId="scan-1"
+        complianceId="dora_2022_2554"
+      />,
+    );
+
+    await user.click(
+      screen.getByRole("button", { name: "Open compliance export actions" }),
+    );
+    expect(screen.getByText("Download OCSF report")).toBeInTheDocument();
+
+    await user.click(
+      screen.getByRole("menuitem", { name: /Download OCSF report/i }),
+    );
+
+    expect(downloadComplianceOcsfMock).toHaveBeenCalledWith(
+      "scan-1",
+      "dora_2022_2554",
+      {},
+    );
+  });
 });
diff --git a/ui/components/compliance/compliance-download-container.tsx b/ui/components/compliance/compliance-download-container.tsx
index 6d2e0ddfee..6e29acc213 100644
--- a/ui/components/compliance/compliance-download-container.tsx
+++ b/ui/components/compliance/compliance-download-container.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { DownloadIcon, FileTextIcon } from "lucide-react";
+import { DownloadIcon, FileJsonIcon, FileTextIcon } from "lucide-react";
 import { useState } from "react";
 
 import { Button } from "@/components/shadcn/button/button";
@@ -14,8 +14,15 @@ import {
   TooltipTrigger,
 } from "@/components/shadcn/tooltip";
 import { toast } from "@/components/ui";
-import type { ComplianceReportType } from "@/lib/compliance/compliance-report-types";
-import { downloadComplianceCsv, downloadCompliancePdf } from "@/lib/helper";
+import {
+  type ComplianceReportType,
+  isOcsfSupported,
+} from "@/lib/compliance/compliance-report-types";
+import {
+  downloadComplianceCsv,
+  downloadComplianceOcsf,
+  downloadCompliancePdf,
+} from "@/lib/helper";
 import { cn } from "@/lib/utils";
 
 interface ComplianceDownloadContainerProps {
@@ -40,9 +47,14 @@ export const ComplianceDownloadContainer = ({
   presentation = "buttons",
 }: ComplianceDownloadContainerProps) => {
   const [isDownloadingCsv, setIsDownloadingCsv] = useState(false);
+  const [isDownloadingOcsf, setIsDownloadingOcsf] = useState(false);
   const [isDownloadingPdf, setIsDownloadingPdf] = useState(false);
   const isIconWidth = buttonWidth === "icon";
   const isDropdown = presentation === "dropdown";
+  // Only universal frameworks declaring an ``outputs`` block expose a
+  // per-framework OCSF artifact (today: DORA, CSA CCM 4.0). Hide the
+  // action everywhere else so the user never hits a guaranteed 404.
+  const ocsfAvailable = isOcsfSupported(complianceId);
 
   const handleDownloadCsv = async () => {
     if (isDownloadingCsv) return;
@@ -54,6 +66,16 @@ export const ComplianceDownloadContainer = ({
     }
   };
 
+  const handleDownloadOcsf = async () => {
+    if (!ocsfAvailable || isDownloadingOcsf) return;
+    setIsDownloadingOcsf(true);
+    try {
+      await downloadComplianceOcsf(scanId, complianceId, toast);
+    } finally {
+      setIsDownloadingOcsf(false);
+    }
+  };
+
   const handleDownloadPdf = async () => {
     if (!reportType || isDownloadingPdf) return;
     setIsDownloadingPdf(true);
@@ -105,6 +127,18 @@ export const ComplianceDownloadContainer = ({
             onSelect={handleDownloadCsv}
             disabled={disabled || isDownloadingCsv}
           />
+          {ocsfAvailable && (
+            <ActionDropdownItem
+              icon={
+                <FileJsonIcon
+                  className={isDownloadingOcsf ? "animate-download-icon" : ""}
+                />
+              }
+              label="Download OCSF report"
+              onSelect={handleDownloadOcsf}
+              disabled={disabled || isDownloadingOcsf}
+            />
+          )}
           {reportType && (
             <ActionDropdownItem
               icon={
@@ -152,6 +186,29 @@ export const ComplianceDownloadContainer = ({
               <TooltipContent>Download CSV report</TooltipContent>
             )}
           </Tooltip>
+          {ocsfAvailable && (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <Button
+                  size="sm"
+                  variant="outline"
+                  className={buttonClassName}
+                  onClick={handleDownloadOcsf}
+                  disabled={disabled || isDownloadingOcsf}
+                  aria-label="Download compliance OCSF report"
+                >
+                  <FileJsonIcon
+                    size={14}
+                    className={isDownloadingOcsf ? "animate-download-icon" : ""}
+                  />
+                  <span className={labelClassName}>OCSF</span>
+                </Button>
+              </TooltipTrigger>
+              {showTooltip && (
+                <TooltipContent>Download OCSF report</TooltipContent>
+              )}
+            </Tooltip>
+          )}
           {reportType && (
             <Tooltip>
               <TooltipTrigger asChild>
diff --git a/ui/components/compliance/compliance-overview-grid.tsx b/ui/components/compliance/compliance-overview-grid.tsx
index 280465520a..b042ccc658 100644
--- a/ui/components/compliance/compliance-overview-grid.tsx
+++ b/ui/components/compliance/compliance-overview-grid.tsx
@@ -1,12 +1,26 @@
 "use client";
 
-import { useState } from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { Suspense, useState } from "react";
 
 import { ComplianceCard } from "@/components/compliance/compliance-card";
+import { OnboardingTrigger, PageReady } from "@/components/onboarding";
 import { DataTableSearch } from "@/components/ui/table/data-table-search";
+import { buildComplianceDetailPath } from "@/lib/compliance/compliance-detail-url";
+import { getFlowById } from "@/lib/onboarding";
+import { createViewComplianceTourStepHandlers } from "@/lib/tours/view-compliance.tour";
 import type { ComplianceOverviewData } from "@/types/compliance";
 import type { ScanEntity } from "@/types/scans";
 
+const viewComplianceFlow = getFlowById("view-compliance")!;
+
+// Module-level so the identity is stable: `configOverrides` is an effect dependency in
+// `useDriverTour`, and a fresh object per keystroke would tear the tour down mid-typing.
+const VIEW_COMPLIANCE_TOUR_CONFIG = {
+  // Last step opens the first card (see createViewComplianceTourStepHandlers).
+  doneBtnText: "Open Compliance",
+};
+
 interface ComplianceOverviewGridProps {
   frameworks: ComplianceOverviewData[];
   scanId: string;
@@ -25,6 +39,8 @@ export const ComplianceOverviewGrid = ({
   selectedScan,
   latestCisIds,
 }: ComplianceOverviewGridProps) => {
+  const router = useRouter();
+  const searchParams = useSearchParams();
   const [searchTerm, setSearchTerm] = useState("");
 
   const filteredFrameworks = frameworks.filter((compliance) =>
@@ -33,20 +49,54 @@ export const ComplianceOverviewGrid = ({
       .includes(searchTerm.toLowerCase()),
   );
 
+  const resetSearch = () => {
+    setSearchTerm("");
+    return frameworks.length > 0;
+  };
+
+  const openFirstFramework = () => {
+    const first = frameworks[0];
+    if (!first) return;
+    router.push(
+      buildComplianceDetailPath({
+        title: first.attributes.framework,
+        complianceId: first.id,
+        version: first.attributes.version,
+        scanId,
+        regionFilter: searchParams.get("filter[region__in]"),
+      }),
+    );
+  };
+
   return (
     <>
-      <div className="flex items-center justify-between gap-4">
-        <DataTableSearch
-          controlledValue={searchTerm}
-          onSearchChange={setSearchTerm}
-          placeholder="Search frameworks..."
+      {/* Suspense required: OnboardingTrigger reads useSearchParams */}
+      <Suspense fallback={null}>
+        <OnboardingTrigger
+          flow={viewComplianceFlow}
+          stepHandlers={createViewComplianceTourStepHandlers({
+            resetSearch,
+            openFirstFramework,
+          })}
+          configOverrides={VIEW_COMPLIANCE_TOUR_CONFIG}
         />
+      </Suspense>
+      {/* Signals the navbar that this route's data has loaded (enables the replay icon). */}
+      <PageReady />
+      <div className="flex items-center justify-between gap-4">
+        <div data-tour-id="view-compliance-search">
+          <DataTableSearch
+            controlledValue={searchTerm}
+            onSearchChange={setSearchTerm}
+            placeholder="Search frameworks..."
+          />
+        </div>
         <span className="text-text-neutral-secondary shrink-0 text-sm">
           {filteredFrameworks.length.toLocaleString()} Total Entries
         </span>
       </div>
       <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3 2xl:grid-cols-4">
-        {filteredFrameworks.map((compliance) => {
+        {filteredFrameworks.map((compliance, index) => {
           const { attributes, id } = compliance;
           const {
             framework,
@@ -55,9 +105,8 @@ export const ComplianceOverviewGrid = ({
             total_requirements,
           } = attributes;
 
-          return (
+          const card = (
             <ComplianceCard
-              key={id}
               title={framework}
               version={version}
               passingRequirements={requirements_passed}
@@ -71,6 +120,22 @@ export const ComplianceOverviewGrid = ({
               isLatestCisForProvider={latestCisIds?.has(id) ?? false}
             />
           );
+
+          // Anchor the tour to a single card, not the whole grid: highlighting the
+          // grid lit up the entire viewport and scrolled the page to the bottom.
+          return index === 0 ? (
+            <div
+              key={id}
+              data-tour-id="view-compliance-frameworks"
+              className="h-full [&>*]:h-full"
+            >
+              {card}
+            </div>
+          ) : (
+            <div key={id} className="h-full [&>*]:h-full">
+              {card}
+            </div>
+          );
         })}
       </div>
     </>
diff --git a/ui/components/compliance/compliance-warming.tsx b/ui/components/compliance/compliance-warming.tsx
new file mode 100644
index 0000000000..19864ae121
--- /dev/null
+++ b/ui/components/compliance/compliance-warming.tsx
@@ -0,0 +1,49 @@
+"use client";
+
+import { Icon } from "@iconify/react";
+import { useRouter } from "next/navigation";
+
+import { Button } from "@/components/shadcn/button/button";
+import { Card, CardContent } from "@/components/shadcn/card/card";
+
+export const ComplianceWarming = () => {
+  const router = useRouter();
+
+  return (
+    <div className="flex h-full min-h-[calc(100vh-56px)] items-center justify-center">
+      <div className="mx-auto w-full max-w-2xl">
+        <Card variant="base" padding="lg">
+          <CardContent>
+            <div className="flex w-full items-center justify-between gap-6">
+              <div className="flex items-start gap-4">
+                <Icon
+                  icon="tabler:clock"
+                  className="mt-1 h-5 w-5 text-gray-400 dark:text-gray-300"
+                />
+                <div>
+                  <h2 className="mb-1 text-base font-medium text-gray-900 dark:text-white">
+                    Compliance data is still loading
+                  </h2>
+                  <p className="text-sm text-gray-500 dark:text-gray-300">
+                    This can happen for a few seconds right after an update.
+                    Please try again shortly.
+                  </p>
+                </div>
+              </div>
+              <Button
+                variant="secondary"
+                size="sm"
+                className="shrink-0 gap-2"
+                onClick={() => router.refresh()}
+                aria-label="Reload compliance data"
+              >
+                <Icon icon="tabler:refresh" className="h-4 w-4" />
+                Try Again
+              </Button>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+};
diff --git a/ui/components/compliance/index.ts b/ui/components/compliance/index.ts
index e0bd631200..caea32e264 100644
--- a/ui/components/compliance/index.ts
+++ b/ui/components/compliance/index.ts
@@ -19,6 +19,7 @@ export * from "./compliance-header/compliance-scan-info";
 export * from "./compliance-header/data-compliance";
 export * from "./compliance-header/scan-selector";
 export * from "./compliance-overview-grid";
+export * from "./compliance-warming";
 export * from "./no-scans-available";
 export * from "./skeletons/bar-chart-skeleton";
 export * from "./skeletons/compliance-accordion-skeleton";
diff --git a/ui/components/findings/findings-filters.tsx b/ui/components/findings/findings-filters.tsx
index 02a3aec62d..349769f3ad 100644
--- a/ui/components/findings/findings-filters.tsx
+++ b/ui/components/findings/findings-filters.tsx
@@ -95,7 +95,6 @@ export const FindingsFilterBatchControls = ({
   const [isExpanded, setIsExpanded] = useState(false);
   const isAlertsEdit = variant === "alerts-edit";
 
-  // Custom filters for the expandable section.
   const customFilters = [
     ...filterFindings
       .filter((filter) => !isAlertsEdit || filter.key !== FilterType.STATUS)
@@ -182,8 +181,6 @@ export const FindingsFilterBatchControls = ({
   const showAppliedRow = appliedFilterChips.length > 0;
   const showPendingRow = hasChanges;
 
-  // Handler for removing a single chip: update the pending filter to remove that value.
-  // setPending handles both "filter[key]" and "key" formats internally.
   const handleChipRemove = (filterKey: string, value?: string) => {
     if (value === undefined) {
       setPending(filterKey, []);
@@ -195,7 +192,6 @@ export const FindingsFilterBatchControls = ({
     setPending(filterKey, nextValues);
   };
 
-  // For the date picker, read from pendingFilters
   const pendingDateValues = pendingFilters["filter[inserted_at]"];
   const pendingDateValue =
     pendingDateValues && pendingDateValues.length > 0
@@ -333,19 +329,21 @@ export const FindingsFilters = (props: FindingsFiltersProps) => {
   });
 
   return (
-    <FindingsFilterBatchControls
-      {...props}
-      appliedFilters={appliedFilters}
-      pendingFilters={pendingFilters}
-      changedFilters={changedFilters}
-      setPending={setPending}
-      applyAll={applyAll}
-      discardAll={discardAll}
-      clearAndApply={clearAndApply}
-      removeAppliedAndApply={removeAppliedAndApply}
-      hasChanges={hasChanges}
-      changeCount={changeCount}
-      getFilterValue={getFilterValue}
-    />
+    <div data-tour-id="explore-findings-filters">
+      <FindingsFilterBatchControls
+        {...props}
+        appliedFilters={appliedFilters}
+        pendingFilters={pendingFilters}
+        changedFilters={changedFilters}
+        setPending={setPending}
+        applyAll={applyAll}
+        discardAll={discardAll}
+        clearAndApply={clearAndApply}
+        removeAppliedAndApply={removeAppliedAndApply}
+        hasChanges={hasChanges}
+        changeCount={changeCount}
+        getFilterValue={getFilterValue}
+      />
+    </div>
   );
 };
diff --git a/ui/components/findings/table/findings-group-table.test.tsx b/ui/components/findings/table/findings-group-table.test.tsx
index 38887bf1fb..411f7a64f7 100644
--- a/ui/components/findings/table/findings-group-table.test.tsx
+++ b/ui/components/findings/table/findings-group-table.test.tsx
@@ -9,17 +9,47 @@ vi.mock("next/navigation", () => ({
     refresh: vi.fn(),
   }),
   useSearchParams: () => new URLSearchParams(),
+  usePathname: () => "/findings",
 }));
 
 vi.mock("@/components/ui/table", () => ({
-  DataTable: ({ toolbarRightContent }: { toolbarRightContent?: ReactNode }) => (
+  DataTable: ({
+    data,
+    toolbarRightContent,
+    getRowAttributes,
+  }: {
+    data?: Array<{ checkId?: string }>;
+    toolbarRightContent?: ReactNode;
+    getRowAttributes?: (row: {
+      index: number;
+      original: { checkId?: string };
+    }) => Record<string, string | undefined>;
+  }) => (
     <div>
       <div data-testid="table-toolbar-right">{toolbarRightContent}</div>
       <span>10 Total Entries</span>
+      <table>
+        <tbody>
+          {(data ?? []).map((original, index) => (
+            <tr
+              key={original.checkId ?? index}
+              data-testid={`row-${index}`}
+              {...getRowAttributes?.({ index, original })}
+            >
+              <td>{original.checkId}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
     </div>
   ),
 }));
 
+vi.mock("@/components/onboarding", () => ({
+  OnboardingTrigger: () => <div data-testid="onboarding-trigger" />,
+  PageReady: () => <div data-testid="page-ready" />,
+}));
+
 vi.mock("@/components/filters/custom-checkbox-muted-findings", () => ({
   CustomCheckboxMutedFindings: () => (
     <label>
@@ -75,4 +105,68 @@ describe("FindingsGroupTable", () => {
       expect(toolbar).toHaveTextContent("Include muted findings");
     });
   });
+
+  describe("explore-findings tour gating", () => {
+    it("does not mount the tour trigger when there are no finding groups", () => {
+      // Given an empty table (e.g. a scan is still running)
+      render(
+        <FindingsGroupTable
+          data={[]}
+          resolvedFilters={{}}
+          hasHistoricalData={false}
+        />,
+      );
+
+      // Then the tour never starts — there is no first-row anchor for the
+      // "Open a finding group" step to resolve, which would otherwise throw.
+      expect(
+        screen.queryByTestId("onboarding-trigger"),
+      ).not.toBeInTheDocument();
+      // PageReady still signals the navbar that the route's data has loaded.
+      expect(screen.getByTestId("page-ready")).toBeInTheDocument();
+    });
+
+    it("mounts the tour trigger once at least one finding group exists", () => {
+      // Given a populated table
+      const data = [{ checkId: "check-a" }] as unknown as Parameters<
+        typeof FindingsGroupTable
+      >[0]["data"];
+
+      render(
+        <FindingsGroupTable
+          data={data}
+          resolvedFilters={{}}
+          hasHistoricalData={false}
+        />,
+      );
+
+      // Then the explore-findings tour is allowed to start.
+      expect(screen.getByTestId("onboarding-trigger")).toBeInTheDocument();
+    });
+  });
+
+  describe("onboarding anchor", () => {
+    it("anchors the finding-group tour step to the first row only", () => {
+      // Given two finding groups (the tour must point at the first, even if there is one)
+      const data = [
+        { checkId: "check-a" },
+        { checkId: "check-b" },
+      ] as unknown as Parameters<typeof FindingsGroupTable>[0]["data"];
+
+      render(
+        <FindingsGroupTable
+          data={data}
+          resolvedFilters={{}}
+          hasHistoricalData={false}
+        />,
+      );
+
+      // Then driver.js resolves `[data-tour-id="explore-findings-group"]` to the first row.
+      expect(screen.getByTestId("row-0")).toHaveAttribute(
+        "data-tour-id",
+        "explore-findings-group",
+      );
+      expect(screen.getByTestId("row-1")).not.toHaveAttribute("data-tour-id");
+    });
+  });
 });
diff --git a/ui/components/findings/table/findings-group-table.tsx b/ui/components/findings/table/findings-group-table.tsx
index 035747f1fd..e0aac0a75b 100644
--- a/ui/components/findings/table/findings-group-table.tsx
+++ b/ui/components/findings/table/findings-group-table.tsx
@@ -2,12 +2,15 @@
 
 import { Row, RowSelectionState } from "@tanstack/react-table";
 import { useRouter, useSearchParams } from "next/navigation";
-import { useRef, useState } from "react";
+import { Suspense, useRef, useState } from "react";
 
 import { resolveFindingIdsByVisibleGroupResources } from "@/actions/findings/findings-by-resource";
 import { CustomCheckboxMutedFindings } from "@/components/filters/custom-checkbox-muted-findings";
+import { OnboardingTrigger, PageReady } from "@/components/onboarding";
 import { DataTable } from "@/components/ui/table";
 import { canDrillDownFindingGroup } from "@/lib/findings-groups";
+import { getFlowById } from "@/lib/onboarding";
+import { createExploreFindingsTourStepHandlers } from "@/lib/tours/explore-findings.tour";
 import { FindingGroupRow, MetaDataProps } from "@/types";
 
 import { FloatingMuteButton } from "../floating-mute-button";
@@ -20,6 +23,8 @@ import {
   InlineResourceContainerHandle,
 } from "./inline-resource-container";
 
+const exploreFindingsFlow = getFlowById("explore-findings")!;
+
 function buildMuteLabel(groupCount: number, resourceCount: number): string {
   const parts: string[] = [];
   if (groupCount > 0) {
@@ -53,23 +58,17 @@ export function FindingsGroupTable({
   const [expandedGroup, setExpandedGroup] = useState<FindingGroupRow | null>(
     null,
   );
-  // Separate display state (updates on keystroke) from committed search (updates on Enter only).
-  // This prevents InlineResourceContainer from remounting on every keystroke.
+  // Separate input (keystroke) from committed search (Enter) to avoid remounting InlineResourceContainer.
   const [resourceSearchInput, setResourceSearchInput] = useState("");
   const [resourceSearch, setResourceSearch] = useState("");
   const [resourceSelection, setResourceSelection] = useState<string[]>([]);
   const inlineRef = useRef<InlineResourceContainerHandle>(null);
 
-  // State resets (selection, drill-down) are handled by the parent via
-  // key={groupKey} — when data changes, the component remounts with fresh state.
-
   const safeData = data ?? [];
   const hasResourceSelection = resourceSelection.length > 0;
   const filters = resolvedFilters;
 
-  // Get selected group check IDs. When the expanded group has individual resource
-  // selections, exclude it from group-level mute targets — the resource-level
-  // FloatingMuteButton handles those.
+  // Exclude expanded group from group-level mutes when it has resource selections.
   const selectedCheckIds = Object.keys(rowSelection)
     .filter((key) => rowSelection[key])
     .map((idx) => safeData[parseInt(idx)]?.checkId)
@@ -83,7 +82,6 @@ export function FindingsGroupTable({
     .map((idx) => safeData[parseInt(idx)])
     .filter(Boolean);
 
-  // Count of selectable rows (groups where not ALL findings are muted)
   const selectableRowCount = safeData.filter((g) =>
     canMuteFindingGroup({
       resourcesFail: g.resourcesFail,
@@ -129,7 +127,6 @@ export function FindingsGroupTable({
     return Array.from(new Set(results.flat()));
   };
 
-  /** Shared resolver for group row action dropdowns (via context). */
   const resolveMuteIds = async (checkIds: string[]) =>
     resolveGroupMuteIds(checkIds);
 
@@ -142,10 +139,9 @@ export function FindingsGroupTable({
   };
 
   const handleDrillDown = (checkId: string, group: FindingGroupRow) => {
-    // No resources in the group → nothing to show, skip drill-down
     if (!canDrillDownFindingGroup(group)) return;
 
-    // Toggle: same group = collapse, different = switch
+    // Toggle: same group collapses, different group switches
     if (expandedCheckId === checkId) {
       handleCollapse();
       return;
@@ -165,6 +161,19 @@ export function FindingsGroupTable({
     setResourceSelection([]);
   };
 
+  // Drives the onboarding "Open a finding group" step: opens the first row when
+  // drillable, otherwise the first drillable group. Returns false when none can
+  // open so the tour skips the resources step instead of hanging.
+  const openFirstFindingGroup = (): boolean => {
+    const target =
+      safeData[0] && canDrillDownFindingGroup(safeData[0])
+        ? safeData[0]
+        : safeData.find((group) => canDrillDownFindingGroup(group));
+    if (!target) return false;
+    handleDrillDown(target.checkId, target);
+    return true;
+  };
+
   const columns = getColumnFindingGroups({
     rowSelection,
     selectableRowCount,
@@ -202,29 +211,49 @@ export function FindingsGroupTable({
         resolveMuteIds,
       }}
     >
-      <DataTable
-        columns={columns}
-        data={safeData}
-        metadata={metadata}
-        enableRowSelection
-        rowSelection={rowSelection}
-        onRowSelectionChange={setRowSelection}
-        getRowCanSelect={getRowCanSelect}
-        showSearch
-        searchPlaceholder={
-          expandedCheckId ? "Search resources..." : "Search by name"
-        }
-        controlledSearch={expandedCheckId ? resourceSearchInput : undefined}
-        onSearchChange={expandedCheckId ? setResourceSearchInput : undefined}
-        onSearchCommit={expandedCheckId ? setResourceSearch : undefined}
-        searchBadge={
-          expandedGroup
-            ? { label: expandedGroup.checkTitle, onDismiss: handleCollapse }
-            : undefined
-        }
-        toolbarRightContent={<CustomCheckboxMutedFindings />}
-        renderAfterRow={renderAfterRow}
-      />
+      {/* Gate the tour on having at least one finding group */}
+      <div>
+        <Suspense fallback={null}>
+          {safeData.length > 0 && (
+            <OnboardingTrigger
+              flow={exploreFindingsFlow}
+              stepHandlers={createExploreFindingsTourStepHandlers(
+                openFirstFindingGroup,
+              )}
+            />
+          )}
+        </Suspense>
+        {/* Signals the navbar that this route's data has loaded (enables the replay icon). */}
+        <PageReady />
+        <DataTable
+          columns={columns}
+          data={safeData}
+          metadata={metadata}
+          enableRowSelection
+          rowSelection={rowSelection}
+          onRowSelectionChange={setRowSelection}
+          getRowCanSelect={getRowCanSelect}
+          showSearch
+          searchPlaceholder={
+            expandedCheckId ? "Search resources..." : "Search by name"
+          }
+          controlledSearch={expandedCheckId ? resourceSearchInput : undefined}
+          onSearchChange={expandedCheckId ? setResourceSearchInput : undefined}
+          onSearchCommit={expandedCheckId ? setResourceSearch : undefined}
+          searchBadge={
+            expandedGroup
+              ? { label: expandedGroup.checkTitle, onDismiss: handleCollapse }
+              : undefined
+          }
+          toolbarRightContent={<CustomCheckboxMutedFindings />}
+          renderAfterRow={renderAfterRow}
+          // Anchor the "Open a finding group" tour step to the first group row
+          // (there may be only one); driver.js resolves to the first match.
+          getRowAttributes={(row) =>
+            row.index === 0 ? { "data-tour-id": "explore-findings-group" } : {}
+          }
+        />
+      </div>
 
       {(selectedCheckIds.length > 0 || hasResourceSelection) && (
         <FloatingMuteButton
@@ -239,7 +268,6 @@ export function FindingsGroupTable({
               selectedCheckIds.length > 0
                 ? resolveGroupMuteIds(selectedCheckIds)
                 : Promise.resolve([]),
-              // resourceSelection already contains real finding UUIDs
               Promise.resolve(hasResourceSelection ? resourceSelection : []),
             ]);
             return [...groupIds, ...resourceIds];
diff --git a/ui/components/findings/table/inline-resource-container.tsx b/ui/components/findings/table/inline-resource-container.tsx
index 22ccb027e1..29115bca98 100644
--- a/ui/components/findings/table/inline-resource-container.tsx
+++ b/ui/components/findings/table/inline-resource-container.tsx
@@ -217,6 +217,8 @@ export function InlineResourceContainer({
         <td colSpan={columnCount} className="p-0">
           <AnimatePresence initial>
             <motion.div
+              // Onboarding anchor: the "Review the affected resources" tour step.
+              data-tour-id="explore-findings-resources"
               initial={{ height: 0, opacity: 0 }}
               animate={{ height: "auto", opacity: 1 }}
               exit={{ height: 0, opacity: 0 }}
diff --git a/ui/components/findings/table/provider-icon-cell.test.tsx b/ui/components/findings/table/provider-icon-cell.test.tsx
new file mode 100644
index 0000000000..593122d33a
--- /dev/null
+++ b/ui/components/findings/table/provider-icon-cell.test.tsx
@@ -0,0 +1,45 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import type { ProviderType } from "@/types/providers";
+
+import { ProviderIconCell } from "./provider-icon-cell";
+
+// Render the lazy provider badges as plain text so we can assert on them. The
+// real PROVIDER_TYPE_DATA map (and its `in` guard) is exercised on purpose.
+vi.mock("@/components/icons/providers-badge", () => ({
+  AWSProviderBadge: () => <span>AWS</span>,
+  AzureProviderBadge: () => <span>Azure</span>,
+  GCPProviderBadge: () => <span>GCP</span>,
+  KS8ProviderBadge: () => <span>Kubernetes</span>,
+  M365ProviderBadge: () => <span>M365</span>,
+  GitHubProviderBadge: () => <span>GitHub</span>,
+  GoogleWorkspaceProviderBadge: () => <span>Google Workspace</span>,
+  IacProviderBadge: () => <span>IaC</span>,
+  ImageProviderBadge: () => <span>Image</span>,
+  OracleCloudProviderBadge: () => <span>Oracle Cloud</span>,
+  MongoDBAtlasProviderBadge: () => <span>MongoDB Atlas</span>,
+  AlibabaCloudProviderBadge: () => <span>Alibaba Cloud</span>,
+  CloudflareProviderBadge: () => <span>Cloudflare</span>,
+  OpenStackProviderBadge: () => <span>OpenStack</span>,
+  VercelProviderBadge: () => <span>Vercel</span>,
+  OktaProviderBadge: () => <span>Okta</span>,
+}));
+
+describe("ProviderIconCell", () => {
+  it("renders the shared provider-type icon for a known provider", async () => {
+    render(<ProviderIconCell provider="aws" />);
+
+    expect(await screen.findByText("AWS")).toBeInTheDocument();
+  });
+
+  it("renders a '?' placeholder for a provider type missing from the map", () => {
+    render(
+      <ProviderIconCell
+        provider={"future-provider" as unknown as ProviderType}
+      />,
+    );
+
+    expect(screen.getByText("?")).toBeInTheDocument();
+  });
+});
diff --git a/ui/components/findings/table/provider-icon-cell.tsx b/ui/components/findings/table/provider-icon-cell.tsx
index 05a35b3dc2..350e730e78 100644
--- a/ui/components/findings/table/provider-icon-cell.tsx
+++ b/ui/components/findings/table/provider-icon-cell.tsx
@@ -1,43 +1,10 @@
 import {
-  AlibabaCloudProviderBadge,
-  AWSProviderBadge,
-  AzureProviderBadge,
-  CloudflareProviderBadge,
-  GCPProviderBadge,
-  GitHubProviderBadge,
-  GoogleWorkspaceProviderBadge,
-  IacProviderBadge,
-  ImageProviderBadge,
-  KS8ProviderBadge,
-  M365ProviderBadge,
-  MongoDBAtlasProviderBadge,
-  OktaProviderBadge,
-  OpenStackProviderBadge,
-  OracleCloudProviderBadge,
-  VercelProviderBadge,
-} from "@/components/icons/providers-badge";
+  PROVIDER_TYPE_DATA,
+  ProviderTypeIcon,
+} from "@/components/icons/providers-badge/provider-type-icon";
 import { cn } from "@/lib/utils";
 import { ProviderType } from "@/types";
 
-export const PROVIDER_ICONS = {
-  aws: AWSProviderBadge,
-  azure: AzureProviderBadge,
-  gcp: GCPProviderBadge,
-  kubernetes: KS8ProviderBadge,
-  m365: M365ProviderBadge,
-  github: GitHubProviderBadge,
-  googleworkspace: GoogleWorkspaceProviderBadge,
-  iac: IacProviderBadge,
-  image: ImageProviderBadge,
-  oraclecloud: OracleCloudProviderBadge,
-  mongodbatlas: MongoDBAtlasProviderBadge,
-  alibabacloud: AlibabaCloudProviderBadge,
-  cloudflare: CloudflareProviderBadge,
-  openstack: OpenStackProviderBadge,
-  vercel: VercelProviderBadge,
-  okta: OktaProviderBadge,
-} as const;
-
 interface ProviderIconCellProps {
   provider: ProviderType;
   size?: number;
@@ -49,9 +16,9 @@ export const ProviderIconCell = ({
   size = 26,
   className = "size-8 rounded-md bg-white",
 }: ProviderIconCellProps) => {
-  const IconComponent = PROVIDER_ICONS[provider];
-
-  if (!IconComponent) {
+  // Unknown provider types (present in the data but missing from the shared
+  // PROVIDER_TYPE_DATA map) render an explicit "?" rather than an empty icon.
+  if (!(provider in PROVIDER_TYPE_DATA)) {
     return (
       <div className={cn("flex items-center justify-center", className)}>
         <span className="text-text-neutral-secondary text-xs">?</span>
@@ -66,7 +33,7 @@ export const ProviderIconCell = ({
         className,
       )}
     >
-      <IconComponent width={size} height={size} />
+      <ProviderTypeIcon type={provider} size={size} />
     </div>
   );
 };
diff --git a/ui/components/graphs/sankey-chart.layout.test.ts b/ui/components/graphs/sankey-chart.layout.test.ts
new file mode 100644
index 0000000000..95fe9b624e
--- /dev/null
+++ b/ui/components/graphs/sankey-chart.layout.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it } from "vitest";
+
+import { getSankeyLayoutConfig } from "./sankey-chart.layout";
+
+describe("getSankeyLayoutConfig", () => {
+  it("keeps default size when provider count is at baseline", () => {
+    const config = getSankeyLayoutConfig({
+      baseHeight: 460,
+      nodes: [
+        { name: "AWS" },
+        { name: "High" },
+        { name: "Medium" },
+        { name: "Low" },
+        { name: "Azure" },
+        { name: "Info" },
+        { name: "GCP" },
+      ],
+      links: [{ source: 0 }, { source: 4 }, { source: 6 }],
+    });
+
+    expect(config).toEqual({
+      height: 460,
+      nodePadding: 50,
+    });
+  });
+
+  it("increases height and reduces node padding for denser graphs", () => {
+    const config = getSankeyLayoutConfig({
+      baseHeight: 460,
+      nodes: Array.from({ length: 24 }, (_, index) => ({
+        name: `Provider ${index}`,
+      })),
+      links: [
+        { source: 0 },
+        { source: 1 },
+        { source: 2 },
+        { source: 3 },
+        { source: 4 },
+        { source: 5 },
+        { source: 6 },
+        { source: 7 },
+        { source: 8 },
+        { source: 9 },
+        { source: 10 },
+        { source: 11 },
+      ],
+    });
+
+    expect(config).toEqual({
+      height: 844,
+      nodePadding: 38,
+    });
+  });
+
+  it("clamps padding to minimum when provider count is very large", () => {
+    const config = getSankeyLayoutConfig({
+      baseHeight: 460,
+      nodes: Array.from({ length: 120 }, (_, index) => ({
+        name: `Provider ${index}`,
+      })),
+      links: Array.from({ length: 100 }, (_, index) => ({
+        source: index,
+      })),
+    });
+
+    expect(config.nodePadding).toBe(14);
+    expect(config.height).toBe(1400);
+  });
+
+  it("falls back to node-based provider estimation when no link sources exist", () => {
+    const config = getSankeyLayoutConfig({
+      baseHeight: 460,
+      nodes: Array.from({ length: 8 }, (_, index) => ({
+        name: `Node ${index}`,
+      })),
+      links: [],
+    });
+
+    expect(config).toEqual({
+      height: 460,
+      nodePadding: 50,
+    });
+  });
+});
diff --git a/ui/components/graphs/sankey-chart.layout.ts b/ui/components/graphs/sankey-chart.layout.ts
new file mode 100644
index 0000000000..fd8ba39562
--- /dev/null
+++ b/ui/components/graphs/sankey-chart.layout.ts
@@ -0,0 +1,70 @@
+export interface SankeyNodeLike {
+  name: string;
+}
+
+export interface SankeyLinkLike {
+  source: number;
+}
+
+export interface SankeyLayoutInput {
+  baseHeight: number;
+  nodes: SankeyNodeLike[];
+  links: SankeyLinkLike[];
+}
+
+export interface SankeyLayoutConfig {
+  height: number;
+  nodePadding: number;
+}
+
+const SANKEY_DEFAULT_NODE_PADDING = 50;
+const SANKEY_MIN_NODE_PADDING = 14;
+const SANKEY_HEIGHT_GROWTH_PER_PROVIDER = 64;
+const SANKEY_BASE_PROVIDER_COUNT = 6;
+const SANKEY_MAX_HEIGHT = 1400;
+
+const getProviderNodeCount = ({ nodes, links }: SankeyLayoutInput): number => {
+  const uniqueSourceIndexes = new Set<number>();
+
+  links.forEach((link) => {
+    uniqueSourceIndexes.add(link.source);
+  });
+
+  if (uniqueSourceIndexes.size > 0) {
+    return uniqueSourceIndexes.size;
+  }
+
+  return Math.max(0, nodes.length - 5);
+};
+
+const getNodePaddingForProviderCount = (providerNodeCount: number): number => {
+  const compactedProviders = Math.max(
+    0,
+    providerNodeCount - SANKEY_BASE_PROVIDER_COUNT,
+  );
+  return Math.max(
+    SANKEY_MIN_NODE_PADDING,
+    Math.round(SANKEY_DEFAULT_NODE_PADDING - compactedProviders * 2),
+  );
+};
+
+export const getSankeyLayoutConfig = (
+  params: SankeyLayoutInput,
+): SankeyLayoutConfig => {
+  const providerNodeCount = getProviderNodeCount(params);
+  const extraProviders = Math.max(
+    0,
+    providerNodeCount - SANKEY_BASE_PROVIDER_COUNT,
+  );
+  const dynamicHeight = Math.min(
+    SANKEY_MAX_HEIGHT,
+    Math.round(
+      params.baseHeight + extraProviders * SANKEY_HEIGHT_GROWTH_PER_PROVIDER,
+    ),
+  );
+
+  return {
+    height: dynamicHeight,
+    nodePadding: getNodePaddingForProviderCount(providerNodeCount),
+  };
+};
diff --git a/ui/components/graphs/sankey-chart.test.tsx b/ui/components/graphs/sankey-chart.test.tsx
new file mode 100644
index 0000000000..48c9e01a04
--- /dev/null
+++ b/ui/components/graphs/sankey-chart.test.tsx
@@ -0,0 +1,98 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { CustomNode, SankeyChart } from "./sankey-chart";
+import { getSankeyLayoutConfig } from "./sankey-chart.layout";
+
+const mockPush = vi.fn();
+
+vi.mock("@/lib", () => ({
+  applyFailNonMutedFilters: (filters: unknown) => filters,
+}));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: mockPush }),
+  useSearchParams: () => new URLSearchParams(),
+}));
+
+describe("SankeyChart", () => {
+  it("uses layout-configured height for the empty-state container", () => {
+    const data = {
+      nodes: Array.from({ length: 14 }, (_, index) => ({
+        name: `Node ${index}`,
+      })),
+      links: Array.from({ length: 12 }, (_, index) => ({
+        source: index,
+        target: 13,
+        value: 0,
+      })),
+    };
+
+    const baseHeight = 460;
+    const layoutConfig = getSankeyLayoutConfig({
+      baseHeight,
+      nodes: data.nodes,
+      links: data.links,
+    });
+
+    const { container } = render(
+      <SankeyChart data={data} height={baseHeight} />,
+    );
+
+    expect(
+      screen.getByText("No failed findings to display"),
+    ).toBeInTheDocument();
+    expect(container.firstElementChild).toHaveStyle({
+      height: `${layoutConfig.height}px`,
+    });
+  });
+
+  it("renders risk and severity node labels with middle-aligned text", () => {
+    const x = 10;
+    const y = 20;
+    const width = 70;
+    const height = 80;
+    const nodeCenterY = y + height / 2;
+
+    render(
+      <svg>
+        <CustomNode
+          x={x}
+          y={y}
+          width={width}
+          height={height}
+          payload={{ name: "High", value: 9, newFindings: 3, change: 1 }}
+          containerWidth={200}
+          colors={{ High: "#ff0000" }}
+        />
+      </svg>,
+    );
+
+    const textElements = screen.getAllByText(/High|9/);
+    const nameLabel = textElements.find(
+      (element) => element.textContent === "High",
+    );
+    const valueLabel = textElements.find(
+      (element) => element.textContent === "9",
+    );
+
+    expect(nameLabel).toBeDefined();
+    expect(valueLabel).toBeDefined();
+
+    if (!nameLabel || !valueLabel) {
+      throw new Error(
+        "Expected both node name and value labels to be rendered.",
+      );
+    }
+
+    expect(nameLabel).toHaveAttribute("dominant-baseline", "middle");
+    expect(valueLabel).toHaveAttribute("dominant-baseline", "middle");
+
+    const nameY = Number.parseFloat(nameLabel.getAttribute("y") || "0");
+    const valueY = Number.parseFloat(valueLabel.getAttribute("y") || "0");
+
+    expect(nameY).toBeLessThan(nodeCenterY);
+    expect(valueY).toBeGreaterThan(nodeCenterY);
+    expect((nameY + valueY) / 2).toBeCloseTo(nodeCenterY);
+  });
+});
diff --git a/ui/components/graphs/sankey-chart.tsx b/ui/components/graphs/sankey-chart.tsx
index 0a41d0e4e7..f65647d73e 100644
--- a/ui/components/graphs/sankey-chart.tsx
+++ b/ui/components/graphs/sankey-chart.tsx
@@ -11,6 +11,7 @@ import { initializeChartColors } from "@/lib/charts/colors";
 import { PROVIDER_DISPLAY_NAMES } from "@/types/providers";
 import { SEVERITY_FILTER_MAP } from "@/types/severities";
 
+import { getSankeyLayoutConfig } from "./sankey-chart.layout";
 import { ChartTooltip } from "./shared/chart-tooltip";
 
 // Reverse mapping from display name to provider type for URL filters
@@ -73,6 +74,7 @@ interface NodeTooltipState {
 
 const TOOLTIP_OFFSET_PX = 10;
 const MIN_LINK_WIDTH = 4;
+const NODE_LABEL_LINE_SPACING = 13;
 
 interface TooltipPayload {
   payload: {
@@ -88,7 +90,7 @@ interface TooltipProps {
   payload?: TooltipPayload[];
 }
 
-interface CustomNodeProps {
+export interface CustomNodeProps {
   x: number;
   y: number;
   width: number;
@@ -148,7 +150,7 @@ const CustomTooltip = ({ active, payload }: TooltipProps) => {
   return null;
 };
 
-const CustomNode = ({
+export const CustomNode = ({
   x,
   y,
   width,
@@ -215,6 +217,10 @@ const CustomNode = ({
   const iconSize = 24;
   const iconGap = 8;
 
+  const nodeCenterY = y + height / 2;
+  const nodeNameY = nodeCenterY - NODE_LABEL_LINE_SPACING / 2;
+  const nodeValueY = nodeCenterY + NODE_LABEL_LINE_SPACING / 2;
+
   // Calculate text position accounting for icon
   const textOffsetX = isOut ? x - 6 : x + width + 6;
   const iconOffsetX = isOut
@@ -260,8 +266,9 @@ const CustomNode = ({
                   : textOffsetX + iconSize + iconGap * 2
                 : textOffsetX
             }
-            y={y + height / 2}
+            y={nodeNameY}
             fontSize="14"
+            dominantBaseline="middle"
             fill="var(--color-text-neutral-primary)"
           >
             {nodeName}
@@ -275,8 +282,9 @@ const CustomNode = ({
                   : textOffsetX + iconSize + iconGap * 2
                 : textOffsetX
             }
-            y={y + height / 2 + 13}
+            y={nodeValueY}
             fontSize="12"
+            dominantBaseline="middle"
             fill="var(--color-text-neutral-secondary)"
           >
             {payload.value}
@@ -531,11 +539,17 @@ export function SankeyChart({
   // Check if there's actual data to display (links with values > 0)
   const hasData = data.links.some((link) => link.value > 0);
 
+  const layoutConfig = getSankeyLayoutConfig({
+    baseHeight: height,
+    nodes: data.nodes,
+    links: data.links,
+  });
+
   if (!hasData) {
     return (
       <div
         className="flex items-center justify-center"
-        style={{ height: `${height}px` }}
+        style={{ height: `${layoutConfig.height}px` }}
       >
         <div className="flex flex-col items-center gap-2 text-center">
           <Info size={48} className="text-text-neutral-tertiary" />
@@ -549,12 +563,12 @@ export function SankeyChart({
 
   return (
     <div className="relative">
-      <ResponsiveContainer width="100%" height={height}>
+      <ResponsiveContainer width="100%" height={layoutConfig.height}>
         <Sankey
           data={data}
           node={wrappedCustomNode}
           link={wrappedCustomLink}
-          nodePadding={50}
+          nodePadding={layoutConfig.nodePadding}
           margin={{ top: 20, right: 160, bottom: 20, left: 160 }}
           sort={false}
         >
diff --git a/ui/components/graphs/threat-map.test.tsx b/ui/components/graphs/threat-map.test.tsx
new file mode 100644
index 0000000000..47d447bddc
--- /dev/null
+++ b/ui/components/graphs/threat-map.test.tsx
@@ -0,0 +1,93 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { ThreatMap } from "./threat-map";
+import type { ThreatMapData } from "./threat-map.types";
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn() }),
+  useSearchParams: () => new URLSearchParams(),
+}));
+
+vi.mock("./horizontal-bar-chart", () => ({
+  HorizontalBarChart: () => <div data-testid="bar-chart" />,
+}));
+
+function buildLocation(providerType: string, region: string) {
+  return {
+    id: `${providerType}-${region}`,
+    name: `${providerType} - ${region}`,
+    region,
+    regionCode: region,
+    providerType,
+    coordinates: [-122.4, 37.8] as [number, number],
+    totalFindings: 10,
+    failFindings: 4,
+    riskLevel: "high" as const,
+    severityData: [
+      { name: "Fail", value: 4, percentage: 40 },
+      { name: "Pass", value: 6, percentage: 60 },
+    ],
+  };
+}
+
+describe("ThreatMap region selector", () => {
+  it("auto-selects the region when it is the only one available", () => {
+    const data: ThreatMapData = {
+      locations: [
+        buildLocation("okta", "global"),
+        buildLocation("googleworkspace", "global"),
+      ],
+      regions: ["global"],
+    };
+
+    render(<ThreatMap data={data} />);
+
+    const select = screen.getByRole("combobox", {
+      name: "Filter threat map by region",
+    });
+    expect(select).toHaveValue("global");
+    expect(screen.getByText("Global Regions")).toBeInTheDocument();
+    expect(
+      screen.queryByText("Select a location on the map to view details"),
+    ).not.toBeInTheDocument();
+  });
+
+  it("keeps All Regions as default when there are multiple regions", () => {
+    const data: ThreatMapData = {
+      locations: [
+        buildLocation("aws", "us-east-1"),
+        buildLocation("okta", "global"),
+      ],
+      regions: ["global", "us-east-1"],
+    };
+
+    render(<ThreatMap data={data} />);
+
+    const select = screen.getByRole("combobox", {
+      name: "Filter threat map by region",
+    });
+    expect(select).toHaveValue("All Regions");
+    expect(
+      screen.getByRole("option", { name: "All Regions" }),
+    ).toBeInTheDocument();
+  });
+
+  it("shows the global option capitalized while keeping its filter value", () => {
+    const data: ThreatMapData = {
+      locations: [
+        buildLocation("aws", "us-east-1"),
+        buildLocation("okta", "global"),
+      ],
+      regions: ["global", "us-east-1"],
+    };
+
+    render(<ThreatMap data={data} />);
+
+    const globalOption = screen.getByRole("option", { name: "Global" });
+    expect(globalOption).toHaveValue("global");
+    expect(
+      screen.getByRole("option", { name: "us-east-1" }),
+    ).toBeInTheDocument();
+  });
+});
diff --git a/ui/components/graphs/threat-map.tsx b/ui/components/graphs/threat-map.tsx
index 42b44aa8d1..b73f81336c 100644
--- a/ui/components/graphs/threat-map.tsx
+++ b/ui/components/graphs/threat-map.tsx
@@ -124,7 +124,11 @@ export function ThreatMap({
     x: number;
     y: number;
   } | null>(null);
-  const [selectedRegion, setSelectedRegion] = useState("All Regions");
+  // With a single region "All Regions" adds nothing, so it starts selected
+  const hasSingleRegion = data.regions.length === 1;
+  const [selectedRegion, setSelectedRegion] = useState(
+    hasSingleRegion ? data.regions[0] : "All Regions",
+  );
   const [worldData, setWorldData] = useState<FeatureCollection | null>(null);
   const [isLoadingMap, setIsLoadingMap] = useState(true);
   const [dimensions, setDimensions] = useState<{
@@ -424,10 +428,12 @@ export function ThreatMap({
                   onChange={(e) => setSelectedRegion(e.target.value)}
                   className="border-border-neutral-primary bg-bg-neutral-secondary text-text-neutral-primary appearance-none rounded-lg border px-4 py-2 pr-10 text-sm focus:outline-none focus-visible:ring-2 focus-visible:ring-offset-2"
                 >
-                  <option value="All Regions">All Regions</option>
+                  {!hasSingleRegion && (
+                    <option value="All Regions">All Regions</option>
+                  )}
                   {sortedRegions.map((region) => (
                     <option key={region} value={region}>
-                      {region}
+                      {region.toLowerCase() === "global" ? "Global" : region}
                     </option>
                   ))}
                 </select>
@@ -467,7 +473,7 @@ export function ThreatMap({
                   <div className="border-border-neutral-primary bg-bg-neutral-secondary absolute bottom-4 left-4 flex items-center gap-2 rounded-full border px-3 py-1.5">
                     <div
                       aria-hidden="true"
-                      className="bg-data-critical h-3 w-3 rounded"
+                      className="bg-bg-data-critical h-3 w-3 rounded"
                     />
                     <span className="text-text-neutral-primary text-sm font-medium">
                       {locationCount} Locations
diff --git a/ui/components/icons/Icons.tsx b/ui/components/icons/Icons.tsx
index eb746e8e83..4fc61dec6b 100644
--- a/ui/components/icons/Icons.tsx
+++ b/ui/components/icons/Icons.tsx
@@ -1322,69 +1322,3 @@ export const BellIcon: React.FC<IconSvgProps> = ({
     </svg>
   );
 };
-
-export const SidebarExpandIcon: React.FC<IconSvgProps> = ({
-  size = 24,
-  width,
-  height,
-  ...props
-}) => {
-  return (
-    <svg
-      xmlns="http://www.w3.org/2000/svg"
-      width={size || width}
-      height={size || height}
-      viewBox="0 0 24 24"
-      fill="none"
-      {...props}
-    >
-      <path
-        d="M19 21H5C4.46957 21 3.96086 20.7893 3.58579 20.4142C3.21071 20.0391 3 19.5304 3 19V5C3 4.46957 3.21071 3.96086 3.58579 3.58579C3.96086 3.21071 4.46957 3 5 3H19C19.5304 3 20.0391 3.21071 20.4142 3.58579C20.7893 3.96086 21 4.46957 21 5V19C21 19.5304 20.7893 20.0391 20.4142 20.4142C20.0391 20.7893 19.5304 21 19 21Z"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
-      <path
-        d="M7.25 10L5.5 12L7.25 14M9.5 21V3"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
-    </svg>
-  );
-};
-
-export const SidebarCollapseIcon: React.FC<IconSvgProps> = ({
-  size = 24,
-  width,
-  height,
-  ...props
-}) => {
-  return (
-    <svg
-      xmlns="http://www.w3.org/2000/svg"
-      width={size || width}
-      height={size || height}
-      viewBox="0 0 24 24"
-      fill="none"
-      {...props}
-    >
-      <path
-        d="M19 21H5C4.46957 21 3.96086 20.7893 3.58579 20.4142C3.21071 20.0391 3 19.5304 3 19V5C3 4.46957 3.21071 3.96086 3.58579 3.58579C3.96086 3.21071 4.46957 3 5 3H19C19.5304 3 20.0391 3.21071 20.4142 3.58579C20.7893 3.96086 21 4.46957 21 5V19C21 19.5304 20.7893 20.0391 20.4142 20.4142C20.0391 20.7893 19.5304 21 19 21Z"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
-      <path
-        d="M16.75 10L18.5 12L16.75 14M14.5 21V3"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
-    </svg>
-  );
-};
diff --git a/ui/components/icons/compliance/IconCompliance.test.ts b/ui/components/icons/compliance/IconCompliance.test.ts
index ca5f5a363e..b956b80548 100644
--- a/ui/components/icons/compliance/IconCompliance.test.ts
+++ b/ui/components/icons/compliance/IconCompliance.test.ts
@@ -58,6 +58,12 @@ describe("getComplianceIcon", () => {
       expect(getComplianceIcon("prowler_threatscore_aws")).toBe(threatLogo);
     });
 
+    it("resolves the Okta IDaaS STIG via the `okta` keyword", () => {
+      const oktaLogo = getComplianceIcon("Okta-IDaaS-STIG");
+      expect(oktaLogo).toBeDefined();
+      expect(getComplianceIcon("okta_idaas_stig_v1r2_okta")).toBe(oktaLogo);
+    });
+
     it("resolves ASD Essential Eight by the framework keyword, not by `aws`", () => {
       const essentialLogo = getComplianceIcon("ASD-Essential-Eight");
       expect(essentialLogo).toBeDefined();
diff --git a/ui/components/icons/compliance/IconCompliance.tsx b/ui/components/icons/compliance/IconCompliance.tsx
index d9e7d0ce1c..6723fe8a95 100644
--- a/ui/components/icons/compliance/IconCompliance.tsx
+++ b/ui/components/icons/compliance/IconCompliance.tsx
@@ -6,6 +6,7 @@ import CCCLogo from "./ccc.svg";
 import CISLogo from "./cis.svg";
 import CISALogo from "./cisa.svg";
 import CSALogo from "./csa.svg";
+import DORALogo from "./dora.svg";
 import ENSLogo from "./ens.png";
 import FedRAMPLogo from "./fedramp.svg";
 import FFIECLogo from "./ffiec.svg";
@@ -17,6 +18,7 @@ import KISALogo from "./kisa.svg";
 import MITRELogo from "./mitre-attack.svg";
 import NIS2Logo from "./nis2.svg";
 import NISTLogo from "./nist.svg";
+import OktaLogo from "./okta.svg";
 import PCILogo from "./pci-dss.svg";
 import PROWLERTHREATLogo from "./prowlerThreat.svg";
 import RBILogo from "./rbi.svg";
@@ -67,7 +69,12 @@ const COMPLIANCE_LOGOS = [
   ["c5", C5Logo],
   ["ccc", CCCLogo],
   ["csa", CSALogo],
+  // DORA — universal framework (`prowler/compliance/dora_2022_2554.json`).
+  // The compliance_id is `dora_2022_2554`; the `dora` keyword still matches
+  // it via `includes`, with no provider suffix.
+  ["dora", DORALogo],
   ["secnumcloud", ANSSILogo],
+  ["okta", OktaLogo],
   ["aws", AWSLogo],
 ] as const;
 
diff --git a/ui/components/icons/compliance/dora.svg b/ui/components/icons/compliance/dora.svg
new file mode 100644
index 0000000000..8ba02e218f
--- /dev/null
+++ b/ui/components/icons/compliance/dora.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 400 170" fill="none">
+  <defs>
+    <linearGradient id="doraGradient" x1="0%" y1="0%" x2="100%" y2="0%">
+      <stop offset="0%" style="stop-color:#003399"/>
+      <stop offset="100%" style="stop-color:#0055A5"/>
+    </linearGradient>
+  </defs>
+  <g>
+    <rect x="0" y="20" width="400" height="130" rx="16" fill="url(#doraGradient)"/>
+    <text x="200" y="100" font-family="Helvetica, Arial, sans-serif" font-size="76" font-weight="700" fill="#FFFFFF" text-anchor="middle" letter-spacing="6">DORA</text>
+    <text x="200" y="135" font-family="Helvetica, Arial, sans-serif" font-size="14" font-weight="500" fill="#FFD700" text-anchor="middle" letter-spacing="3">EU 2022/2554</text>
+  </g>
+</svg>
diff --git a/ui/components/icons/compliance/okta.svg b/ui/components/icons/compliance/okta.svg
new file mode 100644
index 0000000000..91b8acbb20
--- /dev/null
+++ b/ui/components/icons/compliance/okta.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 63 63" width="40" height="40"><path fill="#00297A" d="M34.6,0.4l-1.3,16c-0.6-0.1-1.2-0.1-1.9-0.1c-0.8,0-1.6,0.1-2.3,0.2l-0.7-7.7c0-0.2,0.2-0.5,0.4-0.5h1.3l-0.6-7.8c0-0.2,0.2-0.5,0.4-0.5h4.3C34.5,0,34.7,0.2,34.6,0.4L34.6,0.4L34.6,0.4z M23.8,1.2c-0.1-0.2-0.3-0.4-0.5-0.3l-4,1.5C19,2.5,18.9,2.8,19,3l3.3,7.1l-1.2,0.5c-0.2,0.1-0.3,0.3-0.2,0.6l3.3,7c1.2-0.7,2.5-1.2,3.9-1.5L23.8,1.2L23.8,1.2z M14,5.7l9.3,13.1c-1.2,0.8-2.2,1.7-3.1,2.7L14.5,16c-0.2-0.2-0.2-0.5,0-0.6l1-0.8L10,9c-0.2-0.2-0.2-0.5,0-0.6l3.3-2.7C13.5,5.4,13.8,5.5,14,5.7L14,5.7z M6.2,13.2c-0.2-0.1-0.5-0.1-0.6,0.1l-2.1,3.7c-0.1,0.2,0,0.5,0.2,0.6l7.1,3.4l-0.7,1.1c-0.1,0.2,0,0.5,0.2,0.6l7.1,3.2c0.5-1.3,1.2-2.5,2-3.6L6.2,13.2z M0.9,23.3c0-0.2,0.3-0.4,0.5-0.3l15.5,4c-0.4,1.3-0.6,2.7-0.7,4.1l-7.8-0.6c-0.2,0-0.4-0.2-0.4-0.5l0.2-1.3L0.6,28c-0.2,0-0.4-0.2-0.4-0.5L0.9,23.3L0.9,23.3L0.9,23.3z M0.4,33.8C0.1,33.8,0,34,0,34.3l0.8,4.2c0,0.2,0.3,0.4,0.5,0.3l7.6-2l0.2,1.3c0,0.2,0.3,0.4,0.5,0.3l7.5-2.1c-0.4-1.3-0.7-2.7-0.8-4.1L0.4,33.8L0.4,33.8z M2.9,44.9c-0.1-0.2,0-0.5,0.2-0.6l14.5-6.9c0.5,1.3,1.3,2.5,2.2,3.6l-6.3,4.5c-0.2,0.1-0.5,0.1-0.6-0.1L12,44.3l-6.5,4.5c-0.2,0.1-0.5,0.1-0.6-0.1L2.9,44.9L2.9,44.9z M20.4,41.9L9.1,53.3c-0.2,0.2-0.2,0.5,0,0.6l3.3,2.7c0.2,0.2,0.5,0.1,0.6-0.1l4.6-6.4l1,0.9c0.2,0.2,0.5,0.1,0.6-0.1l4.4-6.4C22.4,43.8,21.3,42.9,20.4,41.9L20.4,41.9z M18.2,60.1c-0.2-0.1-0.3-0.3-0.2-0.6L24.6,45c1.2,0.6,2.6,1.1,3.9,1.4l-2,7.5c-0.1,0.2-0.3,0.4-0.5,0.3l-1.2-0.5l-2.1,7.6c-0.1,0.2-0.3,0.4-0.5,0.3L18.2,60.1L18.2,60.1L18.2,60.1z M29.6,46.6l-1.3,16c0,0.2,0.2,0.5,0.4,0.5H33c0.2,0,0.4-0.2,0.4-0.5l-0.6-7.8h1.3c0.2,0,0.4-0.2,0.4-0.5l-0.7-7.7c-0.8,0.1-1.5,0.2-2.3,0.2C30.9,46.7,30.2,46.7,29.6,46.6L29.6,46.6z M45.1,3.4c0.1-0.2,0-0.5-0.2-0.6l-4-1.5c-0.2-0.1-0.5,0.1-0.5,0.3l-2.1,7.6l-1.2-0.5c-0.2-0.1-0.5,0.1-0.5,0.3l-2,7.5c1.4,0.3,2.7,0.8,3.9,1.4L45.1,3.4L45.1,3.4z M53.9,9.7L42.6,21.1c-0.9-1-2-1.9-3.2-2.6l4.4-6.4c0.1-0.2,0.4-0.2,0.6-0.1l1,0.9l4.6-6.4c0.1-0.2,0.4-0.2,0.6-0.1l3.3,2.7C54,9.3,54,9.6,53.9,9.7L53.9,9.7z M59.9,18.7c0.2-0.1,0.3-0.4,0.2-0.6L58,14.4c-0.1-0.2-0.4-0.3-0.6-0.1l-6.5,4.5l-0.7-1.1c-0.1-0.2-0.4-0.3-0.6-0.1L43.3,22c0.9,1.1,1.6,2.3,2.2,3.6L59.9,18.7L59.9,18.7z M62.2,24.5l0.7,4.2c0,0.2-0.1,0.5-0.4,0.5l-15.9,1.5c-0.1-1.4-0.4-2.8-0.8-4.1l7.5-2.1c0.2-0.1,0.5,0.1,0.5,0.3l0.2,1.3l7.6-2C61.9,24.1,62.1,24.3,62.2,24.5L62.2,24.5L62.2,24.5z M61.5,40c0.2,0.1,0.5-0.1,0.5-0.3l0.7-4.2c0-0.2-0.1-0.5-0.4-0.5l-7.8-0.7l0.2-1.3c0-0.2-0.1-0.5-0.4-0.5l-7.8-0.6c0,1.4-0.3,2.8-0.7,4.1L61.5,40L61.5,40L61.5,40z M57.4,49.6c-0.1,0.2-0.4,0.3-0.6,0.1l-13.2-9.1c0.8-1.1,1.5-2.3,2-3.6l7.1,3.2c0.2,0.1,0.3,0.4,0.2,0.6L52.2,42l7.1,3.4c0.2,0.1,0.3,0.4,0.2,0.6L57.4,49.6C57.4,49.6,57.4,49.6,57.4,49.6z M39.7,44.2L49,57.3c0.1,0.2,0.4,0.2,0.6,0.1l3.3-2.7c0.2-0.2,0.2-0.4,0-0.6l-5.5-5.6l1-0.8c0.2-0.2,0.2-0.4,0-0.6l-5.5-5.5C42,42.6,40.9,43.5,39.7,44.2L39.7,44.2L39.7,44.2z M39.7,62c-0.2,0.1-0.5-0.1-0.5-0.3l-4.2-15.4c1.4-0.3,2.7-0.8,3.9-1.5l3.3,7c0.1,0.2,0,0.5-0.2,0.6l-1.2,0.5l3.3,7.1c0.1,0.2,0,0.5-0.2,0.6L39.7,62L39.7,62L39.7,62z"/></svg>
diff --git a/ui/components/icons/providers-badge/provider-type-icon.test.tsx b/ui/components/icons/providers-badge/provider-type-icon.test.tsx
new file mode 100644
index 0000000000..96b4f5f4d4
--- /dev/null
+++ b/ui/components/icons/providers-badge/provider-type-icon.test.tsx
@@ -0,0 +1,126 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import type { ProviderType } from "@/types/providers";
+
+import { ProviderTypeIcon, ProviderTypeIconStack } from "./provider-type-icon";
+
+// A provider type the API may return but this UI build does not know about.
+const UNKNOWN_TYPE = "future-provider" as unknown as ProviderType;
+
+// Render the lazy provider badges as plain text so we can assert on them.
+vi.mock("@/components/icons/providers-badge", () => ({
+  AWSProviderBadge: () => <span>AWS</span>,
+  AzureProviderBadge: () => <span>Azure</span>,
+  GCPProviderBadge: () => <span>GCP</span>,
+  KS8ProviderBadge: () => <span>Kubernetes</span>,
+  M365ProviderBadge: () => <span>M365</span>,
+  GitHubProviderBadge: () => <span>GitHub</span>,
+  GoogleWorkspaceProviderBadge: () => <span>Google Workspace</span>,
+  IacProviderBadge: () => <span>IaC</span>,
+  ImageProviderBadge: () => <span>Image</span>,
+  OracleCloudProviderBadge: () => <span>Oracle Cloud</span>,
+  MongoDBAtlasProviderBadge: () => <span>MongoDB Atlas</span>,
+  AlibabaCloudProviderBadge: () => <span>Alibaba Cloud</span>,
+  CloudflareProviderBadge: () => <span>Cloudflare</span>,
+  OpenStackProviderBadge: () => <span>OpenStack</span>,
+  VercelProviderBadge: () => <span>Vercel</span>,
+  OktaProviderBadge: () => <span>Okta</span>,
+}));
+
+// Render the tooltip pieces inline so the hover content is queryable in jsdom.
+vi.mock("@/components/shadcn", () => ({
+  Badge: ({ children }: { children: React.ReactNode }) => (
+    <span data-testid="badge">{children}</span>
+  ),
+  Tooltip: ({ children }: { children: React.ReactNode }) => <>{children}</>,
+  TooltipTrigger: ({ children }: { children: React.ReactNode }) => (
+    <>{children}</>
+  ),
+  TooltipContent: ({ children }: { children: React.ReactNode }) => (
+    <span data-testid="tooltip">{children}</span>
+  ),
+}));
+
+describe("ProviderTypeIcon", () => {
+  it("renders the badge for the given provider type", async () => {
+    render(<ProviderTypeIcon type="aws" />);
+
+    expect(await screen.findByText("AWS")).toBeInTheDocument();
+  });
+
+  it("renders a sized placeholder instead of crashing for an unknown type", () => {
+    // Regression guard for #9991: an unknown provider type must not throw.
+    const { container } = render(
+      <ProviderTypeIcon type={UNKNOWN_TYPE} size={24} />,
+    );
+
+    expect(screen.queryByText("AWS")).not.toBeInTheDocument();
+    expect(container.querySelector("div")).toHaveStyle({
+      width: "24px",
+      height: "24px",
+    });
+  });
+});
+
+describe("ProviderTypeIconStack", () => {
+  it("renders one icon per item without deduping by type", async () => {
+    render(
+      <ProviderTypeIconStack
+        items={[
+          { key: "a", type: "aws", tooltip: "111" },
+          { key: "b", type: "aws", tooltip: "222" },
+        ]}
+      />,
+    );
+
+    // Two AWS accounts -> two AWS icons (no dedupe).
+    expect(await screen.findAllByText("AWS")).toHaveLength(2);
+  });
+
+  it("shows each item's tooltip text on the icon", async () => {
+    render(
+      <ProviderTypeIconStack
+        items={[{ key: "a", type: "aws", tooltip: "account-uid-123" }]}
+      />,
+    );
+
+    expect(await screen.findByTestId("tooltip")).toHaveTextContent(
+      "account-uid-123",
+    );
+  });
+
+  it("collapses items beyond `max` into a +N badge", async () => {
+    render(
+      <ProviderTypeIconStack
+        max={3}
+        items={[
+          { key: "a", type: "aws", tooltip: "1" },
+          { key: "b", type: "azure", tooltip: "2" },
+          { key: "c", type: "gcp", tooltip: "3" },
+          { key: "d", type: "github", tooltip: "4" },
+          { key: "e", type: "okta", tooltip: "5" },
+        ]}
+      />,
+    );
+
+    expect(await screen.findByTestId("badge")).toHaveTextContent("+2");
+    // First icon is shown; items sliced beyond `max` never reach the DOM.
+    expect(await screen.findByText("AWS")).toBeInTheDocument();
+    expect(screen.queryByText("Okta")).not.toBeInTheDocument();
+  });
+
+  it("renders known icons and skips unknown types without crashing", async () => {
+    // Regression guard for #9991: an unknown type in the stack must not throw.
+    render(
+      <ProviderTypeIconStack
+        items={[
+          { key: "a", type: "aws", tooltip: "111" },
+          { key: "b", type: UNKNOWN_TYPE, tooltip: "222" },
+        ]}
+      />,
+    );
+
+    expect(await screen.findByText("AWS")).toBeInTheDocument();
+  });
+});
diff --git a/ui/components/icons/providers-badge/provider-type-icon.tsx b/ui/components/icons/providers-badge/provider-type-icon.tsx
new file mode 100644
index 0000000000..c3915f7d40
--- /dev/null
+++ b/ui/components/icons/providers-badge/provider-type-icon.tsx
@@ -0,0 +1,250 @@
+"use client";
+
+import { type ComponentType, lazy, Suspense } from "react";
+
+import {
+  Badge,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/shadcn";
+import { cn } from "@/lib/utils";
+import type { ProviderType } from "@/types/providers";
+
+type IconProps = { width: number; height: number };
+
+const IconPlaceholder = ({ width, height }: IconProps) => (
+  <div style={{ width, height }} />
+);
+
+// Lazy-load every provider badge so the ~16 SVGs ship in a single deferred
+// chunk instead of being eagerly bundled wherever a selector is imported.
+const AWSProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.AWSProviderBadge,
+  })),
+);
+const AzureProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.AzureProviderBadge,
+  })),
+);
+const GCPProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.GCPProviderBadge,
+  })),
+);
+const KS8ProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.KS8ProviderBadge,
+  })),
+);
+const M365ProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.M365ProviderBadge,
+  })),
+);
+const GitHubProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.GitHubProviderBadge,
+  })),
+);
+const GoogleWorkspaceProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.GoogleWorkspaceProviderBadge,
+  })),
+);
+const IacProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.IacProviderBadge,
+  })),
+);
+const ImageProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.ImageProviderBadge,
+  })),
+);
+const OracleCloudProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.OracleCloudProviderBadge,
+  })),
+);
+const MongoDBAtlasProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.MongoDBAtlasProviderBadge,
+  })),
+);
+const AlibabaCloudProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.AlibabaCloudProviderBadge,
+  })),
+);
+const CloudflareProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.CloudflareProviderBadge,
+  })),
+);
+const OpenStackProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.OpenStackProviderBadge,
+  })),
+);
+const VercelProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.VercelProviderBadge,
+  })),
+);
+const OktaProviderBadge = lazy(() =>
+  import("@/components/icons/providers-badge").then((m) => ({
+    default: m.OktaProviderBadge,
+  })),
+);
+
+/**
+ * Single source of truth mapping each provider type to its human-readable
+ * label and (lazy) badge component. Shared by the account and provider-type
+ * selectors so both stay in sync on labels, icons, and sizing.
+ */
+export const PROVIDER_TYPE_DATA: Record<
+  ProviderType,
+  { label: string; icon: ComponentType<IconProps> }
+> = {
+  aws: { label: "Amazon Web Services", icon: AWSProviderBadge },
+  azure: { label: "Microsoft Azure", icon: AzureProviderBadge },
+  gcp: { label: "Google Cloud Platform", icon: GCPProviderBadge },
+  kubernetes: { label: "Kubernetes", icon: KS8ProviderBadge },
+  m365: { label: "Microsoft 365", icon: M365ProviderBadge },
+  github: { label: "GitHub", icon: GitHubProviderBadge },
+  googleworkspace: {
+    label: "Google Workspace",
+    icon: GoogleWorkspaceProviderBadge,
+  },
+  iac: { label: "Infrastructure as Code", icon: IacProviderBadge },
+  image: { label: "Container Registry", icon: ImageProviderBadge },
+  oraclecloud: {
+    label: "Oracle Cloud Infrastructure",
+    icon: OracleCloudProviderBadge,
+  },
+  mongodbatlas: { label: "MongoDB Atlas", icon: MongoDBAtlasProviderBadge },
+  alibabacloud: { label: "Alibaba Cloud", icon: AlibabaCloudProviderBadge },
+  cloudflare: { label: "Cloudflare", icon: CloudflareProviderBadge },
+  openstack: { label: "OpenStack", icon: OpenStackProviderBadge },
+  vercel: { label: "Vercel", icon: VercelProviderBadge },
+  okta: { label: "Okta", icon: OktaProviderBadge },
+};
+
+interface ProviderTypeIconProps {
+  type: ProviderType;
+  size?: number;
+}
+
+/**
+ * Renders a single provider-type badge with a sized placeholder fallback.
+ *
+ * Falls back to the placeholder for provider types missing from
+ * `PROVIDER_TYPE_DATA` (e.g. a brand-new provider the API knows but this UI
+ * build does not). The `type` is statically typed as `ProviderType`, so this
+ * only guards the runtime case — see #9991, which fixed the same crash class.
+ */
+export const ProviderTypeIcon = ({
+  type,
+  size = 18,
+}: ProviderTypeIconProps) => {
+  const data = PROVIDER_TYPE_DATA[type];
+  if (!data) return <IconPlaceholder width={size} height={size} />;
+
+  const Icon = data.icon;
+  return (
+    <Suspense fallback={<IconPlaceholder width={size} height={size} />}>
+      <Icon width={size} height={size} />
+    </Suspense>
+  );
+};
+
+export interface ProviderTypeIconStackItem {
+  /** Stable React key (account id for accounts, provider type for types). */
+  key: string;
+  type: ProviderType;
+  /** Text shown on hover to disambiguate the icon (e.g. an account UID). */
+  tooltip?: string;
+}
+
+interface ProviderTypeIconStackProps {
+  items: ProviderTypeIconStackItem[];
+  max?: number;
+  size?: number;
+  className?: string;
+}
+
+/**
+ * Icon with a hover tooltip. `TooltipContent` (shadcn) already renders inside a
+ * Radix portal, so the tooltip is not clipped by the selector trigger and we do
+ * not need to portal it ourselves. `delayDuration` is set on the tooltip itself
+ * because shadcn's `Tooltip` wraps each instance in its own `TooltipProvider`
+ * (delay 0), which would otherwise override an ancestor provider's delay.
+ */
+const IconWithTooltip = ({
+  item,
+  size,
+}: {
+  item: ProviderTypeIconStackItem;
+  size: number;
+}) => {
+  const icon = (
+    <span className="inline-flex shrink-0">
+      <ProviderTypeIcon type={item.type} size={size} />
+    </span>
+  );
+
+  if (!item.tooltip) return icon;
+
+  return (
+    <Tooltip delayDuration={150}>
+      <TooltipTrigger asChild>{icon}</TooltipTrigger>
+      <TooltipContent side="top">{item.tooltip}</TooltipContent>
+    </Tooltip>
+  );
+};
+
+/**
+ * Renders up to `max` provider-type icons followed by a `+N` badge for the
+ * remainder. Each icon shows its `tooltip` on hover. Items are rendered as
+ * passed (one per selection) — callers decide whether to dedupe.
+ */
+export const ProviderTypeIconStack = ({
+  items,
+  max = 3,
+  size = 18,
+  className,
+}: ProviderTypeIconStackProps) => {
+  const visible = items.slice(0, max);
+  const overflow = items.slice(max);
+  const overflowLabel = overflow
+    .map((item) => item.tooltip)
+    .filter(Boolean)
+    .join(", ");
+
+  return (
+    <span className={cn("flex shrink-0 items-center gap-1", className)}>
+      <span className="flex items-center gap-1">
+        {visible.map((item) => (
+          <IconWithTooltip key={item.key} item={item} size={size} />
+        ))}
+      </span>
+      {overflow.length > 0 && (
+        <Tooltip delayDuration={150}>
+          <TooltipTrigger asChild>
+            <Badge variant="tag" className="px-1.5 py-0.5 text-xs font-medium">
+              +{overflow.length}
+            </Badge>
+          </TooltipTrigger>
+          {overflowLabel && (
+            <TooltipContent side="top" className="max-w-xs">
+              {overflowLabel}
+            </TooltipContent>
+          )}
+        </Tooltip>
+      )}
+    </span>
+  );
+};
diff --git a/ui/components/integrations/s3/s3-integration-form.tsx b/ui/components/integrations/s3/s3-integration-form.tsx
index 7b3af4b018..23be644570 100644
--- a/ui/components/integrations/s3/s3-integration-form.tsx
+++ b/ui/components/integrations/s3/s3-integration-form.tsx
@@ -8,7 +8,10 @@ import { useState } from "react";
 import { Control, useForm } from "react-hook-form";
 
 import { createIntegration, updateIntegration } from "@/actions/integrations";
-import { PROVIDER_ICONS } from "@/components/findings/table/provider-icon-cell";
+import {
+  PROVIDER_TYPE_DATA,
+  ProviderTypeIcon,
+} from "@/components/icons/providers-badge/provider-type-icon";
 import { AWSRoleCredentialsForm } from "@/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-form";
 import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
 import { useToast } from "@/components/ui";
@@ -279,11 +282,14 @@ export const S3IntegrationForm = ({
     // Show configuration step (step 0 or editing configuration)
     if (isEditingConfig || currentStep === 0) {
       const providerOptions = providers.map((provider) => {
-        const Icon = PROVIDER_ICONS[provider.attributes.provider];
+        const providerType = provider.attributes.provider;
         return {
           value: provider.id,
           label: provider.attributes.alias || provider.attributes.uid,
-          icon: Icon ? <Icon width={20} height={20} /> : undefined,
+          icon:
+            providerType in PROVIDER_TYPE_DATA ? (
+              <ProviderTypeIcon type={providerType} size={20} />
+            ) : undefined,
           description: provider.attributes.connection.connected
             ? "Connected"
             : "Disconnected",
diff --git a/ui/components/integrations/saml/saml-config-form.tsx b/ui/components/integrations/saml/saml-config-form.tsx
index a995fffceb..935f5412e9 100644
--- a/ui/components/integrations/saml/saml-config-form.tsx
+++ b/ui/components/integrations/saml/saml-config-form.tsx
@@ -18,7 +18,7 @@ import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
 import { CustomServerInput } from "@/components/ui/custom";
 import { CustomLink } from "@/components/ui/custom/custom-link";
 import { FormButtons } from "@/components/ui/form";
-import { apiBaseUrl } from "@/lib";
+import { useRuntimeConfig } from "@/hooks/use-runtime-config";
 
 const validateXMLContent = (
   xmlContent: string,
@@ -253,10 +253,12 @@ export const SamlConfigForm = ({
     reader.readAsText(file);
   };
 
+  const { apiBaseUrl } = useRuntimeConfig();
   const trimmedEmailDomain = emailDomain.trim();
-  const acsUrl = trimmedEmailDomain
-    ? `${apiBaseUrl}/accounts/saml/${trimmedEmailDomain}/acs/`
-    : "";
+  const acsUrl =
+    trimmedEmailDomain && apiBaseUrl
+      ? `${apiBaseUrl}/accounts/saml/${trimmedEmailDomain}/acs/`
+      : "";
 
   return (
     <form
diff --git a/ui/components/integrations/security-hub/security-hub-integration-form.tsx b/ui/components/integrations/security-hub/security-hub-integration-form.tsx
index 8a62f62457..1c3b436832 100644
--- a/ui/components/integrations/security-hub/security-hub-integration-form.tsx
+++ b/ui/components/integrations/security-hub/security-hub-integration-form.tsx
@@ -10,7 +10,10 @@ import { useEffect, useState } from "react";
 import { Control, useForm } from "react-hook-form";
 
 import { createIntegration, updateIntegration } from "@/actions/integrations";
-import { PROVIDER_ICONS } from "@/components/findings/table/provider-icon-cell";
+import {
+  PROVIDER_TYPE_DATA,
+  ProviderTypeIcon,
+} from "@/components/icons/providers-badge/provider-type-icon";
 import { AWSRoleCredentialsForm } from "@/components/providers/workflow/forms/select-credentials-type/aws/credentials-type/aws-role-credentials-form";
 import { EnhancedMultiSelect } from "@/components/shadcn/select/enhanced-multi-select";
 import { useToast } from "@/components/ui";
@@ -121,11 +124,14 @@ export const SecurityHubIntegrationForm = ({
         ? "Connected"
         : "Disconnected";
 
-      const Icon = PROVIDER_ICONS[provider.attributes.provider];
+      const providerType = provider.attributes.provider;
       return {
         value: provider.id,
         label: provider.attributes.alias || provider.attributes.uid,
-        icon: Icon ? <Icon width={20} height={20} /> : undefined,
+        icon:
+          providerType in PROVIDER_TYPE_DATA ? (
+            <ProviderTypeIcon type={providerType} size={20} />
+          ) : undefined,
         description: isDisabled
           ? `${connectionLabel} (Already in use)`
           : connectionLabel,
diff --git a/ui/components/onboarding/__tests__/onboarding-checkpoint-dialog.test.tsx b/ui/components/onboarding/__tests__/onboarding-checkpoint-dialog.test.tsx
new file mode 100644
index 0000000000..dfaf6bb676
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-checkpoint-dialog.test.tsx
@@ -0,0 +1,109 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { OnboardingCheckpointDialog } from "../onboarding-checkpoint-dialog";
+
+describe("OnboardingCheckpointDialog", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("when open", () => {
+    it("shows the checkpoint title and both choices", () => {
+      render(
+        <OnboardingCheckpointDialog
+          open
+          onContinue={vi.fn()}
+          onFinish={vi.fn()}
+        />,
+      );
+
+      expect(
+        screen.getByText("Provider added — keep exploring?"),
+      ).toBeInTheDocument();
+      expect(
+        screen.getByText(/Your first provider is added\./),
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole("button", { name: /continue the tour/i }),
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole("button", { name: /finish here/i }),
+      ).toBeInTheDocument();
+    });
+
+    it("calls onContinue when the primary button is clicked", async () => {
+      const user = userEvent.setup();
+      const onContinue = vi.fn();
+      const onFinish = vi.fn();
+      render(
+        <OnboardingCheckpointDialog
+          open
+          onContinue={onContinue}
+          onFinish={onFinish}
+        />,
+      );
+
+      await user.click(
+        screen.getByRole("button", { name: /continue the tour/i }),
+      );
+
+      expect(onContinue).toHaveBeenCalledTimes(1);
+      expect(onFinish).not.toHaveBeenCalled();
+    });
+
+    it("calls onFinish when the outline button is clicked", async () => {
+      const user = userEvent.setup();
+      const onContinue = vi.fn();
+      const onFinish = vi.fn();
+      render(
+        <OnboardingCheckpointDialog
+          open
+          onContinue={onContinue}
+          onFinish={onFinish}
+        />,
+      );
+
+      await user.click(screen.getByRole("button", { name: /finish here/i }));
+
+      expect(onFinish).toHaveBeenCalledTimes(1);
+      expect(onContinue).not.toHaveBeenCalled();
+    });
+
+    it("treats Escape (overlay/X dismiss) as finish", async () => {
+      const user = userEvent.setup();
+      const onContinue = vi.fn();
+      const onFinish = vi.fn();
+      render(
+        <OnboardingCheckpointDialog
+          open
+          onContinue={onContinue}
+          onFinish={onFinish}
+        />,
+      );
+
+      await user.keyboard("{Escape}");
+
+      // Escape/overlay dismiss must route to onFinish, not onContinue.
+      await waitFor(() => expect(onFinish).toHaveBeenCalledTimes(1));
+      expect(onContinue).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when closed", () => {
+    it("renders nothing", () => {
+      render(
+        <OnboardingCheckpointDialog
+          open={false}
+          onContinue={vi.fn()}
+          onFinish={vi.fn()}
+        />,
+      );
+
+      expect(
+        screen.queryByText("Provider added — keep exploring?"),
+      ).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-checkpoint-watcher.test.tsx b/ui/components/onboarding/__tests__/onboarding-checkpoint-watcher.test.tsx
new file mode 100644
index 0000000000..f30fca862d
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-checkpoint-watcher.test.tsx
@@ -0,0 +1,112 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getFlowById } from "@/lib/onboarding";
+
+import { OnboardingCheckpointWatcher } from "../onboarding-checkpoint-watcher";
+
+const pushMock = vi.fn();
+const startSequenceMock = vi.fn();
+const closeMock = vi.fn();
+
+const CHECKPOINT_MARKER = "prowler.onboarding.checkpoint";
+
+// Tests set this before render to control the store `open` flag the watcher subscribes to.
+let checkpointOpenState = false;
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: pushMock }),
+}));
+
+vi.mock("@/store/onboarding-sequence", () => ({
+  useOnboardingSequenceStore: {
+    getState: () => ({ startSequence: startSequenceMock }),
+  },
+}));
+
+vi.mock("@/store/onboarding-checkpoint", () => ({
+  CHECKPOINT_MARKER: "prowler.onboarding.checkpoint",
+  useOnboardingCheckpointStore: Object.assign(
+    (selector: (state: { open: boolean }) => unknown) =>
+      selector({ open: checkpointOpenState }),
+    {
+      getState: () => ({ close: closeMock }),
+    },
+  ),
+}));
+
+describe("OnboardingCheckpointWatcher", () => {
+  beforeEach(() => {
+    pushMock.mockClear();
+    startSequenceMock.mockClear();
+    closeMock.mockClear();
+    checkpointOpenState = false;
+    window.localStorage.clear();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("rendering", () => {
+    it("renders the dialog when the store open flag is true", () => {
+      checkpointOpenState = true;
+      render(<OnboardingCheckpointWatcher />);
+
+      expect(
+        screen.getByText("Provider added — keep exploring?"),
+      ).toBeInTheDocument();
+    });
+
+    it("does not render the dialog when the store open flag is false", () => {
+      checkpointOpenState = false;
+      render(<OnboardingCheckpointWatcher />);
+
+      expect(
+        screen.queryByText("Provider added — keep exploring?"),
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe("when the user continues the tour", () => {
+    it("marks handled, starts the sequence at the next flow, navigates, and closes the store", async () => {
+      const user = userEvent.setup();
+      checkpointOpenState = true;
+      render(<OnboardingCheckpointWatcher />);
+      await screen.findByText("Provider added — keep exploring?");
+
+      await user.click(
+        screen.getByRole("button", { name: /continue the tour/i }),
+      );
+
+      const nextFlow = getFlowById("view-first-scan");
+      expect(window.localStorage.getItem(CHECKPOINT_MARKER)).not.toBeNull();
+      expect(closeMock).toHaveBeenCalledTimes(1);
+      if (nextFlow) {
+        expect(startSequenceMock).toHaveBeenCalledWith(nextFlow.id);
+        expect(pushMock).toHaveBeenCalledWith(nextFlow.route);
+      } else {
+        // Guard: registry is still add-provider-only.
+        expect(startSequenceMock).not.toHaveBeenCalled();
+        expect(pushMock).not.toHaveBeenCalled();
+      }
+    });
+  });
+
+  describe("when the user finishes here", () => {
+    it("marks handled, starts no sequence, does not navigate, and closes the store", async () => {
+      const user = userEvent.setup();
+      checkpointOpenState = true;
+      render(<OnboardingCheckpointWatcher />);
+      await screen.findByText("Provider added — keep exploring?");
+
+      await user.click(screen.getByRole("button", { name: /finish here/i }));
+
+      expect(window.localStorage.getItem(CHECKPOINT_MARKER)).not.toBeNull();
+      expect(startSequenceMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+      await waitFor(() => expect(closeMock).toHaveBeenCalledTimes(1));
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-gate.test.tsx b/ui/components/onboarding/__tests__/onboarding-gate.test.tsx
new file mode 100644
index 0000000000..4198ba5846
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-gate.test.tsx
@@ -0,0 +1,185 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { addProviderTour } from "@/lib/tours/add-provider.tour";
+import { localStorageAdapter } from "@/lib/tours/store/local-storage-adapter";
+
+import { OnboardingGate } from "../onboarding-gate";
+
+const pushMock = vi.fn();
+const armMock = vi.fn();
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: pushMock, replace: vi.fn() }),
+}));
+
+vi.mock("@/store/onboarding-checkpoint", () => ({
+  useOnboardingCheckpointStore: {
+    getState: () => ({ arm: armMock }),
+  },
+}));
+
+const addProviderTourId = {
+  id: addProviderTour.id,
+  version: addProviderTour.version,
+};
+
+describe("OnboardingGate", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    pushMock.mockClear();
+    armMock.mockClear();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("when the user has no providers and no completion record", () => {
+    it("shows the Welcome modal", async () => {
+      render(<OnboardingGate hasProviders={false} />);
+
+      expect(
+        await screen.findByRole("button", { name: /get started/i }),
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe("when the user already has providers", () => {
+    it("does not show the Welcome modal", async () => {
+      render(<OnboardingGate hasProviders={true} />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe("when a completion record already exists in this browser", () => {
+    it("does not show the Welcome modal", async () => {
+      localStorageAdapter.set(addProviderTourId, {
+        tourId: addProviderTour.id,
+        version: addProviderTour.version,
+        state: "dismissed",
+        completedAt: new Date().toISOString(),
+      });
+
+      render(<OnboardingGate hasProviders={false} />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe("when the gate flow is dismissed but later sequence flows are incomplete", () => {
+    it("does not show the Welcome modal for a later flow", async () => {
+      // Later flows are only reachable via the checkpoint/sequence, never the gate.
+      localStorageAdapter.set(addProviderTourId, {
+        tourId: addProviderTour.id,
+        version: addProviderTour.version,
+        state: "dismissed",
+        completedAt: new Date().toISOString(),
+      });
+
+      render(<OnboardingGate hasProviders={false} />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe("when hasProviders is undefined (fail-open)", () => {
+    it("does not show the Welcome modal", async () => {
+      // `undefined` mirrors the tri-state layout forwards on a failed provider fetch.
+      render(<OnboardingGate hasProviders={undefined} />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+
+    it("can be mounted with the prop omitted entirely (fail-open)", async () => {
+      render(<OnboardingGate />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe("when the user accepts the Welcome modal", () => {
+    it("navigates to the flow route with the onboarding query param and writes no record", async () => {
+      const user = userEvent.setup();
+      render(<OnboardingGate hasProviders={false} />);
+      const getStarted = await screen.findByRole("button", {
+        name: /get started/i,
+      });
+
+      await user.click(getStarted);
+
+      expect(pushMock).toHaveBeenCalledWith(
+        "/providers?onboarding=add-provider",
+      );
+      expect(localStorageAdapter.get(addProviderTourId)).toBeNull();
+    });
+
+    it("arms the onboarding checkpoint", async () => {
+      const user = userEvent.setup();
+      render(<OnboardingGate hasProviders={false} />);
+      const getStarted = await screen.findByRole("button", {
+        name: /get started/i,
+      });
+
+      await user.click(getStarted);
+
+      expect(armMock).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("when the user dismisses the Welcome modal", () => {
+    it("writes a dismissed record and stops showing the modal", async () => {
+      const user = userEvent.setup();
+      render(<OnboardingGate hasProviders={false} />);
+      const skip = await screen.findByRole("button", {
+        name: /skip for now/i,
+      });
+
+      await user.click(skip);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /skip for now/i }),
+        ).not.toBeInTheDocument();
+      });
+      const record = localStorageAdapter.get(addProviderTourId);
+      expect(record).not.toBeNull();
+      expect(record?.state).toBe("dismissed");
+    });
+
+    it("does NOT arm the onboarding checkpoint", async () => {
+      const user = userEvent.setup();
+      render(<OnboardingGate hasProviders={false} />);
+      const skip = await screen.findByRole("button", {
+        name: /skip for now/i,
+      });
+
+      await user.click(skip);
+
+      // Skipping must never arm the checkpoint (user opted out).
+      expect(armMock).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-sequence-banner.logic.test.ts b/ui/components/onboarding/__tests__/onboarding-sequence-banner.logic.test.ts
new file mode 100644
index 0000000000..71ff8c7fdd
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-sequence-banner.logic.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+
+import type { OnboardingFlow } from "@/lib/onboarding";
+
+import { getSequenceProgress } from "../onboarding-sequence-banner.logic";
+
+// Minimal fixtures — the progress helper only reads id/order/title/route and the optional dataRequirementHint.
+const buildFlow = (overrides: Partial<OnboardingFlow>): OnboardingFlow =>
+  ({
+    id: overrides.id ?? "flow",
+    order: overrides.order ?? 1,
+    title: overrides.title ?? "Title",
+    description: overrides.description ?? "Description",
+    route: overrides.route ?? "/route",
+    tour: overrides.tour ?? { id: "t", version: 1, coversFiles: [], steps: [] },
+    dataRequirementHint: overrides.dataRequirementHint,
+  }) as OnboardingFlow;
+
+const flows: OnboardingFlow[] = [
+  buildFlow({ id: "a", order: 1, title: "First", route: "/a" }),
+  buildFlow({
+    id: "b",
+    order: 2,
+    title: "Second",
+    route: "/b",
+    dataRequirementHint: "needs a scan",
+  }),
+  buildFlow({ id: "c", order: 3, title: "Third", route: "/c" }),
+];
+
+describe("getSequenceProgress", () => {
+  it("computes the index, total, current flow, and next flow for a middle step", () => {
+    const progress = getSequenceProgress("b", flows);
+
+    // 0-based index 1 of 3, current is b, next is c
+    expect(progress).not.toBeNull();
+    expect(progress?.index).toBe(1);
+    expect(progress?.total).toBe(3);
+    expect(progress?.flow.id).toBe("b");
+    expect(progress?.nextFlow?.id).toBe("c");
+  });
+
+  it("returns a null nextFlow on the last step", () => {
+    const progress = getSequenceProgress("c", flows);
+
+    expect(progress?.index).toBe(2);
+    expect(progress?.total).toBe(3);
+    expect(progress?.nextFlow).toBeNull();
+  });
+
+  it("returns null when the currentFlowId is unknown or null", () => {
+    expect(getSequenceProgress("missing", flows)).toBeNull();
+    expect(getSequenceProgress(null, flows)).toBeNull();
+  });
+
+  it("exposes the data requirement hint of the current flow when present", () => {
+    const withHint = getSequenceProgress("b", flows);
+    const withoutHint = getSequenceProgress("a", flows);
+
+    expect(withHint?.flow.dataRequirementHint).toBe("needs a scan");
+    expect(withoutHint?.flow.dataRequirementHint).toBeUndefined();
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-sequence-banner.test.tsx b/ui/components/onboarding/__tests__/onboarding-sequence-banner.test.tsx
new file mode 100644
index 0000000000..6b417e5ed6
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-sequence-banner.test.tsx
@@ -0,0 +1,193 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getFlowById } from "@/lib/onboarding";
+
+import { OnboardingSequenceBanner } from "../onboarding-sequence-banner";
+
+const pushMock = vi.fn();
+const advanceMock = vi.fn();
+const stopMock = vi.fn();
+
+// Mutable snapshot the mocked store hook returns; tests mutate via setSlice().
+let sliceState = {
+  active: false,
+  currentFlowId: null as string | null,
+  advance: advanceMock,
+  stop: stopMock,
+};
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: pushMock }),
+}));
+
+vi.mock("@/store/onboarding-sequence", () => {
+  const hook = (selector: (state: typeof sliceState) => unknown) =>
+    selector(sliceState);
+  hook.getState = () => sliceState;
+  return { useOnboardingSequenceStore: hook };
+});
+
+function setSlice(next: Partial<typeof sliceState>) {
+  sliceState = { ...sliceState, ...next };
+}
+
+describe("OnboardingSequenceBanner", () => {
+  beforeEach(() => {
+    pushMock.mockClear();
+    advanceMock.mockClear();
+    stopMock.mockClear();
+    sliceState = {
+      active: false,
+      currentFlowId: null,
+      advance: advanceMock,
+      stop: stopMock,
+    };
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("renders nothing when the sequence is inactive", () => {
+    const { container } = render(<OnboardingSequenceBanner />);
+
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it("shows the step progress for the active flow", () => {
+    setSlice({ active: true, currentFlowId: "view-first-scan" });
+    const flow = getFlowById("view-first-scan")!;
+
+    render(<OnboardingSequenceBanner />);
+
+    expect(screen.getByText(`Step 2 of 5: ${flow.title}`)).toBeInTheDocument();
+  });
+
+  it("announces step progress to screen readers via a polite live region", () => {
+    setSlice({ active: true, currentFlowId: "view-first-scan" });
+    const flow = getFlowById("view-first-scan")!;
+
+    render(<OnboardingSequenceBanner />);
+
+    // Polite live region so screen readers announce step transitions on update.
+    const status = screen.getByRole("status");
+    expect(status).toHaveTextContent(`Step 2 of 5: ${flow.title}`);
+    expect(status).toHaveAttribute("aria-live", "polite");
+  });
+
+  it("does not show the data requirement hint on a scan-dependent step once a scan has finished", () => {
+    // The Continue gate already guarantees we only reach this step with data,
+    // so the "wait for findings" hint would be stale/misleading here.
+    setSlice({ active: true, currentFlowId: "explore-findings" });
+
+    render(<OnboardingSequenceBanner hasCompletedScan={true} />);
+
+    expect(
+      screen.queryByText(/wait for the scan to finish/i),
+    ).not.toBeInTheDocument();
+  });
+
+  it("does not show a hint for a flow without one", () => {
+    setSlice({ active: true, currentFlowId: "view-first-scan" });
+
+    render(<OnboardingSequenceBanner />);
+
+    expect(
+      screen.queryByText(/wait for the scan to finish/i),
+    ).not.toBeInTheDocument();
+  });
+
+  it("advances and navigates to the next flow when Continue is clicked", async () => {
+    setSlice({ active: true, currentFlowId: "view-first-scan" });
+    const nextFlow = getFlowById("explore-findings")!;
+    const user = userEvent.setup();
+
+    render(<OnboardingSequenceBanner />);
+    await user.click(screen.getByRole("button", { name: /continue/i }));
+
+    expect(advanceMock).toHaveBeenCalledTimes(1);
+    expect(pushMock).toHaveBeenCalledWith(nextFlow.route);
+    expect(stopMock).not.toHaveBeenCalled();
+  });
+
+  it("stops the sequence without navigating when Continue is clicked on the last step", async () => {
+    setSlice({ active: true, currentFlowId: "attack-paths" });
+    const user = userEvent.setup();
+
+    render(<OnboardingSequenceBanner />);
+    await user.click(screen.getByRole("button", { name: /continue/i }));
+
+    expect(stopMock).toHaveBeenCalledTimes(1);
+    expect(pushMock).not.toHaveBeenCalled();
+  });
+
+  it("stops the sequence when Skip is clicked", async () => {
+    setSlice({ active: true, currentFlowId: "explore-findings" });
+    const user = userEvent.setup();
+
+    render(<OnboardingSequenceBanner />);
+    await user.click(screen.getByRole("button", { name: /skip/i }));
+
+    expect(stopMock).toHaveBeenCalledTimes(1);
+    expect(advanceMock).not.toHaveBeenCalled();
+    expect(pushMock).not.toHaveBeenCalled();
+  });
+
+  describe("scan-gated Continue", () => {
+    it("disables Continue when the next step needs scan data and none has finished", () => {
+      // On the scan step, advancing would land on explore-findings (scan-dependent).
+      setSlice({ active: true, currentFlowId: "view-first-scan" });
+
+      render(<OnboardingSequenceBanner hasCompletedScan={false} />);
+
+      expect(screen.getByRole("button", { name: /continue/i })).toBeDisabled();
+      // The next step's hint explains why progression is blocked.
+      expect(
+        screen.getByText(/wait for the scan to finish/i),
+      ).toBeInTheDocument();
+    });
+
+    it("does not advance even if a disabled Continue is force-clicked", async () => {
+      setSlice({ active: true, currentFlowId: "view-first-scan" });
+      const user = userEvent.setup();
+
+      render(<OnboardingSequenceBanner hasCompletedScan={false} />);
+      await user.click(screen.getByRole("button", { name: /continue/i }));
+
+      expect(advanceMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+
+    it("enables Continue once a scan has finished", () => {
+      setSlice({ active: true, currentFlowId: "view-first-scan" });
+
+      render(<OnboardingSequenceBanner hasCompletedScan={true} />);
+
+      expect(screen.getByRole("button", { name: /continue/i })).toBeEnabled();
+    });
+
+    it("surfaces the hint on a scan-dependent step itself when no scan has finished", () => {
+      // Edge case: if we somehow sit on findings without a completed scan, the
+      // next step (compliance) is still gated, so the hint explains the block.
+      setSlice({ active: true, currentFlowId: "explore-findings" });
+
+      render(<OnboardingSequenceBanner hasCompletedScan={false} />);
+
+      expect(screen.getByRole("button", { name: /continue/i })).toBeDisabled();
+      expect(
+        screen.getByText(/wait for the scan to finish/i),
+      ).toBeInTheDocument();
+    });
+
+    it("never gates Continue when the next step does not need scan data", () => {
+      // add-provider → view-first-scan: neither requires scan data.
+      setSlice({ active: true, currentFlowId: "add-provider" });
+
+      render(<OnboardingSequenceBanner hasCompletedScan={false} />);
+
+      expect(screen.getByRole("button", { name: /continue/i })).toBeEnabled();
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-trigger.decision.test.ts b/ui/components/onboarding/__tests__/onboarding-trigger.decision.test.ts
new file mode 100644
index 0000000000..b1b50c142e
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-trigger.decision.test.ts
@@ -0,0 +1,164 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  mapCloseToSequenceAction,
+  resolveTriggerRequest,
+} from "../onboarding-trigger.logic";
+
+describe("resolveTriggerRequest", () => {
+  describe("replay (param) path", () => {
+    it("requests a replay start when the param matches this flow", () => {
+      const result = resolveTriggerRequest({
+        param: "add-provider",
+        replayRequestFlowId: null,
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+
+    it("takes precedence over the sequence when the param matches", () => {
+      const result = resolveTriggerRequest({
+        param: "add-provider",
+        replayRequestFlowId: null,
+        sliceActive: true,
+        currentFlowId: "add-provider",
+        flowId: "add-provider",
+      });
+
+      // Param takes precedence over sequence when both match.
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+
+    it("takes precedence over an in-memory replay request", () => {
+      const result = resolveTriggerRequest({
+        param: "add-provider",
+        replayRequestFlowId: "add-provider",
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      // Both resolve to replay; the param branch wins but the mode is identical.
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+  });
+
+  describe("replay (in-memory request) path", () => {
+    it("requests a replay start when the store names this flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: "add-provider",
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+
+    it("takes precedence over the sequence when the store names this flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: "add-provider",
+        sliceActive: true,
+        currentFlowId: "add-provider",
+        flowId: "add-provider",
+      });
+
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+
+    it("does not start when the store names a different flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: "view-first-scan",
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("sequence (slice) path", () => {
+    it("requests a sequence start when the active slice names this flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: null,
+        sliceActive: true,
+        currentFlowId: "add-provider",
+        flowId: "add-provider",
+      });
+
+      expect(result).toEqual({ start: true, mode: "sequence" });
+    });
+
+    it("does not start when the active slice names a different flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: null,
+        sliceActive: true,
+        currentFlowId: "view-first-scan",
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+
+    it("does not start when the slice is inactive even if the id matches", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: null,
+        sliceActive: false,
+        currentFlowId: "add-provider",
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("no-match path", () => {
+    it("returns null when the param targets a different flow and the slice is inactive", () => {
+      const result = resolveTriggerRequest({
+        param: "view-first-scan",
+        replayRequestFlowId: null,
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+
+    it("returns null when neither the param, the store, nor the slice match", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: null,
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+  });
+});
+
+describe("mapCloseToSequenceAction", () => {
+  it("advances the sequence when the tour completes", () => {
+    expect(mapCloseToSequenceAction("completed")).toBe("advance");
+  });
+
+  it("stops the sequence when the tour is skipped", () => {
+    expect(mapCloseToSequenceAction("skipped")).toBe("stop");
+  });
+
+  it("stops the sequence when the tour is dismissed", () => {
+    expect(mapCloseToSequenceAction("dismissed")).toBe("stop");
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-trigger.test.tsx b/ui/components/onboarding/__tests__/onboarding-trigger.test.tsx
new file mode 100644
index 0000000000..ca9f2cd106
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-trigger.test.tsx
@@ -0,0 +1,300 @@
+import { render, waitFor } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getFlowById } from "@/lib/onboarding";
+import type { OnboardingSequenceMode } from "@/store/onboarding-sequence";
+
+import { OnboardingTrigger } from "../onboarding-trigger";
+
+const startMock = vi.fn();
+const pushMock = vi.fn();
+const advanceMock = vi.fn();
+const stopMock = vi.fn();
+const consumeMock = vi.fn();
+
+// Counts hook re-invocations; the regression test uses this to confirm the runner stays mounted.
+const useDriverTourMock = vi.fn();
+// Captures onClosed so close→action wiring can be exercised without driver.js.
+let capturedOnClosed: ((state: string) => void) | undefined;
+
+let searchParamsValue = new URLSearchParams();
+
+let sliceState = {
+  active: false,
+  currentFlowId: null as string | null,
+  mode: null as OnboardingSequenceMode | null,
+  advance: advanceMock,
+  stop: stopMock,
+};
+
+let replayState = {
+  flowId: null as string | null,
+  token: 0,
+  consume: consumeMock,
+};
+
+vi.mock("next/navigation", () => ({
+  useSearchParams: () => searchParamsValue,
+  usePathname: () => "/providers",
+  useRouter: () => ({ replace: vi.fn(), push: pushMock }),
+}));
+
+vi.mock("@/lib/tours/use-driver-tour", () => ({
+  useDriverTour: (
+    _tour: unknown,
+    options: { onClosed?: (state: string) => void },
+  ) => {
+    useDriverTourMock();
+    capturedOnClosed = options?.onClosed;
+    return { start: startMock, stop: vi.fn(), hasCompleted: false };
+  },
+}));
+
+vi.mock("@/store/onboarding-sequence", () => {
+  const hook = (selector: (state: typeof sliceState) => unknown) =>
+    selector(sliceState);
+  hook.getState = () => sliceState;
+  return { useOnboardingSequenceStore: hook };
+});
+
+vi.mock("@/store/onboarding-replay", () => {
+  const hook = (selector: (state: typeof replayState) => unknown) =>
+    selector(replayState);
+  hook.getState = () => replayState;
+  return { useOnboardingReplayStore: hook };
+});
+
+const addProviderFlow = getFlowById("add-provider")!;
+
+function setSlice(next: Partial<typeof sliceState>) {
+  sliceState = { ...sliceState, ...next };
+}
+
+function setReplay(next: Partial<typeof replayState>) {
+  replayState = { ...replayState, ...next };
+}
+
+describe("OnboardingTrigger", () => {
+  beforeEach(() => {
+    startMock.mockClear();
+    pushMock.mockClear();
+    advanceMock.mockClear();
+    stopMock.mockClear();
+    consumeMock.mockClear();
+    useDriverTourMock.mockClear();
+    capturedOnClosed = undefined;
+    // Trigger only resolves in cloud.
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    searchParamsValue = new URLSearchParams();
+    sliceState = {
+      active: false,
+      currentFlowId: null,
+      mode: null,
+      advance: advanceMock,
+      stop: stopMock,
+    };
+    replayState = { flowId: null, token: 0, consume: consumeMock };
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("when the onboarding param matches this flow (replay)", () => {
+    it("force-starts the tour and strips the param", async () => {
+      searchParamsValue = new URLSearchParams("onboarding=add-provider");
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      // Param is stripped via history.replaceState (no router round-trip).
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+      await waitFor(() =>
+        expect(replaceStateSpy).toHaveBeenCalledWith(
+          null,
+          "",
+          window.location.pathname,
+        ),
+      );
+    });
+
+    it("strips only the onboarding param and preserves other query params", async () => {
+      searchParamsValue = new URLSearchParams(
+        "scanId=scan-1&onboarding=add-provider&tab=completed",
+      );
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+      await waitFor(() =>
+        expect(replaceStateSpy).toHaveBeenCalledWith(
+          null,
+          "",
+          `${window.location.pathname}?scanId=scan-1&tab=completed`,
+        ),
+      );
+    });
+  });
+
+  describe("when the in-memory replay store names this flow", () => {
+    it("force-starts the tour, consumes the request, and never touches the URL", async () => {
+      // Same-route navbar replay: started via the store, no `?onboarding=` param.
+      setReplay({ flowId: "add-provider", token: 1 });
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+      await waitFor(() => expect(consumeMock).toHaveBeenCalledTimes(1));
+      // No URL param to strip, and no router round-trip → no RSC refetch.
+      expect(replaceStateSpy).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when the sequence names this flow", () => {
+    it("force-starts the tour without stripping any param", async () => {
+      setSlice({
+        active: true,
+        currentFlowId: "add-provider",
+        mode: "sequence",
+      });
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+      expect(replaceStateSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when neither the param nor the sequence names this flow", () => {
+    it("renders null and does not start the tour", async () => {
+      searchParamsValue = new URLSearchParams();
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      const { container } = render(
+        <OnboardingTrigger flow={addProviderFlow} />,
+      );
+
+      expect(container).toBeEmptyDOMElement();
+      await waitFor(() => expect(startMock).not.toHaveBeenCalled());
+      expect(replaceStateSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when the onboarding param targets a different flow", () => {
+    it("does not start the tour", async () => {
+      searchParamsValue = new URLSearchParams("onboarding=explore-findings");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() => expect(startMock).not.toHaveBeenCalled());
+    });
+  });
+
+  describe("in self-hosted (OSS) deployments", () => {
+    it("renders null and never starts the tour, even with a matching param", async () => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+      searchParamsValue = new URLSearchParams("onboarding=add-provider");
+
+      const { container } = render(
+        <OnboardingTrigger flow={addProviderFlow} />,
+      );
+
+      expect(container).toBeEmptyDOMElement();
+      await waitFor(() => expect(startMock).not.toHaveBeenCalled());
+    });
+
+    it("ignores an active sequence slice in OSS", async () => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+      setSlice({
+        active: true,
+        currentFlowId: "add-provider",
+        mode: "sequence",
+      });
+
+      const { container } = render(
+        <OnboardingTrigger flow={addProviderFlow} />,
+      );
+
+      expect(container).toBeEmptyDOMElement();
+      await waitFor(() => expect(startMock).not.toHaveBeenCalled());
+    });
+  });
+
+  describe("when a sequence tour completes", () => {
+    it("leaves the sequence slice untouched (the banner owns advance now)", async () => {
+      setSlice({
+        active: true,
+        currentFlowId: "add-provider",
+        mode: "sequence",
+      });
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+      await waitFor(() => expect(capturedOnClosed).toBeDefined());
+      capturedOnClosed?.("completed");
+
+      // Banner is the sole advance/exit control; closing the tour must not auto-advance.
+      expect(advanceMock).not.toHaveBeenCalled();
+      expect(stopMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when a sequence tour is dismissed", () => {
+    it("leaves the sequence slice untouched (no auto-stop on close)", async () => {
+      setSlice({
+        active: true,
+        currentFlowId: "add-provider",
+        mode: "sequence",
+      });
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+      await waitFor(() => expect(capturedOnClosed).toBeDefined());
+      capturedOnClosed?.("skipped");
+
+      // Only the banner Exit button ends the sequence; closing the tour must not auto-stop.
+      expect(stopMock).not.toHaveBeenCalled();
+      expect(advanceMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when a replay tour closes", () => {
+    it("does not touch the sequence slice", async () => {
+      searchParamsValue = new URLSearchParams("onboarding=add-provider");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+      await waitFor(() => expect(capturedOnClosed).toBeDefined());
+      capturedOnClosed?.("completed");
+
+      // Single-flow replay never advances or stops the sequence.
+      expect(advanceMock).not.toHaveBeenCalled();
+      expect(stopMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when the param is cleared after the tour starts (regression)", () => {
+    it("keeps the runner mounted and does not restart the tour", async () => {
+      // StrictMode-safe latch: stripping the param must not unmount the runner or re-start the tour.
+      searchParamsValue = new URLSearchParams("onboarding=add-provider");
+      const { rerender } = render(<OnboardingTrigger flow={addProviderFlow} />);
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+
+      const callsBeforeClear = useDriverTourMock.mock.calls.length;
+
+      searchParamsValue = new URLSearchParams();
+      rerender(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() =>
+        expect(useDriverTourMock.mock.calls.length).toBeGreaterThan(
+          callsBeforeClear,
+        ),
+      );
+      expect(startMock).toHaveBeenCalledTimes(1);
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-welcome-modal.test.tsx b/ui/components/onboarding/__tests__/onboarding-welcome-modal.test.tsx
new file mode 100644
index 0000000000..a3665031c2
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-welcome-modal.test.tsx
@@ -0,0 +1,83 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+import { OnboardingWelcomeModal } from "../onboarding-welcome-modal";
+
+describe("OnboardingWelcomeModal", () => {
+  describe("when open is true", () => {
+    it("renders the flow title and description", () => {
+      render(
+        <OnboardingWelcomeModal
+          open
+          flowTitle="Add your first provider"
+          flowDescription="Connect a cloud account so Prowler has something to scan."
+          onAccept={vi.fn()}
+          onDismiss={vi.fn()}
+        />,
+      );
+
+      expect(screen.getByText("Add your first provider")).toBeInTheDocument();
+      expect(
+        screen.getByText(
+          "Connect a cloud account so Prowler has something to scan.",
+        ),
+      ).toBeInTheDocument();
+    });
+
+    it("calls onAccept when the primary action is clicked", async () => {
+      const user = userEvent.setup();
+      const onAccept = vi.fn();
+      const onDismiss = vi.fn();
+      render(
+        <OnboardingWelcomeModal
+          open
+          flowTitle="Add your first provider"
+          onAccept={onAccept}
+          onDismiss={onDismiss}
+        />,
+      );
+
+      await user.click(screen.getByRole("button", { name: /get started/i }));
+
+      expect(onAccept).toHaveBeenCalledTimes(1);
+      expect(onDismiss).not.toHaveBeenCalled();
+    });
+
+    it("calls onDismiss when the skip action is clicked", async () => {
+      const user = userEvent.setup();
+      const onAccept = vi.fn();
+      const onDismiss = vi.fn();
+      render(
+        <OnboardingWelcomeModal
+          open
+          flowTitle="Add your first provider"
+          onAccept={onAccept}
+          onDismiss={onDismiss}
+        />,
+      );
+
+      await user.click(screen.getByRole("button", { name: /skip for now/i }));
+
+      expect(onDismiss).toHaveBeenCalledTimes(1);
+      expect(onAccept).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when open is false", () => {
+    it("does not render the modal content", () => {
+      render(
+        <OnboardingWelcomeModal
+          open={false}
+          flowTitle="Add your first provider"
+          onAccept={vi.fn()}
+          onDismiss={vi.fn()}
+        />,
+      );
+
+      expect(
+        screen.queryByRole("button", { name: /get started/i }),
+      ).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/page-ready.test.tsx b/ui/components/onboarding/__tests__/page-ready.test.tsx
new file mode 100644
index 0000000000..9037cdb803
--- /dev/null
+++ b/ui/components/onboarding/__tests__/page-ready.test.tsx
@@ -0,0 +1,30 @@
+import { render } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { usePageReadyStore } from "@/store/page-ready";
+
+import { PageReady } from "../page-ready";
+
+vi.mock("next/navigation", () => ({
+  usePathname: () => "/compliance",
+}));
+
+describe("PageReady", () => {
+  beforeEach(() => usePageReadyStore.setState({ readyPath: null }));
+
+  it("marks the current route ready on mount", () => {
+    render(<PageReady />);
+    expect(usePageReadyStore.getState().readyPath).toBe("/compliance");
+  });
+
+  it("clears readiness on unmount", () => {
+    const { unmount } = render(<PageReady />);
+    unmount();
+    expect(usePageReadyStore.getState().readyPath).toBeNull();
+  });
+
+  it("renders nothing", () => {
+    const { container } = render(<PageReady />);
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/ui/components/onboarding/index.ts b/ui/components/onboarding/index.ts
new file mode 100644
index 0000000000..ba6a7e4128
--- /dev/null
+++ b/ui/components/onboarding/index.ts
@@ -0,0 +1,5 @@
+export { OnboardingCheckpointWatcher } from "./onboarding-checkpoint-watcher";
+export { OnboardingGate } from "./onboarding-gate";
+export { OnboardingSequenceBanner } from "./onboarding-sequence-banner";
+export { OnboardingTrigger } from "./onboarding-trigger";
+export { PageReady } from "./page-ready";
diff --git a/ui/components/onboarding/onboarding-checkpoint-dialog.tsx b/ui/components/onboarding/onboarding-checkpoint-dialog.tsx
new file mode 100644
index 0000000000..2517ef3692
--- /dev/null
+++ b/ui/components/onboarding/onboarding-checkpoint-dialog.tsx
@@ -0,0 +1,38 @@
+"use client";
+
+import { Button } from "@/components/shadcn";
+import { DialogFooter } from "@/components/shadcn/dialog";
+import { Modal } from "@/components/shadcn/modal/modal";
+
+interface OnboardingCheckpointDialogProps {
+  open: boolean;
+  onContinue: () => void;
+  onFinish: () => void;
+}
+
+export function OnboardingCheckpointDialog({
+  open,
+  onContinue,
+  onFinish,
+}: OnboardingCheckpointDialogProps) {
+  return (
+    <Modal
+      open={open}
+      title="Provider added — keep exploring?"
+      description="Your first provider is added. Want a quick guided tour of scans, findings, compliance, and attack paths? You can stop anytime."
+      size="lg"
+      // Overlay/Escape/X maps to "Finish here" — persists the handled marker once.
+      onOpenChange={(next) => {
+        if (!next) onFinish();
+      }}
+    >
+      <DialogFooter>
+        {/* Outline matches the app's modal secondary action (e.g. Launch Scan's Cancel). */}
+        <Button variant="outline" onClick={onFinish}>
+          Finish here
+        </Button>
+        <Button onClick={onContinue}>Continue the tour</Button>
+      </DialogFooter>
+    </Modal>
+  );
+}
diff --git a/ui/components/onboarding/onboarding-checkpoint-watcher.tsx b/ui/components/onboarding/onboarding-checkpoint-watcher.tsx
new file mode 100644
index 0000000000..1339b17f8c
--- /dev/null
+++ b/ui/components/onboarding/onboarding-checkpoint-watcher.tsx
@@ -0,0 +1,58 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+
+import { getOrderedFlows } from "@/lib/onboarding";
+import {
+  CHECKPOINT_MARKER,
+  useOnboardingCheckpointStore,
+} from "@/store/onboarding-checkpoint";
+import { useOnboardingSequenceStore } from "@/store/onboarding-sequence";
+
+import { OnboardingCheckpointDialog } from "./onboarding-checkpoint-dialog";
+
+// Sequence begins at the flow after `add-provider` (the gate).
+const FIRST_FLOW_ID = "add-provider";
+
+function markCheckpointHandled(): void {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(CHECKPOINT_MARKER, "true");
+  } catch {
+    // Non-fatal: a re-shown checkpoint beats a thrown render.
+  }
+}
+
+// Layout-level watcher: renders the checkpoint dialog when the store `open` flag is set.
+export function OnboardingCheckpointWatcher() {
+  const router = useRouter();
+  const open = useOnboardingCheckpointStore((state) => state.open);
+
+  const handleContinue = () => {
+    markCheckpointHandled(); // before navigation to prevent re-open on re-render
+    useOnboardingCheckpointStore.getState().close();
+
+    // Start at the flow immediately after the gate, not just any non-gate flow:
+    // a future registry insertion before it must not be skipped past.
+    const ordered = getOrderedFlows();
+    const gateIndex = ordered.findIndex((flow) => flow.id === FIRST_FLOW_ID);
+    const nextFlow = gateIndex >= 0 ? ordered[gateIndex + 1] : undefined;
+    if (!nextFlow) return;
+
+    useOnboardingSequenceStore.getState().startSequence(nextFlow.id);
+    router.push(nextFlow.route);
+  };
+
+  const handleFinish = () => {
+    markCheckpointHandled();
+    useOnboardingCheckpointStore.getState().close();
+  };
+
+  return (
+    <OnboardingCheckpointDialog
+      open={open}
+      onContinue={handleContinue}
+      onFinish={handleFinish}
+    />
+  );
+}
diff --git a/ui/components/onboarding/onboarding-gate.tsx b/ui/components/onboarding/onboarding-gate.tsx
new file mode 100644
index 0000000000..0161bffef4
--- /dev/null
+++ b/ui/components/onboarding/onboarding-gate.tsx
@@ -0,0 +1,74 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+
+import { getOrderedFlows, shouldStartOnboarding } from "@/lib/onboarding";
+import { localStorageAdapter } from "@/lib/tours/store/local-storage-adapter";
+import { TOUR_COMPLETION_STATES } from "@/lib/tours/tour-types";
+import { useTourCompletion } from "@/lib/tours/use-tour-completion";
+import { useOnboardingCheckpointStore } from "@/store/onboarding-checkpoint";
+
+import { OnboardingWelcomeModal } from "./onboarding-welcome-modal";
+
+interface OnboardingGateProps {
+  // `undefined` = fetch failed/ambiguous; fail-open (never force the modal).
+  hasProviders?: boolean;
+}
+
+// Mandatory new-user gate. Mounted once in the layout; decision derived during render
+// via useSyncExternalStore — server renders nothing, no hydration mismatch.
+export function OnboardingGate({ hasProviders }: OnboardingGateProps) {
+  const router = useRouter();
+
+  // Gate forces only the first flow (`add-provider`); remaining flows come via checkpoint/replay.
+  const flow = getOrderedFlows()[0] ?? null;
+
+  // Returns null on server/first render — gate stays closed until resolved client-side.
+  const completionRecord = useTourCompletion(flow?.tour ?? null);
+
+  // Session flag prevents the gate re-opening after accept/dismiss within this mount.
+  const [resolvedThisSession, setResolvedThisSession] = useState(false);
+
+  const activeFlow =
+    flow &&
+    !resolvedThisSession &&
+    shouldStartOnboarding({ hasProviders, completionRecord })
+      ? flow
+      : null;
+
+  if (!activeFlow) return null;
+
+  const handleAccept = () => {
+    // Arm checkpoint only on explicit accept — skip must never arm it.
+    useOnboardingCheckpointStore.getState().arm();
+    setResolvedThisSession(true);
+    // Routes may already carry a query string, so pick the right separator.
+    const separator = activeFlow.route.includes("?") ? "&" : "?";
+    router.push(`${activeFlow.route}${separator}onboarding=${activeFlow.id}`);
+  };
+
+  const handleDismiss = () => {
+    // Persist dismissal so the gate silently skips on future visits.
+    localStorageAdapter.set(
+      { id: activeFlow.tour.id, version: activeFlow.tour.version },
+      {
+        tourId: activeFlow.tour.id,
+        version: activeFlow.tour.version,
+        state: TOUR_COMPLETION_STATES.DISMISSED,
+        completedAt: new Date().toISOString(),
+      },
+    );
+    setResolvedThisSession(true);
+  };
+
+  return (
+    <OnboardingWelcomeModal
+      open
+      flowTitle={activeFlow.title}
+      flowDescription={activeFlow.description}
+      onAccept={handleAccept}
+      onDismiss={handleDismiss}
+    />
+  );
+}
diff --git a/ui/components/onboarding/onboarding-sequence-banner.logic.ts b/ui/components/onboarding/onboarding-sequence-banner.logic.ts
new file mode 100644
index 0000000000..cea460e983
--- /dev/null
+++ b/ui/components/onboarding/onboarding-sequence-banner.logic.ts
@@ -0,0 +1,32 @@
+import {
+  getOrderedFlows,
+  type OnboardingFlow,
+  onboardingFlows,
+} from "@/lib/onboarding";
+
+// Framework-free projection of the active sequence position — unit-testable without React.
+export interface SequenceProgress {
+  index: number; // 0-based
+  total: number;
+  flow: OnboardingFlow;
+  nextFlow: OnboardingFlow | null; // null when on the last step
+}
+
+// Returns null when `currentFlowId` is absent or not in the registry.
+export function getSequenceProgress(
+  currentFlowId: string | null,
+  flows: readonly OnboardingFlow[] = onboardingFlows,
+): SequenceProgress | null {
+  if (!currentFlowId) return null;
+
+  const ordered = getOrderedFlows(flows);
+  const index = ordered.findIndex((flow) => flow.id === currentFlowId);
+  if (index < 0) return null;
+
+  return {
+    index,
+    total: ordered.length,
+    flow: ordered[index],
+    nextFlow: ordered[index + 1] ?? null,
+  };
+}
diff --git a/ui/components/onboarding/onboarding-sequence-banner.tsx b/ui/components/onboarding/onboarding-sequence-banner.tsx
new file mode 100644
index 0000000000..3b9cce47cf
--- /dev/null
+++ b/ui/components/onboarding/onboarding-sequence-banner.tsx
@@ -0,0 +1,100 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+
+import { Button } from "@/components/shadcn";
+import { cn } from "@/lib/utils";
+import { useOnboardingSequenceStore } from "@/store/onboarding-sequence";
+
+import { getSequenceProgress } from "./onboarding-sequence-banner.logic";
+
+interface OnboardingSequenceBannerProps {
+  // Defaults to true (fail-open) when scan state is unknown, so the banner never
+  // wrongly blocks progression.
+  hasCompletedScan?: boolean;
+}
+
+// Non-blocking bottom banner for an active sequence. Owns advance/exit; the per-route
+// tour only shows on arrival and no longer auto-advances on close.
+export function OnboardingSequenceBanner({
+  hasCompletedScan = true,
+}: OnboardingSequenceBannerProps = {}) {
+  const router = useRouter();
+  const active = useOnboardingSequenceStore((state) => state.active);
+  const currentFlowId = useOnboardingSequenceStore(
+    (state) => state.currentFlowId,
+  );
+
+  const progress = getSequenceProgress(currentFlowId);
+  if (!active || !progress) return null;
+
+  const { index, total, flow, nextFlow } = progress;
+
+  // Block advancing into a scan-dependent step (e.g. findings, compliance) until a
+  // scan has finished — those steps have no data to show otherwise.
+  const continueDisabled =
+    hasCompletedScan === false && Boolean(nextFlow?.dataRequirementHint);
+  // Only surface a hint to explain why Continue is disabled. The gate already
+  // guarantees scan-dependent steps are reached with data, so showing a step's
+  // own "wait for findings" hint once we're there would be stale/misleading.
+  const hint = continueDisabled ? nextFlow?.dataRequirementHint : undefined;
+
+  const handleContinue = () => {
+    if (continueDisabled) return;
+    const sequence = useOnboardingSequenceStore.getState();
+    if (!nextFlow) {
+      sequence.stop(); // last step — end in place
+      return;
+    }
+    sequence.advance();
+    router.push(nextFlow.route);
+  };
+
+  const handleExit = () => {
+    useOnboardingSequenceStore.getState().stop();
+  };
+
+  return (
+    <div
+      role="region"
+      aria-label="Onboarding tour progress"
+      className={cn(
+        "fixed inset-x-0 bottom-0 z-40",
+        "border-border-neutral-secondary bg-bg-neutral-secondary border-t",
+        "px-4 py-3 shadow-lg",
+      )}
+    >
+      {/* Everything aligned to the right edge: step text first, then the two buttons.
+          No max-width/centering — that left a gap between the content and the screen. */}
+      <div className="flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-end sm:gap-6">
+        <div className="flex flex-col gap-1 sm:text-right">
+          {/* Polite live region: screen readers announce step transitions. */}
+          <p
+            role="status"
+            aria-live="polite"
+            className="text-text-neutral-primary text-sm font-medium"
+          >
+            Step {index + 1} of {total}: {flow.title}
+          </p>
+          {hint ? (
+            <p className="text-text-warning-primary text-xs">{hint}</p>
+          ) : null}
+        </div>
+        <div className="flex shrink-0 items-center gap-2">
+          {/* Secondary action: skips the whole tour. Outline matches the app's modal Cancel variant. */}
+          <Button variant="outline" size="sm" onClick={handleExit}>
+            Skip
+          </Button>
+          <Button
+            variant="default"
+            size="sm"
+            disabled={continueDisabled}
+            onClick={handleContinue}
+          >
+            Continue
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/ui/components/onboarding/onboarding-trigger.logic.ts b/ui/components/onboarding/onboarding-trigger.logic.ts
new file mode 100644
index 0000000000..841451304d
--- /dev/null
+++ b/ui/components/onboarding/onboarding-trigger.logic.ts
@@ -0,0 +1,48 @@
+import type { TourCompletionRecord } from "@/lib/tours/tour-types";
+import type { OnboardingSequenceMode } from "@/store/onboarding-sequence";
+
+// Flat, framework-free inputs for `resolveTriggerRequest` — unit-testable without React.
+export interface TriggerRequestInput {
+  param: string | null; // `?onboarding=<id>` value, or null
+  replayRequestFlowId: string | null; // in-memory replay request (same-route navbar), or null
+  sliceActive: boolean;
+  currentFlowId: string | null; // flow the active sequence points at
+  flowId: string; // flow this route owns
+}
+
+// Resolved start request, or null when this route's flow should not start.
+export interface TriggerRequest {
+  start: true;
+  mode: OnboardingSequenceMode;
+}
+
+// Replay (param or in-memory request) takes precedence over the sequence so a
+// manual replay is never hijacked. The in-memory request is how the navbar starts
+// a same-route replay without a `?onboarding=` URL param (which would force an RSC refetch).
+export function resolveTriggerRequest({
+  param,
+  replayRequestFlowId,
+  sliceActive,
+  currentFlowId,
+  flowId,
+}: TriggerRequestInput): TriggerRequest | null {
+  if (param === flowId) {
+    return { start: true, mode: "replay" };
+  }
+  if (replayRequestFlowId === flowId) {
+    return { start: true, mode: "replay" };
+  }
+  if (sliceActive && currentFlowId === flowId) {
+    return { start: true, mode: "sequence" };
+  }
+  return null;
+}
+
+// completed → advance the sequence; anything else → stop.
+export type SequenceCloseAction = "advance" | "stop";
+
+export function mapCloseToSequenceAction(
+  state: TourCompletionRecord["state"],
+): SequenceCloseAction {
+  return state === "completed" ? "advance" : "stop";
+}
diff --git a/ui/components/onboarding/onboarding-trigger.tsx b/ui/components/onboarding/onboarding-trigger.tsx
new file mode 100644
index 0000000000..2a1854f3c8
--- /dev/null
+++ b/ui/components/onboarding/onboarding-trigger.tsx
@@ -0,0 +1,165 @@
+"use client";
+
+import type { Config } from "driver.js";
+import { useSearchParams } from "next/navigation";
+import { useState } from "react";
+
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { type OnboardingFlow } from "@/lib/onboarding";
+import { isCloud } from "@/lib/shared/env";
+import type { TourStepHandlers } from "@/lib/tours/tour-types";
+import { useDriverTour } from "@/lib/tours/use-driver-tour";
+import { useOnboardingReplayStore } from "@/store/onboarding-replay";
+import {
+  type OnboardingSequenceMode,
+  useOnboardingSequenceStore,
+} from "@/store/onboarding-sequence";
+
+import { resolveTriggerRequest } from "./onboarding-trigger.logic";
+
+const ONBOARDING_PARAM = "onboarding";
+
+function stripOnboardingParamFromLocation(queryString: string) {
+  const params = new URLSearchParams(queryString);
+  params.delete(ONBOARDING_PARAM);
+  const query = params.toString();
+  window.history.replaceState(
+    null,
+    "",
+    `${window.location.pathname}${query ? `?${query}` : ""}${window.location.hash}`,
+  );
+}
+
+interface OnboardingTriggerProps<TTarget extends string = string> {
+  flow: OnboardingFlow; // force-started when the sequence names it or `?onboarding=<id>` matches
+  stepHandlers?: { [K in TTarget]?: TourStepHandlers<TTarget> };
+  configOverrides?: Partial<Config>;
+}
+
+// Latched per-trigger: `key` mounts a fresh runner on each re-trigger; `mode` drives param-strip logic.
+interface OnboardingRequest {
+  flow: OnboardingFlow;
+  key: number;
+  mode: OnboardingSequenceMode;
+  queryString: string;
+}
+
+// Per-route trigger: derives via `resolveTriggerRequest` whether this flow should start,
+// then mounts a keyed runner. Renders nothing.
+export function OnboardingTrigger<TTarget extends string = string>({
+  flow,
+  stepHandlers,
+  configOverrides,
+}: OnboardingTriggerProps<TTarget>) {
+  const searchParams = useSearchParams();
+  const param = searchParams?.get(ONBOARDING_PARAM) ?? null; // null outside Suspense context
+  const queryString = searchParams?.toString() ?? "";
+
+  const sliceActive = useOnboardingSequenceStore((state) => state.active);
+  const currentFlowId = useOnboardingSequenceStore(
+    (state) => state.currentFlowId,
+  );
+
+  // In-memory replay request (same-route navbar click): starts the tour without a
+  // `?onboarding=` URL param, so Next.js never refetches the page. `token` bumps on
+  // every request so re-clicking the same flow yields a fresh signal.
+  const replayRequestFlowId = useOnboardingReplayStore((state) => state.flowId);
+  const replayToken = useOnboardingReplayStore((state) => state.token);
+
+  // Cloud-only: in OSS the tour never resolves, so a manual `?onboarding=` URL can't start it.
+  const resolved = isCloud()
+    ? resolveTriggerRequest({
+        param,
+        replayRequestFlowId,
+        sliceActive,
+        currentFlowId,
+        flowId: flow.id,
+      })
+    : null;
+  // Token is part of the signal so a repeat same-route replay re-mints the key.
+  // For param/sequence starts the token is stable, so behaviour is unchanged.
+  const signal = resolved ? `${flow.id}:${resolved.mode}:${replayToken}` : null;
+
+  // Latched via "adjust state while rendering" (no useEffect): mints a fresh key on each
+  // new truthy signal; when signal drops to null (param stripped) the runner stays mounted.
+  const [request, setRequest] = useState<OnboardingRequest | null>(null);
+  const [lastSignal, setLastSignal] = useState<string | null>(null);
+
+  if (signal !== lastSignal) {
+    setLastSignal(signal);
+    if (resolved) {
+      setRequest((prev) => ({
+        flow,
+        key: (prev?.key ?? 0) + 1,
+        mode: resolved.mode,
+        queryString,
+      }));
+    }
+  }
+
+  if (!request) return null;
+
+  // Keyed runner: fresh mount per re-trigger; `useDriverTour` is unconditional so hooks rules hold.
+  return (
+    <OnboardingTourRunner<TTarget>
+      key={request.key}
+      flow={request.flow}
+      mode={request.mode}
+      queryString={request.queryString}
+      stepHandlers={stepHandlers}
+      configOverrides={configOverrides}
+    />
+  );
+}
+
+interface OnboardingTourRunnerProps<TTarget extends string> {
+  flow: OnboardingFlow;
+  mode: OnboardingSequenceMode;
+  queryString: string;
+  stepHandlers?: { [K in TTarget]?: TourStepHandlers<TTarget> };
+  configOverrides?: Partial<Config>;
+}
+
+function OnboardingTourRunner<TTarget extends string>({
+  flow,
+  mode,
+  queryString,
+  stepHandlers,
+  configOverrides,
+}: OnboardingTourRunnerProps<TTarget>) {
+  // onClosed is intentionally inert — the banner owns advance/exit for both modes.
+  const { start } = useDriverTour(flow.tour, {
+    autoOpen: false,
+    stepHandlers,
+    configOverrides,
+    onClosed: () => {},
+  });
+
+  // replaceState (not router.replace) avoids a useSearchParams re-trigger that would
+  // drop the latched runner. The microtask keeps driver.js/flushSync outside
+  // React's mount lifecycle.
+  useMountEffect(() => {
+    let cancelled = false;
+
+    queueMicrotask(() => {
+      if (cancelled) return;
+
+      start();
+      if (mode === "replay") {
+        // Only strip when the param actually started this replay; a same-route
+        // in-memory request leaves the URL untouched (no replaceState needed).
+        if (new URLSearchParams(queryString).has(ONBOARDING_PARAM)) {
+          stripOnboardingParamFromLocation(queryString);
+        }
+        // Clear any in-memory request so returning to this page won't auto-replay.
+        useOnboardingReplayStore.getState().consume();
+      }
+    });
+
+    return () => {
+      cancelled = true;
+    };
+  });
+
+  return null;
+}
diff --git a/ui/components/onboarding/onboarding-welcome-modal.tsx b/ui/components/onboarding/onboarding-welcome-modal.tsx
new file mode 100644
index 0000000000..566db34cba
--- /dev/null
+++ b/ui/components/onboarding/onboarding-welcome-modal.tsx
@@ -0,0 +1,42 @@
+"use client";
+
+import { Button } from "@/components/shadcn";
+import { DialogFooter } from "@/components/shadcn/dialog";
+import { Modal } from "@/components/shadcn/modal/modal";
+
+interface OnboardingWelcomeModalProps {
+  open: boolean;
+  flowTitle?: string;
+  flowDescription?: string;
+  onAccept: () => void;
+  onDismiss: () => void;
+}
+
+export function OnboardingWelcomeModal({
+  open,
+  flowTitle,
+  flowDescription,
+  onAccept,
+  onDismiss,
+}: OnboardingWelcomeModalProps) {
+  return (
+    <Modal
+      open={open}
+      title={flowTitle}
+      description={flowDescription}
+      size="lg"
+      // Overlay/Escape/X counts as dismiss — gate persists the record once.
+      onOpenChange={(next) => {
+        if (!next) onDismiss();
+      }}
+    >
+      <DialogFooter>
+        {/* Outline matches the app's modal secondary action (e.g. Launch Scan's Cancel). */}
+        <Button variant="outline" onClick={onDismiss}>
+          Skip for now
+        </Button>
+        <Button onClick={onAccept}>Get started</Button>
+      </DialogFooter>
+    </Modal>
+  );
+}
diff --git a/ui/components/onboarding/page-ready.tsx b/ui/components/onboarding/page-ready.tsx
new file mode 100644
index 0000000000..a24b0e4234
--- /dev/null
+++ b/ui/components/onboarding/page-ready.tsx
@@ -0,0 +1,25 @@
+"use client";
+
+import { usePathname } from "next/navigation";
+
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { usePageReadyStore } from "@/store/page-ready";
+
+/**
+ * Invisible marker rendered inside a page's post-Suspense (data-loaded) content.
+ * While it is unmounted the route counts as "still loading", which the navbar uses
+ * to keep the product-tour replay icon disabled until the page's requests resolve.
+ * Mounting marks the route ready; unmounting (navigation / in-page re-suspense) clears it.
+ */
+export function PageReady() {
+  const pathname = usePathname();
+  const markReady = usePageReadyStore((state) => state.markReady);
+  const clearReady = usePageReadyStore((state) => state.clearReady);
+
+  useMountEffect(() => {
+    markReady(pathname);
+    return () => clearReady(pathname);
+  });
+
+  return null;
+}
diff --git a/ui/components/providers/add-provider-button.tsx b/ui/components/providers/add-provider-button.tsx
index b296533ccc..0c965bd3cd 100644
--- a/ui/components/providers/add-provider-button.tsx
+++ b/ui/components/providers/add-provider-button.tsx
@@ -23,7 +23,9 @@ export const AddProviderButton = ({ onOpenWizard }: AddProviderButtonProps) => {
 
   return (
     <>
-      <Button onClick={handleOpen}>Add Provider</Button>
+      <Button data-tour-id="add-provider-trigger" onClick={handleOpen}>
+        Add Provider
+      </Button>
       {!onOpenWizard && (
         <ProviderWizardModal open={open} onOpenChange={setOpen} />
       )}
diff --git a/ui/components/providers/link-to-scans.tsx b/ui/components/providers/link-to-scans.tsx
index 09f06a7fd8..fee1ec407d 100644
--- a/ui/components/providers/link-to-scans.tsx
+++ b/ui/components/providers/link-to-scans.tsx
@@ -1,25 +1,29 @@
 "use client";
 
-import Link from "next/link";
-
-import { Button } from "@/components/shadcn";
+import { StackedCell } from "@/components/shadcn";
+import { formatLocalTimeWithZone } from "@/lib/date-utils";
+import type { ScanScheduleSummary } from "@/types/scans";
 
 interface LinkToScansProps {
   hasSchedule: boolean;
-  providerUid?: string;
+  schedule?: ScanScheduleSummary;
 }
 
-export const LinkToScans = ({ hasSchedule, providerUid }: LinkToScansProps) => {
+// Matches the scans table Schedule column: cadence on top, next-run local time
+// underneath. Falls back to a plain label when the cadence is unknown.
+export const LinkToScans = ({ hasSchedule, schedule }: LinkToScansProps) => {
+  if (schedule) {
+    return (
+      <StackedCell
+        primary={schedule.cadence ?? schedule.summary}
+        secondary={formatLocalTimeWithZone(schedule.nextScanAt ?? null)}
+      />
+    );
+  }
+
   return (
-    <div className="flex items-center gap-1">
-      <span className="text-text-neutral-secondary text-sm">
-        {hasSchedule ? "Daily" : "None"}
-      </span>
-      <Button asChild variant="link" size="sm" className="text-xs">
-        <Link href={`/scans?filter[provider_uid]=${providerUid}`}>
-          View Jobs
-        </Link>
-      </Button>
-    </div>
+    <span className="text-text-neutral-secondary text-sm">
+      {hasSchedule ? "Daily" : "None"}
+    </span>
   );
 };
diff --git a/ui/components/providers/no-providers-added.tsx b/ui/components/providers/no-providers-added.tsx
new file mode 100644
index 0000000000..5bfb8836ea
--- /dev/null
+++ b/ui/components/providers/no-providers-added.tsx
@@ -0,0 +1,95 @@
+"use client";
+
+import Link from "next/link";
+
+import { InfoIcon } from "@/components/icons/Icons";
+import { Button, Card, CardContent } from "@/components/shadcn";
+import { cn } from "@/lib/utils";
+
+const NO_PROVIDERS_ADDED_ACTION = {
+  BUTTON: "button",
+  LINK: "link",
+} as const;
+
+interface NoProvidersAddedBaseProps {
+  containerClassName?: string;
+  // Tour anchor for the CTA; needed because this empty state replaces the table's AddProviderButton.
+  ctaTourId?: string;
+}
+
+interface NoProvidersAddedButtonProps extends NoProvidersAddedBaseProps {
+  action: typeof NO_PROVIDERS_ADDED_ACTION.BUTTON;
+  onOpenWizard: () => void;
+  href?: never;
+}
+
+interface NoProvidersAddedLinkProps extends NoProvidersAddedBaseProps {
+  action: typeof NO_PROVIDERS_ADDED_ACTION.LINK;
+  href: string;
+  onOpenWizard?: never;
+}
+
+type NoProvidersAddedProps =
+  | NoProvidersAddedButtonProps
+  | NoProvidersAddedLinkProps;
+
+const renderCta = (props: NoProvidersAddedProps) => {
+  if (props.action === NO_PROVIDERS_ADDED_ACTION.LINK) {
+    return (
+      <Button
+        asChild
+        aria-label="Open Add Provider modal"
+        className="w-full max-w-xs justify-center"
+        size="lg"
+      >
+        <Link href={props.href}>Add a Provider</Link>
+      </Button>
+    );
+  }
+
+  return (
+    <Button
+      aria-label="Open Add Provider modal"
+      className="w-full max-w-xs justify-center"
+      data-tour-id={props.ctaTourId}
+      size="lg"
+      onClick={props.onOpenWizard}
+    >
+      Add a Provider
+    </Button>
+  );
+};
+
+export const NoProvidersAdded = (props: NoProvidersAddedProps) => {
+  return (
+    <div
+      role="region"
+      aria-labelledby="no-providers-added-title"
+      className={cn(
+        "flex min-h-[calc(100dvh-10rem)] items-center justify-center",
+        props.containerClassName,
+      )}
+    >
+      <Card variant="base" className="mx-auto w-full max-w-3xl">
+        <CardContent className="flex flex-col items-center gap-4 p-6 text-center sm:p-8">
+          <div className="flex flex-col items-center gap-4">
+            <InfoIcon className="h-10 w-10 text-gray-800 dark:text-white" />
+            <h2
+              id="no-providers-added-title"
+              className="text-2xl font-bold text-gray-800 dark:text-white"
+            >
+              No Providers Configured
+            </h2>
+          </div>
+          <div className="flex flex-col items-center gap-3">
+            <p className="text-md leading-relaxed text-gray-600 dark:text-gray-300">
+              No providers have been configured. Start by setting up a provider.
+            </p>
+          </div>
+
+          {renderCta(props)}
+        </CardContent>
+      </Card>
+    </div>
+  );
+};
diff --git a/ui/components/providers/organizations/org-launch-scan.test.tsx b/ui/components/providers/organizations/org-launch-scan.test.tsx
index 75949c2ae9..f7ef851a0c 100644
--- a/ui/components/providers/organizations/org-launch-scan.test.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.test.tsx
@@ -1,8 +1,9 @@
-import { act, render, waitFor } from "@testing-library/react";
+import { act, render, screen, waitFor } from "@testing-library/react";
 import type { ComponentProps } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { useOrgSetupStore } from "@/store/organizations/store";
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
 
 import { OrgLaunchScan } from "./org-launch-scan";
 
@@ -76,4 +77,72 @@ describe("OrgLaunchScan", () => {
     expect(toastPayload.action).toBeDefined();
     expect(toastPayload.action.props.children.props.href).toBe("/scans");
   });
+
+  it("uses a single manual scan when schedules are unavailable", async () => {
+    // Given
+    launchOrganizationScansMock.mockResolvedValue({ successCount: 1 });
+    const onFooterChange = vi.fn();
+
+    render(
+      <OrgLaunchScan
+        onClose={vi.fn()}
+        onBack={vi.fn()}
+        onFooterChange={onFooterChange}
+        capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+      />,
+    );
+
+    // Then
+    expect(
+      screen.getByText(/scheduled scans are not available for trial accounts/i),
+    ).toBeInTheDocument();
+    expect(screen.queryByRole("combobox")).not.toBeInTheDocument();
+
+    // When
+    await waitFor(() => {
+      expect(onFooterChange).toHaveBeenCalled();
+    });
+    const footerConfig = onFooterChange.mock.calls.at(-1)?.[0];
+    await act(async () => {
+      footerConfig.onAction?.();
+    });
+
+    // Then
+    await waitFor(() => {
+      expect(launchOrganizationScansMock).toHaveBeenCalledTimes(1);
+    });
+    expect(launchOrganizationScansMock).toHaveBeenCalledWith(
+      ["provider-1"],
+      "single",
+    );
+  });
+
+  it("blocks manual scans when the trial scan limit is reached", async () => {
+    // Given
+    const onFooterChange = vi.fn();
+
+    render(
+      <OrgLaunchScan
+        onClose={vi.fn()}
+        onBack={vi.fn()}
+        onFooterChange={onFooterChange}
+        capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+        isScanLimitReached
+      />,
+    );
+
+    // When
+    await waitFor(() => {
+      expect(onFooterChange).toHaveBeenCalled();
+    });
+    const footerConfig = onFooterChange.mock.calls.at(-1)?.[0];
+    await act(async () => {
+      footerConfig.onAction?.();
+    });
+
+    // Then
+    expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+    expect(footerConfig.actionDisabled).toBe(true);
+    expect(launchOrganizationScansMock).not.toHaveBeenCalled();
+  });
 });
diff --git a/ui/components/providers/organizations/org-launch-scan.tsx b/ui/components/providers/organizations/org-launch-scan.tsx
index 535d4186ba..6aede38b81 100644
--- a/ui/components/providers/organizations/org-launch-scan.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.tsx
@@ -21,12 +21,23 @@ import { Spinner } from "@/components/shadcn/spinner/spinner";
 import { TreeStatusIcon } from "@/components/shadcn/tree-view/tree-status-icon";
 import { ToastAction, useToast } from "@/components/ui";
 import { useOrgSetupStore } from "@/store/organizations/store";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+} from "@/types/schedules";
 import { TREE_ITEM_STATUS } from "@/types/tree";
 
 interface OrgLaunchScanProps {
   onClose: () => void;
   onBack: () => void;
   onFooterChange: (config: WizardFooterConfig) => void;
+  /**
+   * Schedule capability override. Prowler Cloud passes MANUAL_ONLY for trial
+   * tenants so organization onboarding cannot create recurring schedules.
+   */
+  capability?: ScanScheduleCapability;
+  /** Cloud-only manual scan quota signal. */
+  isScanLimitReached?: boolean;
 }
 
 const SCAN_SCHEDULE = {
@@ -40,6 +51,8 @@ export function OrgLaunchScan({
   onClose,
   onBack,
   onFooterChange,
+  capability,
+  isScanLimitReached = false,
 }: OrgLaunchScanProps) {
   const router = useRouter();
   const { toast } = useToast();
@@ -51,13 +64,21 @@ export function OrgLaunchScan({
     SCAN_SCHEDULE.DAILY,
   );
   const launchActionRef = useRef<() => void>(() => {});
+  const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
+  const effectiveScheduleOption = isManualOnly
+    ? SCAN_SCHEDULE.SINGLE
+    : scheduleOption;
 
   const handleLaunchScan = async () => {
+    if (isManualOnly && isScanLimitReached) {
+      return;
+    }
+
     setIsLaunching(true);
 
     const result = await launchOrganizationScans(
       createdProviderIds,
-      scheduleOption,
+      effectiveScheduleOption,
     );
     const successCount = result.successCount;
 
@@ -69,7 +90,7 @@ export function OrgLaunchScan({
     toast({
       title: "Scan Launched",
       description:
-        scheduleOption === SCAN_SCHEDULE.DAILY
+        effectiveScheduleOption === SCAN_SCHEDULE.DAILY
           ? `Daily scan scheduled for ${successCount} account${successCount !== 1 ? "s" : ""}.`
           : `Single scan launched for ${successCount} account${successCount !== 1 ? "s" : ""}.`,
       action: (
@@ -92,13 +113,23 @@ export function OrgLaunchScan({
       onBack,
       showAction: true,
       actionLabel: "Launch scan",
-      actionDisabled: isLaunching || createdProviderIds.length === 0,
+      actionDisabled:
+        isLaunching ||
+        createdProviderIds.length === 0 ||
+        (isManualOnly && isScanLimitReached),
       actionType: WIZARD_FOOTER_ACTION_TYPE.BUTTON,
       onAction: () => {
         launchActionRef.current();
       },
     });
-  }, [createdProviderIds.length, isLaunching, onBack, onFooterChange]);
+  }, [
+    createdProviderIds.length,
+    isLaunching,
+    isManualOnly,
+    isScanLimitReached,
+    onBack,
+    onFooterChange,
+  ]);
 
   return (
     <div className="flex min-h-0 flex-1 flex-col gap-8">
@@ -146,30 +177,45 @@ export function OrgLaunchScan({
             </p>
           )}
 
-          <div className="flex flex-col gap-4">
-            <p className="text-text-neutral-secondary text-sm">
-              Select a Prowler scan schedule for these accounts.
-            </p>
-            <Select
-              value={scheduleOption}
-              onValueChange={(value) =>
-                setScheduleOption(value as ScanScheduleOption)
-              }
-              disabled={isLaunching}
-            >
-              <SelectTrigger className="w-full max-w-[376px]">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem value={SCAN_SCHEDULE.DAILY}>
-                  Scan Daily (every 24 hours)
-                </SelectItem>
-                <SelectItem value={SCAN_SCHEDULE.SINGLE}>
-                  Run a single scan (no recurring schedule)
-                </SelectItem>
-              </SelectContent>
-            </Select>
-          </div>
+          {isManualOnly ? (
+            <div className="flex flex-col gap-3">
+              <p className="text-text-neutral-secondary text-sm">
+                Scheduled scans are not available for trial accounts. These
+                accounts will run a one-time manual scan now.
+              </p>
+              {isScanLimitReached && (
+                <p className="text-text-error-primary text-sm">
+                  You have reached your scan limit, so additional scans are not
+                  available right now.
+                </p>
+              )}
+            </div>
+          ) : (
+            <div className="flex flex-col gap-4">
+              <p className="text-text-neutral-secondary text-sm">
+                Select a Prowler scan schedule for these accounts.
+              </p>
+              <Select
+                value={scheduleOption}
+                onValueChange={(value) =>
+                  setScheduleOption(value as ScanScheduleOption)
+                }
+                disabled={isLaunching}
+              >
+                <SelectTrigger className="w-full max-w-[376px]">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value={SCAN_SCHEDULE.DAILY}>
+                    Scan Daily (every 24 hours)
+                  </SelectItem>
+                  <SelectItem value={SCAN_SCHEDULE.SINGLE}>
+                    Run a single scan (no recurring schedule)
+                  </SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+          )}
         </div>
       )}
     </div>
diff --git a/ui/components/providers/providers-accounts-view.test.tsx b/ui/components/providers/providers-accounts-view.test.tsx
index 9263277ea9..c8b3baf596 100644
--- a/ui/components/providers/providers-accounts-view.test.tsx
+++ b/ui/components/providers/providers-accounts-view.test.tsx
@@ -1,11 +1,36 @@
 import { render, screen } from "@testing-library/react";
-import { describe, expect, it, vi } from "vitest";
+import userEvent from "@testing-library/user-event";
+import type { ReactNode } from "react";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import type { FilterOption, MetaDataProps, ProviderProps } from "@/types";
 import type { ProvidersTableRow } from "@/types/providers-table";
 
+const { refreshMock, replaceMock, searchParamsValue } = vi.hoisted(() => ({
+  refreshMock: vi.fn(),
+  replaceMock: vi.fn(),
+  searchParamsValue: { current: "" },
+}));
+
+vi.mock("next/navigation", () => ({
+  usePathname: () => "/providers",
+  useRouter: () => ({
+    refresh: refreshMock,
+    replace: replaceMock,
+  }),
+  useSearchParams: () => new URLSearchParams(searchParamsValue.current),
+}));
+
+vi.mock("@/components/providers/table", () => ({
+  SkeletonTableProviders: () => <div data-testid="providers-skeleton" />,
+}));
+
 vi.mock("@/components/providers/add-provider-button", () => ({
-  AddProviderButton: () => <button type="button">Add provider</button>,
+  AddProviderButton: ({ onOpenWizard }: { onOpenWizard: () => void }) => (
+    <button type="button" onClick={onOpenWizard}>
+      Add Provider
+    </button>
+  ),
 }));
 
 vi.mock("@/components/providers/muted-findings-config-button", () => ({
@@ -15,7 +40,12 @@ vi.mock("@/components/providers/muted-findings-config-button", () => ({
 }));
 
 vi.mock("@/components/providers/providers-filters", () => ({
-  ProvidersFilters: () => <div data-testid="providers-filters">Filters</div>,
+  ProvidersFilters: ({ actions }: { actions: ReactNode }) => (
+    <div data-testid="providers-filters">
+      Filters
+      {actions}
+    </div>
+  ),
 }));
 
 vi.mock("@/components/providers/providers-accounts-table", () => ({
@@ -23,7 +53,21 @@ vi.mock("@/components/providers/providers-accounts-table", () => ({
 }));
 
 vi.mock("@/components/providers/wizard", () => ({
-  ProviderWizardModal: () => <div data-testid="provider-wizard-modal" />,
+  ProviderWizardModal: ({
+    open,
+    onOpenChange,
+  }: {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+  }) =>
+    open ? (
+      <div role="dialog">
+        Provider wizard
+        <button type="button" onClick={() => onOpenChange(false)}>
+          Close
+        </button>
+      </div>
+    ) : null,
 }));
 
 import { ProvidersAccountsView } from "./providers-accounts-view";
@@ -36,8 +80,55 @@ const metadata: MetaDataProps = {
   version: "latest",
 };
 
+const disconnectedProviders: ProviderProps[] = [
+  {
+    id: "provider-1",
+    type: "providers",
+    attributes: {
+      provider: "aws",
+      uid: "123456789012",
+      alias: "Production",
+      status: "completed",
+      resources: 0,
+      connection: {
+        connected: false,
+        last_checked_at: "2026-04-13T00:00:00Z",
+      },
+      scanner_args: {
+        only_logs: false,
+        excluded_checks: [],
+        aws_retries_max_attempts: 3,
+      },
+      inserted_at: "2026-04-13T00:00:00Z",
+      updated_at: "2026-04-13T00:00:00Z",
+      created_by: {
+        object: "user",
+        id: "user-1",
+      },
+    },
+    relationships: {
+      secret: {
+        data: null,
+      },
+      provider_groups: {
+        meta: {
+          count: 0,
+        },
+        data: [],
+      },
+    },
+  },
+];
+
 describe("ProvidersAccountsView", () => {
-  it("keeps the same vertical spacing between filters and table as other views", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+    searchParamsValue.current = "";
+    window.history.replaceState({}, "", "/");
+  });
+
+  it("shows a full page empty state without filters or table when there are no providers", () => {
+    // Given/When
     render(
       <ProvidersAccountsView
         isCloud={false}
@@ -48,11 +139,170 @@ describe("ProvidersAccountsView", () => {
       />,
     );
 
+    // Then
+    expect(screen.getByText("No Providers Configured")).toBeInTheDocument();
+    expect(
+      screen.getByRole("region", { name: /no providers configured/i }),
+    ).toHaveClass("min-h-[calc(100dvh-28rem)]");
+    expect(screen.queryByTestId("providers-filters")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("providers-table")).not.toBeInTheDocument();
+  });
+
+  it("opens the provider wizard from the no providers CTA", async () => {
+    // Given
+    const user = userEvent.setup();
+
+    render(
+      <ProvidersAccountsView
+        isCloud={false}
+        filters={filters}
+        metadata={metadata}
+        providers={providers}
+        rows={rows}
+      />,
+    );
+
+    // When
+    await user.click(
+      screen.getByRole("button", { name: /open add provider modal/i }),
+    );
+
+    // Then
+    expect(screen.getByRole("dialog")).toHaveTextContent("Provider wizard");
+  });
+
+  it("opens the provider wizard from the URL without immediately clearing the one-shot intent", () => {
+    // Given
+    searchParamsValue.current = "tab=connected&addProvider=true";
+    window.history.replaceState(
+      {},
+      "",
+      "/providers?tab=connected&addProvider=true",
+    );
+    // Spy only after the URL setup so we measure what the component does on mount.
+    const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+    render(
+      <ProvidersAccountsView
+        isCloud={false}
+        filters={filters}
+        metadata={metadata}
+        providers={providers}
+        rows={rows}
+      />,
+    );
+
+    // Then
+    expect(screen.getByRole("dialog")).toHaveTextContent("Provider wizard");
+    expect(replaceStateSpy).not.toHaveBeenCalled();
+  });
+
+  it("cleans the one-shot intent from the URL without refetching when the URL-opened wizard closes", async () => {
+    // Given
+    searchParamsValue.current = "tab=connected&addProvider=true";
+    const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+    const user = userEvent.setup();
+
+    render(
+      <ProvidersAccountsView
+        isCloud={false}
+        filters={filters}
+        metadata={metadata}
+        providers={providers}
+        rows={rows}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button", { name: /close/i }));
+
+    // Then
+    expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
+    // The URL is cleaned via the History API (no RSC refetch). We must NOT
+    // refresh/replace here: re-running the /providers Server Component on close
+    // read as a full page reload. The provider-creation actions already
+    // revalidatePath("/providers"), so the table is fresh behind the modal.
+    expect(replaceStateSpy).toHaveBeenCalledWith(
+      null,
+      "",
+      "/providers?tab=connected",
+    );
+    expect(refreshMock).not.toHaveBeenCalled();
+    expect(replaceMock).not.toHaveBeenCalled();
+  });
+
+  it("does not touch the URL or refetch when a manually opened wizard closes", async () => {
+    // Given: no addProvider param in the URL, wizard opened via the CTA.
+    searchParamsValue.current = "";
+    const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+    const user = userEvent.setup();
+
+    render(
+      <ProvidersAccountsView
+        isCloud={false}
+        filters={filters}
+        metadata={metadata}
+        providers={providers}
+        rows={rows}
+      />,
+    );
+
+    // When: open the wizard from the empty-state CTA, then close it.
+    await user.click(
+      screen.getByRole("button", { name: /open add provider modal/i }),
+    );
+    await user.click(screen.getByRole("button", { name: /close/i }));
+
+    // Then: nothing to clean and no refresh — the creation actions own the
+    // data refresh via revalidatePath.
+    expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
+    expect(replaceStateSpy).not.toHaveBeenCalled();
+    expect(refreshMock).not.toHaveBeenCalled();
+    expect(replaceMock).not.toHaveBeenCalled();
+  });
+
+  it("keeps filters and table visible when providers are disconnected", () => {
+    // Given/When
+    render(
+      <ProvidersAccountsView
+        isCloud={false}
+        filters={filters}
+        metadata={metadata}
+        providers={disconnectedProviders}
+        rows={rows}
+      />,
+    );
+
+    // Then
     expect(screen.getByTestId("providers-filters").parentElement).toHaveClass(
       "flex",
       "flex-col",
       "gap-6",
     );
     expect(screen.getByTestId("providers-table")).toBeInTheDocument();
+    expect(
+      screen.queryByText("No Providers Configured"),
+    ).not.toBeInTheDocument();
+  });
+
+  it("opens the provider wizard from the normal Add Provider button", async () => {
+    // Given
+    const user = userEvent.setup();
+
+    render(
+      <ProvidersAccountsView
+        isCloud={false}
+        filters={filters}
+        metadata={metadata}
+        providers={disconnectedProviders}
+        rows={rows}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button", { name: /add provider/i }));
+
+    // Then
+    expect(screen.getByRole("dialog")).toHaveTextContent("Provider wizard");
   });
 });
diff --git a/ui/components/providers/providers-accounts-view.tsx b/ui/components/providers/providers-accounts-view.tsx
index b53155d8c0..d1ff22a958 100644
--- a/ui/components/providers/providers-accounts-view.tsx
+++ b/ui/components/providers/providers-accounts-view.tsx
@@ -1,9 +1,12 @@
 "use client";
 
-import { useState } from "react";
+import { usePathname, useSearchParams } from "next/navigation";
+import { Suspense, useState } from "react";
 
+import { OnboardingTrigger, PageReady } from "@/components/onboarding";
 import { AddProviderButton } from "@/components/providers/add-provider-button";
 import { MutedFindingsConfigButton } from "@/components/providers/muted-findings-config-button";
+import { NoProvidersAdded } from "@/components/providers/no-providers-added";
 import { ProvidersAccountsTable } from "@/components/providers/providers-accounts-table";
 import { ProvidersFilters } from "@/components/providers/providers-filters";
 import { ProviderWizardModal } from "@/components/providers/wizard";
@@ -11,8 +14,37 @@ import type {
   OrgWizardInitialData,
   ProviderWizardInitialData,
 } from "@/components/providers/wizard/types";
+import { getFlowById } from "@/lib/onboarding";
+import {
+  ADD_PROVIDER_SEARCH_PARAM,
+  ADD_PROVIDER_SEARCH_VALUE,
+} from "@/lib/providers-navigation";
+import {
+  ADD_PROVIDER_TOUR_TARGETS,
+  addProviderTour,
+} from "@/lib/tours/add-provider.tour";
+import {
+  advanceActiveTourWhenReady,
+  getTourTargetSelector,
+} from "@/lib/tours/use-driver-tour";
 import type { FilterOption, MetaDataProps, ProviderProps } from "@/types";
 import type { ProvidersTableRow } from "@/types/providers-table";
+import type { ScanScheduleCapability } from "@/types/schedules";
+
+const addProviderFlow = getFlowById("add-provider")!;
+
+// Softer overlay for this onboarding tour — a heavy dim over the wizard feels harsh
+// while the user fills the form. Module-level constant keeps the driver config stable
+// across renders (useDriverTour recreates the driver when configOverrides identity
+// changes).
+const ADD_PROVIDER_TOUR_CONFIG = { overlayOpacity: 0.45 } as const;
+
+// The tour's "trigger" step auto-advances when the wizard opens; this is the anchor
+// it waits for (the provider-type selector inside the wizard).
+const PROVIDER_TYPE_TOUR_SELECTOR = getTourTargetSelector(
+  addProviderTour.id,
+  ADD_PROVIDER_TOUR_TARGETS.PROVIDER_TYPE,
+);
 
 interface ProvidersAccountsViewProps {
   isCloud: boolean;
@@ -20,6 +52,9 @@ interface ProvidersAccountsViewProps {
   metadata?: MetaDataProps;
   providers: ProviderProps[];
   rows: ProvidersTableRow[];
+  /** Cloud overlay seam for provider-creation scan launch. */
+  scanScheduleCapability?: ScanScheduleCapability;
+  isScanLimitReached?: boolean;
 }
 
 export function ProvidersAccountsView({
@@ -28,8 +63,17 @@ export function ProvidersAccountsView({
   metadata,
   providers,
   rows,
+  scanScheduleCapability,
+  isScanLimitReached,
 }: ProvidersAccountsViewProps) {
-  const [isProviderWizardOpen, setIsProviderWizardOpen] = useState(false);
+  const pathname = usePathname();
+  const searchParams = useSearchParams();
+  const hasNoProviders = providers.length === 0;
+  const shouldOpenProviderWizardFromUrl =
+    searchParams.get(ADD_PROVIDER_SEARCH_PARAM) === ADD_PROVIDER_SEARCH_VALUE;
+  const [isProviderWizardOpen, setIsProviderWizardOpen] = useState(
+    () => shouldOpenProviderWizardFromUrl,
+  );
   const [providerWizardInitialData, setProviderWizardInitialData] = useState<
     ProviderWizardInitialData | undefined
   >(undefined);
@@ -41,6 +85,9 @@ export function ProvidersAccountsView({
     setOrgWizardInitialData(undefined);
     setProviderWizardInitialData(initialData);
     setIsProviderWizardOpen(true);
+    // If the add-provider tour is on its "trigger" step, opening the wizard is the
+    // advance signal: move to the provider-type step once it mounts. No-op otherwise.
+    advanceActiveTourWhenReady(PROVIDER_TYPE_TOUR_SELECTOR);
   };
 
   const openOrganizationWizard = (initialData: OrgWizardInitialData) => {
@@ -52,38 +99,72 @@ export function ProvidersAccountsView({
   const handleWizardOpenChange = (open: boolean) => {
     setIsProviderWizardOpen(open);
 
-    if (!open) {
-      setProviderWizardInitialData(undefined);
-      setOrgWizardInitialData(undefined);
+    if (open) return;
+
+    setProviderWizardInitialData(undefined);
+    setOrgWizardInitialData(undefined);
+
+    // Remove ?addProvider via History API (not router.replace) to avoid an RSC refetch;
+    // revalidatePath in the creation actions already refreshes the table.
+    if (searchParams.has(ADD_PROVIDER_SEARCH_PARAM)) {
+      const params = new URLSearchParams(searchParams.toString());
+      params.delete(ADD_PROVIDER_SEARCH_PARAM);
+      const query = params.toString();
+      window.history.replaceState(
+        null,
+        "",
+        query ? `${pathname}?${query}` : pathname,
+      );
     }
   };
 
   return (
     <>
-      <div className="flex flex-col gap-6">
-        <ProvidersFilters
-          filters={filters}
-          providers={providers}
-          actions={
-            <>
-              <MutedFindingsConfigButton />
-              <AddProviderButton onOpenWizard={() => openProviderWizard()} />
-            </>
-          }
+      {/* Suspense required: OnboardingTrigger reads useSearchParams */}
+      <Suspense fallback={null}>
+        <OnboardingTrigger
+          flow={addProviderFlow}
+          configOverrides={ADD_PROVIDER_TOUR_CONFIG}
         />
-        <ProvidersAccountsTable
-          isCloud={isCloud}
-          metadata={metadata}
-          rows={rows}
-          onOpenProviderWizard={openProviderWizard}
-          onOpenOrganizationWizard={openOrganizationWizard}
+      </Suspense>
+      {/* Signals the navbar that this route's data has loaded (enables the replay icon). */}
+      <PageReady />
+      {hasNoProviders ? (
+        <NoProvidersAdded
+          action="button"
+          containerClassName="min-h-[calc(100dvh-28rem)]"
+          onOpenWizard={() => openProviderWizard()}
+          ctaTourId="add-provider-trigger"
         />
-      </div>
+      ) : (
+        <div className="flex flex-col gap-6">
+          <ProvidersFilters
+            filters={filters}
+            providers={providers}
+            actions={
+              <>
+                <MutedFindingsConfigButton />
+                <AddProviderButton onOpenWizard={() => openProviderWizard()} />
+              </>
+            }
+          />
+          <ProvidersAccountsTable
+            isCloud={isCloud}
+            metadata={metadata}
+            rows={rows}
+            onOpenProviderWizard={openProviderWizard}
+            onOpenOrganizationWizard={openOrganizationWizard}
+          />
+        </div>
+      )}
       <ProviderWizardModal
         open={isProviderWizardOpen}
         onOpenChange={handleWizardOpenChange}
         initialData={providerWizardInitialData}
         orgInitialData={orgWizardInitialData}
+        refreshOnClose={false}
+        scanScheduleCapability={scanScheduleCapability}
+        isScanLimitReached={isScanLimitReached}
       />
     </>
   );
diff --git a/ui/components/providers/table/column-providers.tsx b/ui/components/providers/table/column-providers.tsx
index 863a37c4eb..9398931105 100644
--- a/ui/components/providers/table/column-providers.tsx
+++ b/ui/components/providers/table/column-providers.tsx
@@ -1,18 +1,13 @@
 "use client";
 
 import { ColumnDef, Row, RowSelectionState } from "@tanstack/react-table";
-import {
-  Building2,
-  FolderTree,
-  ShieldAlert,
-  ShieldCheck,
-  ShieldOff,
-} from "lucide-react";
+import { Building2, FolderTree } from "lucide-react";
 
 import type {
   OrgWizardInitialData,
   ProviderWizardInitialData,
 } from "@/components/providers/wizard/types";
+import { Badge } from "@/components/shadcn";
 import { Checkbox } from "@/components/shadcn/checkbox/checkbox";
 import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
 import { DateWithTime, EntityInfo } from "@/components/ui/entities";
@@ -48,27 +43,24 @@ const OrganizationIcon = ({ groupKind }: { groupKind: string }) => {
 const ProviderStatusCell = ({ connected }: { connected: boolean | null }) => {
   if (connected === true) {
     return (
-      <div className="text-system-success flex items-center gap-2 text-sm whitespace-nowrap">
-        <ShieldCheck className="size-4 shrink-0" />
-        <span>Connected</span>
-      </div>
+      <Badge variant="success" className="text-sm">
+        Connected
+      </Badge>
     );
   }
 
   if (connected === false) {
     return (
-      <div className="text-text-error-primary flex items-center gap-2 text-sm whitespace-nowrap">
-        <ShieldAlert className="size-4 shrink-0" />
-        <span>Connection failed</span>
-      </div>
+      <Badge variant="error" className="text-sm">
+        Connection failed
+      </Badge>
     );
   }
 
   return (
-    <div className="text-text-neutral-secondary flex items-center gap-2 text-sm whitespace-nowrap">
-      <ShieldOff className="size-4 shrink-0" />
-      <span>Not connected</span>
-    </div>
+    <Badge variant="tag" className="text-text-neutral-secondary text-sm">
+      Not connected
+    </Badge>
   );
 };
 
@@ -260,7 +252,7 @@ export function getColumnProviders(
         return (
           <LinkToScans
             hasSchedule={row.original.hasSchedule}
-            providerUid={row.original.attributes.uid}
+            schedule={row.original.scheduleSummary}
           />
         );
       },
diff --git a/ui/components/providers/table/data-table-row-actions.test.tsx b/ui/components/providers/table/data-table-row-actions.test.tsx
index d72874af31..dc0aeadf47 100644
--- a/ui/components/providers/table/data-table-row-actions.test.tsx
+++ b/ui/components/providers/table/data-table-row-actions.test.tsx
@@ -1,7 +1,7 @@
 import { Row } from "@tanstack/react-table";
 import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { ORG_SETUP_PHASE, ORG_WIZARD_STEP } from "@/types/organizations";
 import {
@@ -10,7 +10,17 @@ import {
   ProvidersTableRow,
 } from "@/types/providers-table";
 
-const checkConnectionProviderMock = vi.hoisted(() => vi.fn());
+const { checkConnectionProviderMock, getScheduleMock, pushMock } = vi.hoisted(
+  () => ({
+    checkConnectionProviderMock: vi.fn(),
+    getScheduleMock: vi.fn(),
+    pushMock: vi.fn(),
+  }),
+);
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: pushMock }),
+}));
 
 vi.mock("@/actions/organizations/organizations", () => ({
   updateOrganizationName: vi.fn(),
@@ -20,6 +30,10 @@ vi.mock("@/actions/providers/providers", () => ({
   checkConnectionProvider: checkConnectionProviderMock,
 }));
 
+vi.mock("@/actions/schedules", () => ({
+  getSchedule: getScheduleMock,
+}));
+
 vi.mock("../forms/delete-form", () => ({
   DeleteForm: () => null,
 }));
@@ -32,6 +46,26 @@ vi.mock("../forms/edit-name-form", () => ({
   EditNameForm: () => null,
 }));
 
+vi.mock("@/components/scans/schedule/edit-scan-schedule-modal", () => ({
+  EDIT_SCAN_SCHEDULE_STATE: {
+    LOADING: "loading",
+    LOADED: "loaded",
+    ERROR: "error",
+  },
+  EditScanScheduleModal: ({
+    open,
+    provider,
+  }: {
+    open: boolean;
+    provider?: { providerId: string };
+  }) =>
+    open ? (
+      <div role="dialog" aria-label="Edit Scan Schedule">
+        Editing schedule for {provider?.providerId}
+      </div>
+    ) : null,
+}));
+
 vi.mock("@/components/ui", () => ({
   useToast: () => ({ toast: vi.fn() }),
 }));
@@ -143,6 +177,23 @@ const createOuRow = () =>
   }) as unknown as Row<ProvidersTableRow>;
 
 describe("DataTableRowActions", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  beforeEach(() => {
+    getScheduleMock.mockResolvedValue({
+      data: {
+        type: "schedules",
+        id: "provider-1",
+        attributes: { scan_hour: null },
+        relationships: {
+          provider: { data: { type: "providers", id: "provider-1" } },
+        },
+      },
+    });
+  });
+
   it("renders Add Credentials for provider rows without credentials", async () => {
     // Given
     const user = userEvent.setup();
@@ -163,12 +214,97 @@ describe("DataTableRowActions", () => {
 
     // Then
     expect(screen.getByText("Edit Provider Alias")).toBeInTheDocument();
+    // Advanced schedule editing is gated to Prowler Cloud subscribed accounts.
+    expect(screen.queryByText("Edit Scan Schedule")).not.toBeInTheDocument();
     expect(screen.getByText("Add Credentials")).toBeInTheDocument();
     expect(screen.getByText("Test Connection")).toBeInTheDocument();
     expect(screen.getByText("Delete Provider")).toBeInTheDocument();
     expect(screen.queryByText("Update Credentials")).not.toBeInTheDocument();
   });
 
+  it("navigates to the provider-filtered scan jobs from View Scan Jobs", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(
+      <DataTableRowActions
+        row={createRow(true)}
+        hasSelection={false}
+        isRowSelected={false}
+        testableProviderIds={[]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button"));
+    await user.click(screen.getByText("View Scan Jobs"));
+
+    // Then: navigates with the key the scans filter bar binds to
+    // (provider_uid__in), URL-encoded, so the provider is pre-selected.
+    expect(pushMock).toHaveBeenCalledWith(
+      "/scans?filter%5Bprovider_uid__in%5D=111111111111",
+    );
+  });
+
+  it("URL-encodes provider UIDs that contain unsafe characters (e.g. GitHub)", async () => {
+    // Given a GitHub provider whose UID is a URL.
+    const user = userEvent.setup();
+    const row = createRow(true);
+    (
+      row.original as unknown as { attributes: { uid: string } }
+    ).attributes.uid = "https://github.com/prowler-cloud/prowler";
+
+    render(
+      <DataTableRowActions
+        row={row}
+        hasSelection={false}
+        isRowSelected={false}
+        testableProviderIds={[]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button"));
+    await user.click(screen.getByText("View Scan Jobs"));
+
+    // Then the ':' and '/' are encoded instead of leaking into the URL raw.
+    expect(pushMock).toHaveBeenCalledWith(
+      "/scans?filter%5Bprovider_uid__in%5D=https%3A%2F%2Fgithub.com%2Fprowler-cloud%2Fprowler",
+    );
+  });
+
+  it("opens Edit Scan Schedule for Prowler Cloud subscribed provider rows", async () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    const user = userEvent.setup();
+
+    render(
+      <DataTableRowActions
+        row={createRow(true)}
+        hasSelection={false}
+        isRowSelected={false}
+        testableProviderIds={[]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button"));
+    await user.click(screen.getByText("Edit Scan Schedule"));
+
+    // Then
+    expect(
+      screen.getByRole("dialog", { name: /edit scan schedule/i }),
+    ).toHaveTextContent("Editing schedule for provider-1");
+  });
+
   it("renders Update Credentials for provider rows with credentials", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/components/providers/table/data-table-row-actions.tsx b/ui/components/providers/table/data-table-row-actions.tsx
index 9b531f272a..44d7198e2e 100644
--- a/ui/components/providers/table/data-table-row-actions.tsx
+++ b/ui/components/providers/table/data-table-row-actions.tsx
@@ -1,16 +1,31 @@
 "use client";
 
 import { Row } from "@tanstack/react-table";
-import { KeyRound, Pencil, Rocket, Trash2 } from "lucide-react";
+import {
+  CalendarClock,
+  KeyRound,
+  Pencil,
+  Rocket,
+  Timer,
+  Trash2,
+} from "lucide-react";
+import { useRouter } from "next/navigation";
 import { useState } from "react";
 
 import { updateOrganizationName } from "@/actions/organizations/organizations";
 import { updateProvider } from "@/actions/providers";
+import { getSchedule } from "@/actions/schedules";
 import {
   ORG_WIZARD_INTENT,
   OrgWizardInitialData,
   ProviderWizardInitialData,
 } from "@/components/providers/wizard/types";
+import {
+  EDIT_SCAN_SCHEDULE_STATE,
+  EditScanScheduleModal,
+  type EditScanScheduleState,
+  type ScanScheduleProvider,
+} from "@/components/scans/schedule/edit-scan-schedule-modal";
 import {
   ActionDropdown,
   ActionDropdownDangerZone,
@@ -20,6 +35,8 @@ import { Modal } from "@/components/shadcn/modal";
 import { useToast } from "@/components/ui";
 import { runWithConcurrencyLimit } from "@/lib/concurrency";
 import { testProviderConnection } from "@/lib/provider-helpers";
+import { getScanScheduleCapability } from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
 import { ORG_SETUP_PHASE, ORG_WIZARD_STEP } from "@/types/organizations";
 import { PROVIDER_WIZARD_MODE } from "@/types/provider-wizard";
 import {
@@ -29,6 +46,11 @@ import {
   ProvidersOrganizationRow,
   ProvidersTableRow,
 } from "@/types/providers-table";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+  type ScheduleApiResponse,
+} from "@/types/schedules";
 
 import { DeleteForm } from "../forms/delete-form";
 import { DeleteOrganizationForm } from "../forms/delete-organization-form";
@@ -46,6 +68,13 @@ interface DataTableRowActionsProps {
   onClearSelection: () => void;
   onOpenProviderWizard: (initialData?: ProviderWizardInitialData) => void;
   onOpenOrganizationWizard: (initialData: OrgWizardInitialData) => void;
+  /**
+   * Schedule capability override. Absent in OSS (defaults to a Cloud-vs-non-Cloud
+   * decision). The prowler-cloud overlay injects a billing-aware capability so
+   * only subscribed Cloud accounts can open the advanced schedule editor (which
+   * talks to the new schedule API).
+   */
+  capability?: ScanScheduleCapability;
 }
 
 function collectTestableChildProviderIds(rows: ProvidersTableRow[]): string[] {
@@ -200,11 +229,20 @@ export function DataTableRowActions({
   onClearSelection,
   onOpenProviderWizard,
   onOpenOrganizationWizard,
+  capability,
 }: DataTableRowActionsProps) {
+  const canEditSchedule =
+    (capability ?? getScanScheduleCapability(isCloud())) ===
+    SCAN_SCHEDULE_CAPABILITY.ADVANCED;
   const [isEditOpen, setIsEditOpen] = useState(false);
+  const [isScheduleOpen, setIsScheduleOpen] = useState(false);
+  const [scheduleState, setScheduleState] = useState<EditScanScheduleState>({
+    kind: EDIT_SCAN_SCHEDULE_STATE.LOADING,
+  });
   const [isDeleteOpen, setIsDeleteOpen] = useState(false);
   const [loading, setLoading] = useState(false);
   const { toast } = useToast();
+  const router = useRouter();
 
   const rowData = row.original;
   const isOrganizationRow = isProvidersOrganizationRow(rowData);
@@ -215,6 +253,14 @@ export function DataTableRowActions({
   const providerAlias = provider?.attributes.alias ?? null;
   const providerSecretId = provider?.relationships.secret.data?.id ?? null;
   const hasSecret = Boolean(provider?.relationships.secret.data);
+  const scheduleProvider: ScanScheduleProvider | undefined = provider
+    ? {
+        providerId,
+        providerType,
+        providerUid,
+        providerAlias,
+      }
+    : undefined;
 
   const orgGroupKind = isOrganizationRow ? rowData.groupKind : null;
   const childTestableIds = isOrganizationRow
@@ -283,6 +329,40 @@ export function DataTableRowActions({
     await handleBulkTest(childTestableIds);
   };
 
+  const openScheduleEditor = async () => {
+    if (!providerId) {
+      setScheduleState({
+        kind: EDIT_SCAN_SCHEDULE_STATE.ERROR,
+        message: "Provider ID is not available.",
+      });
+      setIsScheduleOpen(true);
+      return;
+    }
+
+    setScheduleState({ kind: EDIT_SCAN_SCHEDULE_STATE.LOADING });
+    setIsScheduleOpen(true);
+
+    const response = (await getSchedule(providerId)) as
+      | ScheduleApiResponse
+      | { error?: string };
+
+    if (!response || ("error" in response && response.error)) {
+      setScheduleState({
+        kind: EDIT_SCAN_SCHEDULE_STATE.ERROR,
+        message:
+          response && "error" in response && response.error
+            ? response.error
+            : "Failed to load scan schedule.",
+      });
+      return;
+    }
+
+    setScheduleState({
+      kind: EDIT_SCAN_SCHEDULE_STATE.LOADED,
+      schedule: "data" in response ? response.data : null,
+    });
+  };
+
   // When this row is part of the selection, only show "Test Connection"
   if (hasSelection && isRowSelected) {
     const bulkCount =
@@ -364,6 +444,12 @@ export function DataTableRowActions({
           <DeleteForm providerId={providerId} setIsOpen={setIsDeleteOpen} />
         )}
       </Modal>
+      <EditScanScheduleModal
+        open={isScheduleOpen}
+        onOpenChange={setIsScheduleOpen}
+        provider={scheduleProvider}
+        state={scheduleState}
+      />
       <div className="relative flex items-center justify-end gap-2">
         <ActionDropdown>
           <ActionDropdownItem
@@ -371,6 +457,27 @@ export function DataTableRowActions({
             label="Edit Provider Alias"
             onSelect={() => setIsEditOpen(true)}
           />
+          <ActionDropdownItem
+            icon={<Timer />}
+            label="View Scan Jobs"
+            onSelect={() => {
+              // Use the same key the scans filter bar binds to
+              // (`provider_uid__in`) so the provider is pre-selected in the UI,
+              // and URLSearchParams to encode UIDs that contain URL-unsafe chars
+              // (e.g. GitHub UIDs like https://github.com/org/repo).
+              const params = new URLSearchParams({
+                "filter[provider_uid__in]": providerUid,
+              });
+              router.push(`/scans?${params.toString()}`);
+            }}
+          />
+          {canEditSchedule && (
+            <ActionDropdownItem
+              icon={<CalendarClock />}
+              label="Edit Scan Schedule"
+              onSelect={() => void openScheduleEditor()}
+            />
+          )}
           <ActionDropdownItem
             icon={<KeyRound />}
             label={hasSecret ? "Update Credentials" : "Add Credentials"}
diff --git a/ui/components/providers/wizard/hooks/use-provider-wizard-controller.test.tsx b/ui/components/providers/wizard/hooks/use-provider-wizard-controller.test.tsx
index 587e02cb32..6603c90091 100644
--- a/ui/components/providers/wizard/hooks/use-provider-wizard-controller.test.tsx
+++ b/ui/components/providers/wizard/hooks/use-provider-wizard-controller.test.tsx
@@ -13,8 +13,9 @@ import type { ProviderWizardInitialData } from "../types";
 
 import { useProviderWizardController } from "./use-provider-wizard-controller";
 
-const { refreshMock } = vi.hoisted(() => ({
+const { refreshMock, requestOpenOnWizardCloseMock } = vi.hoisted(() => ({
   refreshMock: vi.fn(),
+  requestOpenOnWizardCloseMock: vi.fn(),
 }));
 
 vi.mock("next/navigation", () => ({
@@ -23,6 +24,14 @@ vi.mock("next/navigation", () => ({
   }),
 }));
 
+vi.mock("@/store/onboarding-checkpoint", () => ({
+  useOnboardingCheckpointStore: {
+    getState: () => ({
+      requestOpenOnWizardClose: requestOpenOnWizardCloseMock,
+    }),
+  },
+}));
+
 vi.mock("next-auth/react", () => ({
   useSession: () => ({
     data: null,
@@ -34,8 +43,11 @@ describe("useProviderWizardController", () => {
   beforeEach(() => {
     vi.useRealTimers();
     vi.clearAllMocks();
+    requestOpenOnWizardCloseMock.mockClear();
     sessionStorage.clear();
     localStorage.clear();
+    // Checkpoint is Cloud-only.
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
     useProviderWizardStore.getState().reset();
     useOrgSetupStore.getState().reset();
   });
@@ -60,6 +72,78 @@ describe("useProviderWizardController", () => {
     expect(refreshMock).toHaveBeenCalledTimes(1);
   });
 
+  it("requests the onboarding checkpoint with providerConnected:true when a provider was created", () => {
+    const onOpenChange = vi.fn();
+    const { result } = renderHook(() =>
+      useProviderWizardController({
+        open: true,
+        onOpenChange,
+      }),
+    );
+    act(() => {
+      useProviderWizardStore.getState().setProvider({
+        id: "provider-1",
+        type: "aws",
+        uid: "111111111111",
+        alias: "production",
+      });
+    });
+
+    act(() => {
+      result.current.handleClose();
+    });
+
+    // providerId is read before the store reset clears it.
+    expect(requestOpenOnWizardCloseMock).toHaveBeenCalledWith({
+      providerConnected: true,
+    });
+  });
+
+  it("requests the onboarding checkpoint with providerConnected:false when no provider was created", () => {
+    const onOpenChange = vi.fn();
+    const { result } = renderHook(() =>
+      useProviderWizardController({
+        open: true,
+        onOpenChange,
+      }),
+    );
+
+    act(() => {
+      result.current.handleClose();
+    });
+
+    expect(requestOpenOnWizardCloseMock).toHaveBeenCalledWith({
+      providerConnected: false,
+    });
+  });
+
+  it("does not request the onboarding checkpoint in self-hosted (OSS) deployments", () => {
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+    const onOpenChange = vi.fn();
+    const { result } = renderHook(() =>
+      useProviderWizardController({
+        open: true,
+        onOpenChange,
+      }),
+    );
+    act(() => {
+      useProviderWizardStore.getState().setProvider({
+        id: "provider-1",
+        type: "aws",
+        uid: "111111111111",
+        alias: "production",
+      });
+    });
+
+    act(() => {
+      result.current.handleClose();
+    });
+
+    // Checkpoint stays untouched, but the close still refreshes.
+    expect(requestOpenOnWizardCloseMock).not.toHaveBeenCalled();
+    expect(refreshMock).toHaveBeenCalledTimes(1);
+  });
+
   it("hydrates update mode when initial data is provided", async () => {
     // Given
     const onOpenChange = vi.fn();
@@ -182,7 +266,7 @@ describe("useProviderWizardController", () => {
       result.current.handleTestSuccess();
     });
 
-    // Then: credential rotation never surfaces the launch/schedule step
+    // Credential rotation skips the launch/schedule step.
     expect(onOpenChange).toHaveBeenCalledWith(false);
     expect(refreshMock).toHaveBeenCalledTimes(1);
     expect(result.current.currentStep).not.toBe(PROVIDER_WIZARD_STEP.LAUNCH);
@@ -281,7 +365,7 @@ describe("useProviderWizardController", () => {
       result.current.setCurrentStep(PROVIDER_WIZARD_STEP.TEST);
     });
 
-    // When: provider data refreshes while modal is still open
+    // Provider data refreshes while modal is still open — user progress must be kept.
     rerender({
       open: true,
       initialData: {
@@ -294,7 +378,6 @@ describe("useProviderWizardController", () => {
       },
     });
 
-    // Then: keep user progress in the current flow
     expect(result.current.currentStep).toBe(PROVIDER_WIZARD_STEP.TEST);
     expect(useProviderWizardStore.getState().via).toBe("service-account");
   });
diff --git a/ui/components/providers/wizard/hooks/use-provider-wizard-controller.ts b/ui/components/providers/wizard/hooks/use-provider-wizard-controller.ts
index 40644450c2..80c2182840 100644
--- a/ui/components/providers/wizard/hooks/use-provider-wizard-controller.ts
+++ b/ui/components/providers/wizard/hooks/use-provider-wizard-controller.ts
@@ -4,6 +4,9 @@ import { useRouter } from "next/navigation";
 import { useEffect, useRef, useState } from "react";
 
 import { DOCS_URLS, getProviderHelpText } from "@/lib/external-urls";
+import { isCloud } from "@/lib/shared/env";
+import { endActiveTour } from "@/lib/tours/use-driver-tour";
+import { useOnboardingCheckpointStore } from "@/store/onboarding-checkpoint";
 import { useOrgSetupStore } from "@/store/organizations/store";
 import { useProviderWizardStore } from "@/store/provider-wizard/store";
 import {
@@ -50,6 +53,8 @@ interface UseProviderWizardControllerProps {
   onOpenChange: (open: boolean) => void;
   initialData?: ProviderWizardInitialData;
   orgInitialData?: OrgWizardInitialData;
+  // When false, skips post-close router.refresh() — caller relies on revalidatePath instead.
+  refreshOnClose?: boolean;
 }
 
 export function useProviderWizardController({
@@ -57,6 +62,7 @@ export function useProviderWizardController({
   onOpenChange,
   initialData,
   orgInitialData,
+  refreshOnClose = true,
 }: UseProviderWizardControllerProps) {
   const router = useRouter();
   const initialProviderId = initialData?.providerId ?? null;
@@ -176,6 +182,13 @@ export function useProviderWizardController({
   const isOrgDirectEntry = Boolean(orgInitialData);
 
   const handleClose = () => {
+    // Closing the wizard at any point ends the add-provider tour; the checkpoint
+    // logic below still drives the handoff to scans. No-op off-onboarding.
+    endActiveTour();
+
+    // Read providerId before reset clears it — non-null means a provider was connected.
+    const connectedProviderId = useProviderWizardStore.getState().providerId;
+
     resetProviderWizard();
     resetOrgWizard();
     setWizardVariant(WIZARD_VARIANT.PROVIDER);
@@ -185,7 +198,17 @@ export function useProviderWizardController({
     setProviderTypeHint(null);
     setOrgSetupPhase(ORG_SETUP_PHASE.DETAILS);
     onOpenChange(false);
-    router.refresh();
+
+    // Cloud-only; only fires if the store is armed (user started onboarding).
+    if (isCloud()) {
+      useOnboardingCheckpointStore.getState().requestOpenOnWizardClose({
+        providerConnected: connectedProviderId !== null,
+      });
+    }
+
+    if (refreshOnClose) {
+      router.refresh();
+    }
   };
 
   const handleDialogOpenChange = (nextOpen: boolean) => {
@@ -207,6 +230,9 @@ export function useProviderWizardController({
   };
 
   const openOrganizationsFlow = () => {
+    // AWS Organizations diverges from the credentials path the tour guides toward; end
+    // it so it doesn't dangle on a step that no longer fits. No-op off-onboarding.
+    endActiveTour();
     resetOrgWizard();
     setWizardVariant(WIZARD_VARIANT.ORGANIZATIONS);
     setOrgCurrentStep(ORG_WIZARD_STEP.SETUP);
diff --git a/ui/components/providers/wizard/provider-wizard-modal.tsx b/ui/components/providers/wizard/provider-wizard-modal.tsx
index d731ca5786..8904b35e43 100644
--- a/ui/components/providers/wizard/provider-wizard-modal.tsx
+++ b/ui/components/providers/wizard/provider-wizard-modal.tsx
@@ -9,11 +9,13 @@ import { Button } from "@/components/shadcn/button/button";
 import { DialogHeader, DialogTitle } from "@/components/shadcn/dialog";
 import { Modal } from "@/components/shadcn/modal";
 import { useScrollHint } from "@/hooks/use-scroll-hint";
+import { advanceActiveTour, endActiveTour } from "@/lib/tours/use-driver-tour";
 import { ORG_SETUP_PHASE, ORG_WIZARD_STEP } from "@/types/organizations";
 import {
   PROVIDER_WIZARD_MODE,
   PROVIDER_WIZARD_STEP,
 } from "@/types/provider-wizard";
+import type { ScanScheduleCapability } from "@/types/schedules";
 
 import { useProviderWizardController } from "./hooks/use-provider-wizard-controller";
 import {
@@ -38,6 +40,11 @@ interface ProviderWizardModalProps {
   onOpenChange: (open: boolean) => void;
   initialData?: ProviderWizardInitialData;
   orgInitialData?: OrgWizardInitialData;
+  refreshOnClose?: boolean;
+  /** Cloud overlay seam; defaults to the environment-resolved capability. */
+  scanScheduleCapability?: ScanScheduleCapability;
+  /** Cloud-only manual scan quota signal. */
+  isScanLimitReached?: boolean;
 }
 
 export function ProviderWizardModal({
@@ -45,6 +52,9 @@ export function ProviderWizardModal({
   onOpenChange,
   initialData,
   orgInitialData,
+  refreshOnClose,
+  scanScheduleCapability,
+  isScanLimitReached,
 }: ProviderWizardModalProps) {
   const {
     backToProviderFlow,
@@ -72,6 +82,7 @@ export function ProviderWizardModal({
     onOpenChange,
     initialData,
     orgInitialData,
+    refreshOnClose,
   });
   const scrollHintRefreshToken = `${wizardVariant}-${currentStep}-${orgCurrentStep}-${orgSetupPhase}`;
   const { containerRef, sentinelRef, showScrollHint } = useScrollHint({
@@ -103,211 +114,247 @@ export function ProviderWizardModal({
         </div>
       </DialogHeader>
 
-      <div className="mt-6 flex min-h-0 flex-1 flex-col overflow-hidden lg:mt-8 lg:flex-row">
-        <div className="mb-4 box-border w-full shrink-0 lg:mb-0 lg:w-[328px]">
-          {isProviderFlow ? (
-            <WizardStepper
-              currentStep={currentStep}
-              steps={
-                mode === PROVIDER_WIZARD_MODE.UPDATE
-                  ? UPDATE_MODE_WIZARD_STEPS
-                  : undefined
-              }
-            />
-          ) : (
-            <WizardStepper
-              currentStep={orgCurrentStep}
-              stepOffset={getOrganizationsStepperOffset(
-                orgCurrentStep,
-                orgSetupPhase,
-              )}
-            />
-          )}
-        </div>
-        <div aria-hidden className="hidden w-[100px] min-w-0 shrink lg:block" />
-
-        <div className="relative flex-1 overflow-hidden">
-          <div
-            ref={containerRef}
-            className="minimal-scrollbar h-full w-full overflow-y-scroll [scrollbar-gutter:stable] lg:ml-auto lg:max-w-[620px] xl:max-w-[700px]"
-          >
-            {isProviderFlow && currentStep === PROVIDER_WIZARD_STEP.CONNECT && (
-              <ConnectStep
-                onNext={() => setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS)}
-                onSelectOrganizations={openOrganizationsFlow}
-                onFooterChange={setFooterConfig}
-                onProviderTypeChange={setProviderTypeHint}
-              />
-            )}
-
-            {isProviderFlow &&
-              currentStep === PROVIDER_WIZARD_STEP.CREDENTIALS && (
-                <CredentialsStep
-                  onNext={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
-                  onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.CONNECT)}
-                  onFooterChange={setFooterConfig}
-                />
-              )}
-
-            {isProviderFlow && currentStep === PROVIDER_WIZARD_STEP.TEST && (
-              <TestConnectionStep
-                onSuccess={handleTestSuccess}
-                onResetCredentials={() =>
-                  setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS)
-                }
-                onFooterChange={setFooterConfig}
-              />
-            )}
-
-            {isProviderFlow && currentStep === PROVIDER_WIZARD_STEP.LAUNCH && (
-              <LaunchStep
-                onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
-                onClose={handleClose}
-                onFooterChange={setFooterConfig}
-              />
-            )}
-
-            {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.SETUP && (
-              <OrgSetupForm
-                onBack={isOrgDirectEntry ? handleClose : backToProviderFlow}
-                onClose={handleClose}
-                onNext={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
-                }}
-                onFooterChange={setFooterConfig}
-                onPhaseChange={setOrgSetupPhase}
-                initialPhase={orgSetupPhase}
-                initialValues={
-                  orgInitialData
-                    ? {
-                        organizationName: orgInitialData.organizationName,
-                        awsOrgId: orgInitialData.externalId,
-                      }
+      {/* Anchors the add-provider tour's final step to the wizard content and
+          footer, keeping the real form controls clickable under the overlay. */}
+      <div
+        data-tour-id="add-provider-wizard-body"
+        className="mt-6 flex min-h-0 flex-1 flex-col overflow-hidden lg:mt-8"
+      >
+        <div className="flex min-h-0 flex-1 flex-col overflow-hidden lg:flex-row">
+          <div className="mb-4 box-border w-full shrink-0 lg:mb-0 lg:w-[328px]">
+            {isProviderFlow ? (
+              <WizardStepper
+                currentStep={currentStep}
+                steps={
+                  mode === PROVIDER_WIZARD_MODE.UPDATE
+                    ? UPDATE_MODE_WIZARD_STEPS
                     : undefined
                 }
-                intent={orgInitialData?.intent}
+              />
+            ) : (
+              <WizardStepper
+                currentStep={orgCurrentStep}
+                stepOffset={getOrganizationsStepperOffset(
+                  orgCurrentStep,
+                  orgSetupPhase,
+                )}
               />
             )}
-
-            {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.VALIDATE && (
-              <OrgAccountSelection
-                onBack={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.SETUP);
-                  setOrgSetupPhase(ORG_SETUP_PHASE.ACCESS);
-                }}
-                onNext={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
-                }}
-                onSkip={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
-                }}
-                onFooterChange={setFooterConfig}
-              />
-            )}
-
-            {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.LAUNCH && (
-              <OrgLaunchScan
-                onClose={handleClose}
-                onBack={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
-                }}
-                onFooterChange={setFooterConfig}
-              />
-            )}
-
-            {/* Sentinel element for IntersectionObserver scroll detection */}
-            <div ref={sentinelRef} aria-hidden className="h-px shrink-0" />
           </div>
+          <div
+            aria-hidden
+            className="hidden w-[100px] min-w-0 shrink lg:block"
+          />
 
-          {showScrollHint && (
-            <div className="pointer-events-none absolute right-0 bottom-0 left-0 z-10">
-              <div className="from-bg-neutral-secondary h-12 bg-gradient-to-t to-transparent" />
-              <div className="absolute inset-x-0 bottom-2 flex justify-center">
-                <span className="bg-bg-neutral-secondary/85 text-text-neutral-tertiary rounded-full px-3 py-1 text-xs backdrop-blur-sm">
-                  Scroll to see more
-                </span>
+          <div className="relative flex min-h-0 flex-1 flex-col overflow-hidden">
+            <div className="relative min-h-0 flex-1 overflow-hidden">
+              <div
+                ref={containerRef}
+                className="minimal-scrollbar h-full w-full overflow-y-scroll [scrollbar-gutter:stable] lg:ml-auto lg:max-w-[620px] xl:max-w-[700px]"
+              >
+                {isProviderFlow &&
+                  currentStep === PROVIDER_WIZARD_STEP.CONNECT && (
+                    <ConnectStep
+                      onNext={() => {
+                        setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS);
+                        // Reaching credentials is the tour's handoff point: end it so the
+                        // user continues on their own. No-op off-onboarding.
+                        endActiveTour();
+                      }}
+                      onSelectOrganizations={openOrganizationsFlow}
+                      onFooterChange={setFooterConfig}
+                      onProviderTypeChange={(providerType) => {
+                        // Picking a type reveals the account-detail inputs. Advance the tour
+                        // to its wizard-body step, pinned beside the form. No-op off-onboarding.
+                        if (providerType) advanceActiveTour();
+                        setProviderTypeHint(providerType);
+                      }}
+                    />
+                  )}
+
+                {isProviderFlow &&
+                  currentStep === PROVIDER_WIZARD_STEP.CREDENTIALS && (
+                    <CredentialsStep
+                      onNext={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
+                      onBack={() =>
+                        setCurrentStep(PROVIDER_WIZARD_STEP.CONNECT)
+                      }
+                      onFooterChange={setFooterConfig}
+                    />
+                  )}
+
+                {isProviderFlow &&
+                  currentStep === PROVIDER_WIZARD_STEP.TEST && (
+                    <TestConnectionStep
+                      onSuccess={handleTestSuccess}
+                      onResetCredentials={() =>
+                        setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS)
+                      }
+                      onFooterChange={setFooterConfig}
+                    />
+                  )}
+
+                {isProviderFlow &&
+                  currentStep === PROVIDER_WIZARD_STEP.LAUNCH && (
+                    <LaunchStep
+                      onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
+                      onClose={handleClose}
+                      onFooterChange={setFooterConfig}
+                      capability={scanScheduleCapability}
+                      isScanLimitReached={isScanLimitReached}
+                    />
+                  )}
+
+                {!isProviderFlow &&
+                  orgCurrentStep === ORG_WIZARD_STEP.SETUP && (
+                    <OrgSetupForm
+                      onBack={
+                        isOrgDirectEntry ? handleClose : backToProviderFlow
+                      }
+                      onClose={handleClose}
+                      onNext={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
+                      }}
+                      onFooterChange={setFooterConfig}
+                      onPhaseChange={setOrgSetupPhase}
+                      initialPhase={orgSetupPhase}
+                      initialValues={
+                        orgInitialData
+                          ? {
+                              organizationName: orgInitialData.organizationName,
+                              awsOrgId: orgInitialData.externalId,
+                            }
+                          : undefined
+                      }
+                      intent={orgInitialData?.intent}
+                    />
+                  )}
+
+                {!isProviderFlow &&
+                  orgCurrentStep === ORG_WIZARD_STEP.VALIDATE && (
+                    <OrgAccountSelection
+                      onBack={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.SETUP);
+                        setOrgSetupPhase(ORG_SETUP_PHASE.ACCESS);
+                      }}
+                      onNext={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
+                      }}
+                      onSkip={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
+                      }}
+                      onFooterChange={setFooterConfig}
+                    />
+                  )}
+
+                {!isProviderFlow &&
+                  orgCurrentStep === ORG_WIZARD_STEP.LAUNCH && (
+                    <OrgLaunchScan
+                      onClose={handleClose}
+                      onBack={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
+                      }}
+                      onFooterChange={setFooterConfig}
+                      capability={scanScheduleCapability}
+                      isScanLimitReached={isScanLimitReached}
+                    />
+                  )}
+
+                {/* Sentinel element for IntersectionObserver scroll detection */}
+                <div ref={sentinelRef} aria-hidden className="h-px shrink-0" />
+              </div>
+
+              {showScrollHint && (
+                <div className="pointer-events-none absolute right-0 bottom-0 left-0 z-10">
+                  <div className="from-bg-neutral-secondary h-12 bg-gradient-to-t to-transparent" />
+                  <div className="absolute inset-x-0 bottom-2 flex justify-center">
+                    <span className="bg-bg-neutral-secondary/85 text-text-neutral-tertiary rounded-full px-3 py-1 text-xs backdrop-blur-sm">
+                      Scroll to see more
+                    </span>
+                  </div>
+                </div>
+              )}
+            </div>
+          </div>
+        </div>
+
+        {(resolvedFooterConfig.showBack ||
+          resolvedFooterConfig.showSecondaryAction ||
+          resolvedFooterConfig.showAction) && (
+          <div className="mt-8 pt-6">
+            <div className="flex items-center justify-between">
+              <div>
+                {resolvedFooterConfig.showBack && (
+                  <Button
+                    type="button"
+                    variant="outline"
+                    size="xl"
+                    disabled={resolvedFooterConfig.backDisabled}
+                    onClick={resolvedFooterConfig.onBack}
+                  >
+                    {resolvedFooterConfig.backLabel}
+                  </Button>
+                )}
+              </div>
+              <div className="flex items-center gap-6">
+                {resolvedFooterConfig.showSecondaryAction && (
+                  <Button
+                    size={
+                      resolvedFooterConfig.secondaryActionVariant === "link"
+                        ? "link-sm"
+                        : "xl"
+                    }
+                    className={
+                      resolvedFooterConfig.secondaryActionVariant === "link"
+                        ? "h-auto p-0"
+                        : undefined
+                    }
+                    variant={resolvedFooterConfig.secondaryActionVariant}
+                    type={
+                      resolvedFooterConfig.secondaryActionType ===
+                      WIZARD_FOOTER_ACTION_TYPE.SUBMIT
+                        ? "submit"
+                        : "button"
+                    }
+                    form={resolvedFooterConfig.secondaryActionFormId}
+                    disabled={resolvedFooterConfig.secondaryActionDisabled}
+                    onClick={
+                      resolvedFooterConfig.secondaryActionType ===
+                      WIZARD_FOOTER_ACTION_TYPE.BUTTON
+                        ? resolvedFooterConfig.onSecondaryAction
+                        : undefined
+                    }
+                  >
+                    {resolvedFooterConfig.secondaryActionLabel}
+                  </Button>
+                )}
+
+                {resolvedFooterConfig.showAction && (
+                  <Button
+                    size="xl"
+                    type={
+                      resolvedFooterConfig.actionType ===
+                      WIZARD_FOOTER_ACTION_TYPE.SUBMIT
+                        ? "submit"
+                        : "button"
+                    }
+                    form={resolvedFooterConfig.actionFormId}
+                    disabled={resolvedFooterConfig.actionDisabled}
+                    onClick={
+                      resolvedFooterConfig.actionType ===
+                      WIZARD_FOOTER_ACTION_TYPE.BUTTON
+                        ? resolvedFooterConfig.onAction
+                        : undefined
+                    }
+                  >
+                    {resolvedFooterConfig.actionLabel}
+                  </Button>
+                )}
               </div>
             </div>
-          )}
-        </div>
-      </div>
-
-      {(resolvedFooterConfig.showBack ||
-        resolvedFooterConfig.showSecondaryAction ||
-        resolvedFooterConfig.showAction) && (
-        <div className="mt-8 pt-6">
-          <div className="flex items-center justify-between">
-            <div>
-              {resolvedFooterConfig.showBack && (
-                <Button
-                  type="button"
-                  variant="outline"
-                  size="xl"
-                  disabled={resolvedFooterConfig.backDisabled}
-                  onClick={resolvedFooterConfig.onBack}
-                >
-                  {resolvedFooterConfig.backLabel}
-                </Button>
-              )}
-            </div>
-            <div className="flex items-center gap-6">
-              {resolvedFooterConfig.showSecondaryAction && (
-                <Button
-                  size={
-                    resolvedFooterConfig.secondaryActionVariant === "link"
-                      ? "link-sm"
-                      : "xl"
-                  }
-                  className={
-                    resolvedFooterConfig.secondaryActionVariant === "link"
-                      ? "h-auto p-0"
-                      : undefined
-                  }
-                  variant={resolvedFooterConfig.secondaryActionVariant}
-                  type={
-                    resolvedFooterConfig.secondaryActionType ===
-                    WIZARD_FOOTER_ACTION_TYPE.SUBMIT
-                      ? "submit"
-                      : "button"
-                  }
-                  form={resolvedFooterConfig.secondaryActionFormId}
-                  disabled={resolvedFooterConfig.secondaryActionDisabled}
-                  onClick={
-                    resolvedFooterConfig.secondaryActionType ===
-                    WIZARD_FOOTER_ACTION_TYPE.BUTTON
-                      ? resolvedFooterConfig.onSecondaryAction
-                      : undefined
-                  }
-                >
-                  {resolvedFooterConfig.secondaryActionLabel}
-                </Button>
-              )}
-
-              {resolvedFooterConfig.showAction && (
-                <Button
-                  size="xl"
-                  type={
-                    resolvedFooterConfig.actionType ===
-                    WIZARD_FOOTER_ACTION_TYPE.SUBMIT
-                      ? "submit"
-                      : "button"
-                  }
-                  form={resolvedFooterConfig.actionFormId}
-                  disabled={resolvedFooterConfig.actionDisabled}
-                  onClick={
-                    resolvedFooterConfig.actionType ===
-                    WIZARD_FOOTER_ACTION_TYPE.BUTTON
-                      ? resolvedFooterConfig.onAction
-                      : undefined
-                  }
-                >
-                  {resolvedFooterConfig.actionLabel}
-                </Button>
-              )}
-            </div>
           </div>
-        </div>
-      )}
+        )}
+      </div>
     </Modal>
   );
 }
diff --git a/ui/components/providers/wizard/steps/launch-step.test.tsx b/ui/components/providers/wizard/steps/launch-step.test.tsx
index 1f33955849..cfa8e2e63d 100644
--- a/ui/components/providers/wizard/steps/launch-step.test.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.test.tsx
@@ -1,21 +1,32 @@
-import { act, render, waitFor } from "@testing-library/react";
+import { act, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import type { ComponentProps } from "react";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { useProviderWizardStore } from "@/store/provider-wizard/store";
 import { SCAN_JOBS_TAB } from "@/types";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  SCHEDULE_FREQUENCY,
+} from "@/types/schedules";
 
 import { LaunchStep } from "./launch-step";
 
-const { scheduleDailyMock, scanOnDemandMock, toastMock } = vi.hoisted(() => ({
-  scheduleDailyMock: vi.fn(),
-  scanOnDemandMock: vi.fn(),
-  toastMock: vi.fn(),
-}));
+const { scanOnDemandMock, scheduleDailyMock, toastMock, updateScheduleMock } =
+  vi.hoisted(() => ({
+    scanOnDemandMock: vi.fn(),
+    scheduleDailyMock: vi.fn(),
+    toastMock: vi.fn(),
+    updateScheduleMock: vi.fn(),
+  }));
 
 vi.mock("@/actions/scans", () => ({
-  scheduleDaily: scheduleDailyMock,
   scanOnDemand: scanOnDemandMock,
+  scheduleDaily: scheduleDailyMock,
+}));
+
+vi.mock("@/actions/schedules", () => ({
+  updateSchedule: updateScheduleMock,
 }));
 
 vi.mock("@/components/ui", () => ({
@@ -27,64 +38,333 @@ vi.mock("@/components/ui", () => ({
   }),
 }));
 
+const seedConnectedProvider = () => {
+  useProviderWizardStore.setState({
+    providerId: "provider-1",
+    providerType: "gcp",
+    providerUid: "project-123",
+    mode: "add",
+  });
+};
+
+const lastFooterConfig = (onFooterChange: ReturnType<typeof vi.fn>) =>
+  onFooterChange.mock.calls.at(-1)?.[0];
+
 describe("LaunchStep", () => {
   beforeEach(() => {
+    vi.spyOn(Intl, "DateTimeFormat").mockReturnValue({
+      resolvedOptions: () => ({ timeZone: "Europe/Madrid" }),
+    } as Intl.DateTimeFormat);
     sessionStorage.clear();
     localStorage.clear();
+    updateScheduleMock.mockReset();
     scheduleDailyMock.mockReset();
     scanOnDemandMock.mockReset();
     toastMock.mockReset();
     useProviderWizardStore.getState().reset();
   });
 
-  it("launches a daily scan and shows toast", async () => {
-    // Given
-    const onClose = vi.fn();
-    const onFooterChange = vi.fn();
-    useProviderWizardStore.setState({
-      providerId: "provider-1",
-      providerType: "gcp",
-      providerUid: "project-123",
-      mode: "add",
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  describe("Prowler OSS (non-Cloud)", () => {
+    beforeEach(() => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+      scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
     });
 
-    scheduleDailyMock.mockResolvedValue({ data: { id: "scan-1" } });
+    it("defaults to run now and locks schedule mode outside Cloud", async () => {
+      // Given
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
 
-    render(
-      <LaunchStep
-        onBack={vi.fn()}
-        onClose={onClose}
-        onFooterChange={onFooterChange}
-      />,
-    );
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={vi.fn()}
+          onFooterChange={onFooterChange}
+        />,
+      );
 
-    await waitFor(() => {
-      expect(onFooterChange).toHaveBeenCalled();
+      // Then
+      expect(screen.getByText("Account Connected!")).toBeInTheDocument();
+      expect(screen.getByRole("radio", { name: "Run now" })).toBeChecked();
+      expect(
+        screen.getByRole("radio", { name: "On a schedule" }),
+      ).toBeDisabled();
+      expect(
+        screen.queryByRole("combobox", { name: /repeats/i }),
+      ).not.toBeInTheDocument();
+
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+      expect(lastFooterConfig(onFooterChange)?.actionLabel).toBe("Launch scan");
     });
 
-    // When
-    const initialFooterConfig = onFooterChange.mock.calls.at(-1)?.[0];
-    await act(async () => {
-      initialFooterConfig.onAction?.();
+    it("launches only an on-demand scan and never creates a legacy daily schedule", async () => {
+      // Given
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={onClose}
+          onFooterChange={onFooterChange}
+        />,
+      );
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      const sentFormData = scanOnDemandMock.mock.calls[0]?.[0] as FormData;
+      expect(sentFormData.get("providerId")).toBe("provider-1");
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      expect(updateScheduleMock).not.toHaveBeenCalled();
+      expect(onClose).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("Prowler Cloud subscribed", () => {
+    beforeEach(() => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+      updateScheduleMock.mockResolvedValue({ data: { id: "provider-1" } });
     });
 
-    // Then
-    await waitFor(() => {
-      expect(scheduleDailyMock).toHaveBeenCalledTimes(1);
+    it("defaults to schedule mode and saves through the new schedule API", async () => {
+      // Given
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={onClose}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+
+      // Then advanced cadence selector is enabled
+      expect(
+        screen.getByRole("radio", { name: "On a schedule" }),
+      ).toBeChecked();
+      expect(
+        screen.getByRole("combobox", { name: /repeats/i }),
+      ).not.toBeDisabled();
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(updateScheduleMock).toHaveBeenCalledTimes(1));
+      expect(updateScheduleMock).toHaveBeenCalledWith(
+        "provider-1",
+        expect.objectContaining({
+          scan_enabled: true,
+          scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+          scan_hour: expect.any(Number),
+          scan_timezone: "Europe/Madrid",
+          scan_day_of_week: null,
+          scan_day_of_month: null,
+        }),
+      );
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      expect(scanOnDemandMock).not.toHaveBeenCalled();
+      expect(onClose).toHaveBeenCalledTimes(1);
+      const toastPayload = toastMock.mock.calls[0]?.[0];
+      expect(toastPayload.action.props.children.props.href).toBe(
+        `/scans?tab=${SCAN_JOBS_TAB.SCHEDULED}`,
+      );
     });
 
-    const sentFormData = scheduleDailyMock.mock.calls[0]?.[0] as FormData;
-    expect(sentFormData.get("providerId")).toBe("provider-1");
-    expect(onClose).toHaveBeenCalledTimes(1);
-    expect(scanOnDemandMock).not.toHaveBeenCalled();
-    expect(toastMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        title: "Scan Launched",
-      }),
-    );
-    const toastPayload = toastMock.mock.calls[0]?.[0];
-    expect(toastPayload.action.props.children.props.href).toBe(
-      `/scans?tab=${SCAN_JOBS_TAB.ACTIVE}`,
-    );
+    it("also launches an on-demand scan when the checkbox is checked", async () => {
+      // Given
+      const user = userEvent.setup();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+      scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await user.click(
+        screen.getByRole("checkbox", { name: /launch an initial scan now/i }),
+      );
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(updateScheduleMock).toHaveBeenCalledTimes(1));
+      expect(scanOnDemandMock).toHaveBeenCalledTimes(1);
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      const toastPayload = toastMock.mock.calls[0]?.[0];
+      expect(toastPayload.action.props.children.props.href).toBe(
+        `/scans?tab=${SCAN_JOBS_TAB.ACTIVE}`,
+      );
+    });
+
+    it("launches only an on-demand scan when run now is selected", async () => {
+      // Given
+      const user = userEvent.setup();
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+      scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={onClose}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await user.click(
+        screen.getByRole("radio", {
+          name: "Run now",
+        }),
+      );
+      await waitFor(() =>
+        expect(lastFooterConfig(onFooterChange)?.actionLabel).toBe(
+          "Launch scan",
+        ),
+      );
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      expect(updateScheduleMock).not.toHaveBeenCalled();
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      expect(onClose).toHaveBeenCalledTimes(1);
+    });
+
+    it("does not launch an initial scan when the schedule save fails", async () => {
+      // Given
+      const user = userEvent.setup();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+      updateScheduleMock.mockResolvedValue({ error: "Schedule failed" });
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await user.click(
+        screen.getByRole("checkbox", { name: /launch an initial scan now/i }),
+      );
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(updateScheduleMock).toHaveBeenCalledTimes(1));
+      expect(scanOnDemandMock).not.toHaveBeenCalled();
+      expect(toastMock).toHaveBeenCalledWith(
+        expect.objectContaining({ title: "Unable to save scan schedule" }),
+      );
+    });
+  });
+
+  describe("Prowler Cloud trial/onboarding (manual scan only)", () => {
+    beforeEach(() => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+      scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
+    });
+
+    it("defaults to run now, locks schedule mode, and only launches a manual scan", async () => {
+      // Given
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={onClose}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+        />,
+      );
+
+      // Then no schedule cadence selector is rendered
+      expect(
+        screen.queryByRole("combobox", { name: /repeats/i }),
+      ).not.toBeInTheDocument();
+      expect(screen.getByRole("radio", { name: "Run now" })).toBeChecked();
+      expect(
+        screen.getByRole("radio", { name: "On a schedule" }),
+      ).toBeDisabled();
+      expect(
+        screen.getByText(/scheduled scans are not available/i),
+      ).toBeInTheDocument();
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+      expect(lastFooterConfig(onFooterChange)?.actionDisabled).toBe(false);
+      // The action launches a scan here, so it must not be labeled "Save".
+      expect(lastFooterConfig(onFooterChange)?.actionLabel).toBe("Launch scan");
+
+      // When
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      expect(updateScheduleMock).not.toHaveBeenCalled();
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      expect(onClose).toHaveBeenCalledTimes(1);
+    });
+
+    it("disables the action and shows the limit copy when over limit", async () => {
+      // Given
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+          isScanLimitReached
+        />,
+      );
+
+      // Then
+      expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+      expect(lastFooterConfig(onFooterChange)?.actionDisabled).toBe(true);
+    });
   });
 });
diff --git a/ui/components/providers/wizard/steps/launch-step.tsx b/ui/components/providers/wizard/steps/launch-step.tsx
index 1e63f6700d..db42d5be0e 100644
--- a/ui/components/providers/wizard/steps/launch-step.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.tsx
@@ -1,21 +1,42 @@
 "use client";
 
+import { zodResolver } from "@hookform/resolvers/zod";
 import Link from "next/link";
 import { useEffect, useRef, useState } from "react";
+import { useForm, useWatch } from "react-hook-form";
 
-import { scanOnDemand, scheduleDaily } from "@/actions/scans";
+import { scanOnDemand } from "@/actions/scans";
 import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@/components/shadcn/select/select";
+  SAVE_SCHEDULE_STATUS,
+  saveScheduleWithInitialScan,
+} from "@/components/scans/schedule/save-schedule";
+import { ScanScheduleFields } from "@/components/scans/schedule/scan-schedule-fields";
+import { Field, FieldLabel } from "@/components/shadcn";
+import {
+  RadioGroup,
+  RadioGroupItem,
+} from "@/components/shadcn/radio-group/radio-group";
 import { Spinner } from "@/components/shadcn/spinner/spinner";
 import { TreeStatusIcon } from "@/components/shadcn/tree-view/tree-status-icon";
+import {
+  CloudFeatureBadge,
+  CloudFeatureBadgeLink,
+} from "@/components/shared/cloud-feature-badge";
 import { ToastAction, useToast } from "@/components/ui";
+import { EntityInfo } from "@/components/ui/entities";
+import {
+  getScanScheduleCapability,
+  getScheduleFormDefaults,
+  scheduleFormSchema,
+} from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
 import { useProviderWizardStore } from "@/store/provider-wizard/store";
 import { SCAN_JOBS_TAB } from "@/types";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+  type ScheduleFormValues,
+} from "@/types/schedules";
 import { TREE_ITEM_STATUS } from "@/types/tree";
 
 import {
@@ -23,51 +44,94 @@ import {
   WizardFooterConfig,
 } from "./footer-controls";
 
-const SCAN_SCHEDULE = {
-  DAILY: "daily",
-  SINGLE: "single",
+const LAUNCH_MODE = {
+  NOW: "now",
+  SCHEDULE: "schedule",
 } as const;
 
-type ScanScheduleOption = (typeof SCAN_SCHEDULE)[keyof typeof SCAN_SCHEDULE];
+type LaunchMode = (typeof LAUNCH_MODE)[keyof typeof LAUNCH_MODE];
 
 interface LaunchStepProps {
   onBack: () => void;
   onClose: () => void;
   onFooterChange: (config: WizardFooterConfig) => void;
+  /**
+   * Schedule capability override. Absent in Prowler OSS (defaults to a
+   * Cloud-vs-non-Cloud decision). The prowler-cloud overlay computes a
+   * billing-aware capability and injects it here so trial/onboarding accounts
+   * are limited to manual scans.
+   */
+  capability?: ScanScheduleCapability;
+  /**
+   * When true, the manual scan action is disabled (account scan quota reached).
+   * Cloud-only signal; never set in OSS.
+   */
+  isScanLimitReached?: boolean;
 }
 
 export function LaunchStep({
   onBack,
   onClose,
   onFooterChange,
+  capability: capabilityProp,
+  isScanLimitReached = false,
 }: LaunchStepProps) {
   const { toast } = useToast();
-  const { providerId } = useProviderWizardStore();
+  const { providerAlias, providerId, providerType, providerUid } =
+    useProviderWizardStore();
+  const capability = capabilityProp ?? getScanScheduleCapability(isCloud());
+  const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
+  const isAdvanced = capability === SCAN_SCHEDULE_CAPABILITY.ADVANCED;
   const [isLaunching, setIsLaunching] = useState(false);
-  const [scheduleOption, setScheduleOption] = useState<ScanScheduleOption>(
-    SCAN_SCHEDULE.DAILY,
+  const [mode, setMode] = useState<LaunchMode>(
+    isAdvanced ? LAUNCH_MODE.SCHEDULE : LAUNCH_MODE.NOW,
   );
-  const launchActionRef = useRef<() => void>(() => {});
+  const form = useForm<ScheduleFormValues>({
+    resolver: zodResolver(scheduleFormSchema),
+    defaultValues: getScheduleFormDefaults(),
+  });
 
-  const handleLaunchScan = async () => {
-    if (!providerId) {
+  const isScheduleMode = isAdvanced && mode === LAUNCH_MODE.SCHEDULE;
+  const isLimitBlocked = mode === LAUNCH_MODE.NOW && isScanLimitReached;
+  const isActionBlocked = isLaunching || !providerId || isLimitBlocked;
+  const launchInitialScan = useWatch({
+    control: form.control,
+    name: "launchInitialScan",
+  });
+
+  const actionLabel = (() => {
+    if (!isScheduleMode) {
+      return isLaunching ? "Launching scan..." : "Launch scan";
+    }
+
+    if (isLaunching) {
+      return launchInitialScan ? "Saving and launching..." : "Saving...";
+    }
+
+    return launchInitialScan ? "Save and launch scan" : "Save";
+  })();
+
+  const launchOnDemandScan = async (): Promise<{ error?: unknown } | null> => {
+    if (!providerId) return null;
+    const formData = new FormData();
+    formData.set("providerId", providerId);
+    return scanOnDemand(formData);
+  };
+
+  const handleManualScan = async () => {
+    if (isScanLimitReached) {
       return;
     }
 
     setIsLaunching(true);
-    const formData = new FormData();
-    formData.set("providerId", providerId);
-    const result =
-      scheduleOption === SCAN_SCHEDULE.DAILY
-        ? await scheduleDaily(formData)
-        : await scanOnDemand(formData);
+    const scanResult = await launchOnDemandScan();
 
-    if (result?.error) {
+    if (scanResult?.error) {
       setIsLaunching(false);
       toast({
         variant: "destructive",
         title: "Unable to launch scan",
-        description: String(result.error),
+        description: String(scanResult.error),
       });
       return;
     }
@@ -75,11 +139,8 @@ export function LaunchStep({
     setIsLaunching(false);
     onClose();
     toast({
-      title: "Scan Launched",
-      description:
-        scheduleOption === SCAN_SCHEDULE.DAILY
-          ? "Daily scan scheduled successfully."
-          : "Single scan launched successfully.",
+      title: "Scan launched",
+      description: "The scan was launched successfully.",
       action: (
         <ToastAction altText="Go to scans" asChild>
           <Link href={`/scans?tab=${SCAN_JOBS_TAB.ACTIVE}`}>Go to scans</Link>
@@ -88,8 +149,69 @@ export function LaunchStep({
     });
   };
 
-  launchActionRef.current = () => {
-    void handleLaunchScan();
+  const handleSaveSchedule = form.handleSubmit(async (values) => {
+    if (!providerId) {
+      return;
+    }
+
+    setIsLaunching(true);
+
+    const result = await saveScheduleWithInitialScan({
+      providerId,
+      values,
+      useLegacyDaily: !isAdvanced,
+    });
+
+    setIsLaunching(false);
+
+    if (result.status === SAVE_SCHEDULE_STATUS.ERROR) {
+      toast({
+        variant: "destructive",
+        title: "Unable to save scan schedule",
+        description: result.message,
+      });
+      return;
+    }
+
+    onClose();
+
+    const launched = result.status === SAVE_SCHEDULE_STATUS.SAVED_AND_LAUNCHED;
+    const targetTab = launched ? SCAN_JOBS_TAB.ACTIVE : SCAN_JOBS_TAB.SCHEDULED;
+    const goToScans = (
+      <ToastAction altText="Go to scans" asChild>
+        <Link href={`/scans?tab=${targetTab}`}>Go to scans</Link>
+      </ToastAction>
+    );
+
+    if (result.status === SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED) {
+      toast({
+        title: "Scan schedule saved",
+        description: `The schedule was saved, but the initial scan could not be launched: ${result.message}`,
+        action: goToScans,
+      });
+      return;
+    }
+
+    toast({
+      title: launched
+        ? "Scan schedule saved and initial scan launched"
+        : "Scan schedule saved",
+      description: launched
+        ? "The schedule was saved and the initial scan was launched."
+        : "The scan schedule was saved successfully.",
+      action: goToScans,
+    });
+  });
+
+  // Keep the latest action handler in a ref so the footer (synced via effect)
+  // always invokes the current closure without re-running on every render.
+  const actionRef = useRef<() => void>(() => {});
+  actionRef.current = () => {
+    if (!isScheduleMode) {
+      void handleManualScan();
+      return;
+    }
+    void handleSaveSchedule();
   };
 
   useEffect(() => {
@@ -99,21 +221,30 @@ export function LaunchStep({
       backDisabled: isLaunching,
       onBack,
       showAction: true,
-      actionLabel: isLaunching ? "Launching scans..." : "Launch scan",
-      actionDisabled: isLaunching || !providerId,
+      actionLabel,
+      actionDisabled: isActionBlocked,
       actionType: WIZARD_FOOTER_ACTION_TYPE.BUTTON,
-      onAction: () => {
-        launchActionRef.current();
-      },
+      onAction: () => actionRef.current(),
     });
-  }, [isLaunching, onBack, onFooterChange, providerId]);
+  }, [
+    isActionBlocked,
+    isLaunching,
+    actionLabel,
+    isScheduleMode,
+    launchInitialScan,
+    mode,
+    onBack,
+    onFooterChange,
+  ]);
 
   if (isLaunching) {
     return (
       <div className="flex min-h-[320px] items-center justify-center">
         <div className="flex items-center gap-3 py-2">
           <Spinner className="size-6" />
-          <p className="text-sm font-medium">Launching scans...</p>
+          <p className="text-sm font-medium">
+            {!isScheduleMode ? "Launching scan..." : "Saving scan schedule..."}
+          </p>
         </div>
       </div>
     );
@@ -121,13 +252,21 @@ export function LaunchStep({
 
   return (
     <div className="flex min-h-0 flex-1 flex-col gap-6">
+      {(providerId || providerUid) && (
+        <EntityInfo
+          cloudProvider={providerType ?? undefined}
+          entityAlias={providerAlias ?? providerUid ?? providerId ?? undefined}
+          entityId={providerUid ?? providerId ?? undefined}
+        />
+      )}
+
       <div className="flex items-center gap-3">
         <TreeStatusIcon status={TREE_ITEM_STATUS.SUCCESS} className="size-6" />
-        <h3 className="text-sm font-semibold">Connection validated!</h3>
+        <h3 className="text-sm font-semibold">Account Connected!</h3>
       </div>
 
       <p className="text-text-neutral-secondary text-sm">
-        Choose how you want to launch scans for this provider.
+        Your account is connected to Prowler and ready to Scan!
       </p>
 
       {!providerId && (
@@ -136,28 +275,57 @@ export function LaunchStep({
         </p>
       )}
 
-      <div className="flex flex-col gap-4">
-        <p className="text-text-neutral-secondary text-sm">Scan schedule</p>
-        <Select
-          value={scheduleOption}
-          onValueChange={(value) =>
-            setScheduleOption(value as ScanScheduleOption)
-          }
-          disabled={isLaunching || !providerId}
+      <Field>
+        <FieldLabel>Mode</FieldLabel>
+        <RadioGroup
+          value={mode}
+          onValueChange={(value) => setMode(value as LaunchMode)}
+          className="flex flex-row flex-wrap gap-6"
+          aria-label="Scan mode"
         >
-          <SelectTrigger className="w-full max-w-[376px]">
-            <SelectValue />
-          </SelectTrigger>
-          <SelectContent>
-            <SelectItem value={SCAN_SCHEDULE.DAILY}>
-              Scan Daily (every 24 hours)
-            </SelectItem>
-            <SelectItem value={SCAN_SCHEDULE.SINGLE}>
-              Run a single scan (no recurring schedule)
-            </SelectItem>
-          </SelectContent>
-        </Select>
-      </div>
+          <label className="flex items-center gap-2 text-sm">
+            <RadioGroupItem value={LAUNCH_MODE.NOW} aria-label="Run now" />
+            Run now
+          </label>
+          <label className="flex items-center gap-2 text-sm">
+            <RadioGroupItem
+              value={LAUNCH_MODE.SCHEDULE}
+              aria-label="On a schedule"
+              disabled={!isAdvanced}
+            />
+            On a schedule
+            {!isAdvanced &&
+              (isManualOnly ? (
+                <CloudFeatureBadge label="Requires subscription" size="sm" />
+              ) : (
+                <CloudFeatureBadgeLink size="sm" />
+              ))}
+          </label>
+        </RadioGroup>
+      </Field>
+
+      {!isAdvanced && (
+        <p className="text-text-neutral-secondary text-sm">
+          Scheduled scans are not available for this account. Run now to get
+          immediate findings.
+        </p>
+      )}
+
+      {isLimitBlocked && (
+        <p className="text-text-error-primary text-sm">
+          You have reached your scan limit, so additional scans are not
+          available right now.
+        </p>
+      )}
+
+      {isScheduleMode && (
+        <ScanScheduleFields
+          form={form}
+          disabled={isLaunching || !providerId}
+          showLaunchInitialScan
+          showNextScheduledCopy
+        />
+      )}
     </div>
   );
 }
diff --git a/ui/components/providers/workflow/forms/connect-account-form.tsx b/ui/components/providers/workflow/forms/connect-account-form.tsx
index c4a242a5c3..ddc5038160 100644
--- a/ui/components/providers/workflow/forms/connect-account-form.tsx
+++ b/ui/components/providers/workflow/forms/connect-account-form.tsx
@@ -147,7 +147,6 @@ function applyBackStep({
   setPrevStep: Dispatch<SetStateAction<number>>;
   setAwsMethod: Dispatch<SetStateAction<"single" | null>>;
 }) {
-  // If in UID form after choosing single, go back to method selector
   if (prevStep === 2 && awsMethod === "single") {
     setAwsMethod(null);
     form.setValue("providerUid", "", { shouldValidate: false });
@@ -156,17 +155,14 @@ function applyBackStep({
   }
 
   setPrevStep((prev) => prev - 1);
-  // Deselect the providerType if the user is going back to the first step
   if (prevStep === 2) {
     form.setValue("providerType", undefined as unknown as ProviderType, {
       shouldValidate: false,
     });
     setAwsMethod(null);
   }
-  // Reset the providerUid and providerAlias fields when going back
   form.setValue("providerUid", "", { shouldValidate: false });
   form.setValue("providerAlias", "", { shouldValidate: false });
-  // Clear all validation errors so the radio buttons don't show red borders
   form.clearErrors();
 }
 
@@ -215,7 +211,6 @@ export const ConnectAccountForm = ({
       const data = await addProvider(formData);
 
       if (data?.errors && data.errors.length > 0) {
-        // Handle server-side validation errors
         data.errors.forEach((error: ApiError) => {
           const errorMessage = error.detail;
           const pointer = error.source?.pointer;
@@ -250,7 +245,6 @@ export const ConnectAccountForm = ({
         });
         return;
       } else {
-        // Go to the next step after successful submission
         const {
           id,
           attributes: { provider: createdProviderType, uid, alias },
@@ -347,11 +341,13 @@ export const ConnectAccountForm = ({
       >
         {/* Step 1: Provider selection */}
         {prevStep === 1 && (
-          <RadioGroupProvider
-            control={form.control}
-            isInvalid={!!form.formState.errors.providerType}
-            errorMessage={form.formState.errors.providerType?.message}
-          />
+          <div data-tour-id="add-provider-provider-type">
+            <RadioGroupProvider
+              control={form.control}
+              isInvalid={!!form.formState.errors.providerType}
+              errorMessage={form.formState.errors.providerType?.message}
+            />
+          </div>
         )}
         {/* Step 2: AWS method selector (only for AWS, before choosing method) */}
         {prevStep === 2 && providerType === "aws" && awsMethod === null && (
diff --git a/ui/components/runtime-config/runtime-public-config.tsx b/ui/components/runtime-config/runtime-public-config.tsx
new file mode 100644
index 0000000000..1069ac58d2
--- /dev/null
+++ b/ui/components/runtime-config/runtime-public-config.tsx
@@ -0,0 +1,17 @@
+import { getRuntimePublicConfig } from "@/lib/runtime-config";
+import { RUNTIME_CONFIG_SCRIPT_ID } from "@/lib/runtime-config.shared";
+import { serializeForScript } from "@/lib/safe-json";
+
+// Inert JSON config island (type="application/json") rendered in <head> before
+// the client bundle, so module-load consumers (Sentry init) read it race-free.
+export async function RuntimePublicConfig() {
+  const config = await getRuntimePublicConfig();
+
+  return (
+    <script
+      id={RUNTIME_CONFIG_SCRIPT_ID}
+      type="application/json"
+      dangerouslySetInnerHTML={{ __html: serializeForScript(config) }}
+    />
+  );
+}
diff --git a/ui/components/scans/launch-scan-modal.test.tsx b/ui/components/scans/launch-scan-modal.test.tsx
index c5ec901631..97e18dbcae 100644
--- a/ui/components/scans/launch-scan-modal.test.tsx
+++ b/ui/components/scans/launch-scan-modal.test.tsx
@@ -3,13 +3,35 @@ import userEvent from "@testing-library/user-event";
 import type { ComponentProps } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const { refreshMock, scanOnDemandMock, searchParamsValue, toastMock } =
-  vi.hoisted(() => ({
-    refreshMock: vi.fn(),
-    scanOnDemandMock: vi.fn(),
-    searchParamsValue: { current: "" },
-    toastMock: vi.fn(),
-  }));
+const {
+  getScheduleMock,
+  refreshMock,
+  scanOnDemandMock,
+  scheduleDailyMock,
+  searchParamsValue,
+  toastMock,
+  updateScheduleMock,
+} = vi.hoisted(() => ({
+  getScheduleMock: vi.fn(),
+  refreshMock: vi.fn(),
+  scanOnDemandMock: vi.fn(),
+  scheduleDailyMock: vi.fn(),
+  searchParamsValue: { current: "" },
+  toastMock: vi.fn(),
+  updateScheduleMock: vi.fn(),
+}));
+
+class ResizeObserverMock {
+  observe() {}
+  unobserve() {}
+  disconnect() {}
+}
+
+Object.defineProperty(globalThis, "ResizeObserver", {
+  writable: true,
+  configurable: true,
+  value: ResizeObserverMock,
+});
 
 vi.mock("next/navigation", () => ({
   useRouter: () => ({
@@ -20,6 +42,12 @@ vi.mock("next/navigation", () => ({
 
 vi.mock("@/actions/scans", () => ({
   scanOnDemand: scanOnDemandMock,
+  scheduleDaily: scheduleDailyMock,
+}));
+
+vi.mock("@/actions/schedules", () => ({
+  getSchedule: getScheduleMock,
+  updateSchedule: updateScheduleMock,
 }));
 
 vi.mock("@/components/ui/toast", () => ({
@@ -95,6 +123,8 @@ vi.mock("@/app/(prowler)/_overview/_components/accounts-selector", () => ({
   ),
 }));
 
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
+
 import { LaunchScanModal } from "./launch-scan-modal";
 
 const provider = {
@@ -303,4 +333,121 @@ describe("LaunchScanModal", () => {
     expect(refreshMock).not.toHaveBeenCalled();
     expect(onOpenChange).not.toHaveBeenCalledWith(false);
   });
+
+  describe("schedule mode", () => {
+    const weeklyScheduleResponse = {
+      data: {
+        type: "schedules",
+        id: provider.id,
+        attributes: {
+          scan_enabled: true,
+          scan_frequency: "WEEKLY",
+          scan_hour: 9,
+          scan_timezone: "Europe/Madrid",
+          scan_interval_hours: null,
+          scan_day_of_week: 1,
+          scan_day_of_month: null,
+        },
+      },
+    };
+
+    beforeEach(() => {
+      getScheduleMock.mockResolvedValue(weeklyScheduleResponse);
+      updateScheduleMock.mockResolvedValue({ data: { id: provider.id } });
+    });
+
+    const renderAdvanced = () =>
+      render(
+        <LaunchScanModal
+          open
+          onOpenChange={vi.fn()}
+          providers={[provider]}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+
+    it("prefills the provider schedule and saves it through the new API", async () => {
+      const user = userEvent.setup();
+      renderAdvanced();
+
+      await user.selectOptions(screen.getByLabelText("Providers"), provider.id);
+      await user.click(screen.getByRole("radio", { name: "On a schedule" }));
+
+      await waitFor(() =>
+        expect(getScheduleMock).toHaveBeenCalledWith(provider.id),
+      );
+
+      await user.click(
+        await screen.findByRole("button", { name: /save schedule/i }),
+      );
+
+      // The payload carries the fetched WEEKLY schedule, proving the prefill.
+      await waitFor(() =>
+        expect(updateScheduleMock).toHaveBeenCalledWith(
+          provider.id,
+          expect.objectContaining({
+            scan_enabled: true,
+            scan_frequency: "WEEKLY",
+            scan_hour: 9,
+            scan_day_of_week: 1,
+          }),
+        ),
+      );
+      expect(scanOnDemandMock).not.toHaveBeenCalled();
+      expect(toastMock).toHaveBeenCalledWith(
+        expect.objectContaining({ title: "Scan schedule saved" }),
+      );
+    });
+
+    it("launches the initial scan when the checkbox is checked", async () => {
+      const user = userEvent.setup();
+      renderAdvanced();
+
+      await user.selectOptions(screen.getByLabelText("Providers"), provider.id);
+      await user.click(screen.getByRole("radio", { name: "On a schedule" }));
+      await user.click(
+        await screen.findByLabelText(
+          "Launch an initial scan now for immediate findings",
+        ),
+      );
+      await user.click(screen.getByRole("button", { name: /save schedule/i }));
+
+      await waitFor(() => expect(updateScheduleMock).toHaveBeenCalled());
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      expect(toastMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          title: "Scan schedule saved and initial scan launched",
+        }),
+      );
+    });
+
+    it("locks schedule mode outside ADVANCED (OSS default)", () => {
+      render(
+        <LaunchScanModal open onOpenChange={vi.fn()} providers={[provider]} />,
+      );
+
+      expect(
+        screen.getByRole("radio", { name: "On a schedule" }),
+      ).toBeDisabled();
+      expect(getScheduleMock).not.toHaveBeenCalled();
+    });
+
+    it("hides the mode selector and blocks over-limit accounts in MANUAL_ONLY", () => {
+      render(
+        <LaunchScanModal
+          open
+          onOpenChange={vi.fn()}
+          providers={[provider]}
+          capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+          isScanLimitReached
+        />,
+      );
+
+      expect(screen.queryByRole("radio")).not.toBeInTheDocument();
+      expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+      expect(
+        screen.getByRole("button", { name: /launch scan/i }),
+      ).toBeDisabled();
+    });
+  });
 });
diff --git a/ui/components/scans/launch-scan-modal.tsx b/ui/components/scans/launch-scan-modal.tsx
index dd4b049c87..387f2a1f9e 100644
--- a/ui/components/scans/launch-scan-modal.tsx
+++ b/ui/components/scans/launch-scan-modal.tsx
@@ -1,23 +1,48 @@
 "use client";
 
 import { zodResolver } from "@hookform/resolvers/zod";
-import { CloudCog, Rocket } from "lucide-react";
+import { CloudCog, Loader2, Rocket } from "lucide-react";
 import Link from "next/link";
 import { useRouter, useSearchParams } from "next/navigation";
-import { useForm } from "react-hook-form";
+import { useRef, useState } from "react";
+import { useForm, useWatch } from "react-hook-form";
 import { z } from "zod";
 
 import { scanOnDemand } from "@/actions/scans";
+import { getSchedule } from "@/actions/schedules";
 import { AccountsSelector } from "@/app/(prowler)/_overview/_components/accounts-selector";
 import { Field, FieldError, FieldLabel, Input } from "@/components/shadcn";
 import { Modal } from "@/components/shadcn/modal";
+import {
+  RadioGroup,
+  RadioGroupItem,
+} from "@/components/shadcn/radio-group/radio-group";
+import { CloudFeatureBadgeLink } from "@/components/shared/cloud-feature-badge";
 import { FormButtons } from "@/components/ui/form";
 import { toast, ToastAction } from "@/components/ui/toast";
+import {
+  getScanScheduleCapability,
+  getScheduleFormDefaults,
+  getScheduleFormValues,
+  scheduleFormSchema,
+} from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
 import { SCAN_JOBS_TAB } from "@/types";
 import type { ProviderProps } from "@/types/providers";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+  type ScheduleApiResponse,
+  type ScheduleFormValues,
+} from "@/types/schedules";
 
 import { scanAliasSchema } from "./scan-alias-validation";
 import { getScanJobsTab } from "./scans.utils";
+import {
+  SAVE_SCHEDULE_STATUS,
+  saveScheduleWithInitialScan,
+} from "./schedule/save-schedule";
+import { ScanScheduleFields } from "./schedule/scan-schedule-fields";
 
 const launchScanSchema = z.object({
   providerId: z.string().min(1, "Select a provider to launch a scan."),
@@ -26,33 +51,112 @@ const launchScanSchema = z.object({
 
 type LaunchScanFormValues = z.infer<typeof launchScanSchema>;
 
+const LAUNCH_MODE = {
+  NOW: "now",
+  SCHEDULE: "schedule",
+} as const;
+
+type LaunchMode = (typeof LAUNCH_MODE)[keyof typeof LAUNCH_MODE];
+
+const SCHEDULE_LOAD_STATE = {
+  IDLE: "idle",
+  LOADING: "loading",
+  LOADED: "loaded",
+  ERROR: "error",
+} as const;
+
+type ScheduleLoadState =
+  (typeof SCHEDULE_LOAD_STATE)[keyof typeof SCHEDULE_LOAD_STATE];
+
 interface LaunchScanModalProps {
   open: boolean;
   onOpenChange: (open: boolean) => void;
   providers: ProviderProps[];
+  /** Cloud overlay seam; defaults to the environment-resolved capability. */
+  capability?: ScanScheduleCapability;
+  isScanLimitReached?: boolean;
 }
 
 interface LaunchScanFormProps {
   providers: ProviderProps[];
   onClose: () => void;
+  capability: ScanScheduleCapability;
+  isScanLimitReached: boolean;
 }
 
-function LaunchScanForm({ providers, onClose }: LaunchScanFormProps) {
+function LaunchScanForm({
+  providers,
+  onClose,
+  capability,
+  isScanLimitReached,
+}: LaunchScanFormProps) {
   const router = useRouter();
   const searchParams = useSearchParams();
   const form = useForm<LaunchScanFormValues>({
     resolver: zodResolver(launchScanSchema),
     defaultValues: { providerId: "", scanAlias: "" },
   });
+  const scheduleForm = useForm<ScheduleFormValues>({
+    resolver: zodResolver(scheduleFormSchema),
+    defaultValues: getScheduleFormDefaults(),
+  });
+  const [mode, setMode] = useState<LaunchMode>(LAUNCH_MODE.NOW);
+  const [scheduleLoad, setScheduleLoad] = useState<ScheduleLoadState>(
+    SCHEDULE_LOAD_STATE.IDLE,
+  );
+  // Guards against out-of-order responses when switching providers quickly.
+  const requestedProviderRef = useRef<string>("");
 
-  const providerId = form.watch("providerId");
+  const isAdvanced = capability === SCAN_SCHEDULE_CAPABILITY.ADVANCED;
+  const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
+  const isScheduleMode = mode === LAUNCH_MODE.SCHEDULE;
+
+  // useWatch, not form.watch: form.watch re-renders are dropped by React Compiler memoization.
+  const providerId = useWatch({ control: form.control, name: "providerId" });
   const activeTab = getScanJobsTab(searchParams.get("tab") ?? undefined);
   const shouldShowActiveTabAction = activeTab !== SCAN_JOBS_TAB.ACTIVE;
   const disconnectedProviderIds = providers
     .filter((provider) => provider.attributes.connection.connected !== true)
     .map((provider) => provider.id);
 
-  const onSubmit = form.handleSubmit(async ({ providerId, scanAlias }) => {
+  const loadSchedule = async (id: string) => {
+    requestedProviderRef.current = id;
+    if (!id) {
+      setScheduleLoad(SCHEDULE_LOAD_STATE.IDLE);
+      return;
+    }
+
+    setScheduleLoad(SCHEDULE_LOAD_STATE.LOADING);
+    const response = (await getSchedule(id)) as
+      | ScheduleApiResponse
+      | { error?: string };
+
+    if (requestedProviderRef.current !== id) return;
+
+    if (!response || ("error" in response && response.error)) {
+      setScheduleLoad(SCHEDULE_LOAD_STATE.ERROR);
+      return;
+    }
+
+    scheduleForm.reset(
+      getScheduleFormValues(
+        "data" in response ? response.data?.attributes : null,
+      ),
+    );
+    setScheduleLoad(SCHEDULE_LOAD_STATE.LOADED);
+  };
+
+  const handleProviderChange = (id: string) => {
+    form.setValue("providerId", id, { shouldValidate: true });
+    if (isScheduleMode) void loadSchedule(id);
+  };
+
+  const handleModeChange = (nextMode: string) => {
+    setMode(nextMode as LaunchMode);
+    if (nextMode === LAUNCH_MODE.SCHEDULE) void loadSchedule(providerId);
+  };
+
+  const launchNow = form.handleSubmit(async ({ providerId, scanAlias }) => {
     const formData = new FormData();
     formData.set("providerId", providerId);
     const trimmedAlias = scanAlias?.trim();
@@ -87,13 +191,66 @@ function LaunchScanForm({ providers, onClose }: LaunchScanFormProps) {
     router.refresh();
   });
 
+  const saveSchedule = async () => {
+    const providerValid = await form.trigger("providerId");
+    if (!providerValid) return;
+
+    await scheduleForm.handleSubmit(async (values) => {
+      const result = await saveScheduleWithInitialScan({
+        providerId: form.getValues("providerId"),
+        values,
+      });
+
+      if (result.status === SAVE_SCHEDULE_STATUS.ERROR) {
+        form.setError("root", { message: result.message });
+        return;
+      }
+
+      const launched =
+        result.status === SAVE_SCHEDULE_STATUS.SAVED_AND_LAUNCHED;
+      toast({
+        title: launched
+          ? "Scan schedule saved and initial scan launched"
+          : "Scan schedule saved",
+        description:
+          result.status === SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED
+            ? `The schedule was saved, but the initial scan could not be launched: ${result.message}`
+            : launched
+              ? "The schedule was saved and the initial scan was launched."
+              : "The scan schedule was saved successfully.",
+        action: (
+          <ToastAction altText="View scheduled scans" asChild>
+            <Link href={`/scans?tab=${SCAN_JOBS_TAB.SCHEDULED}`}>
+              View schedule
+            </Link>
+          </ToastAction>
+        ),
+      });
+      onClose();
+      router.refresh();
+    })();
+  };
+
+  const onSubmit = (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    if (isScheduleMode) {
+      void saveSchedule();
+      return;
+    }
+    void launchNow();
+  };
+
   const providerError = form.formState.errors.providerId?.message;
   const aliasError = form.formState.errors.scanAlias?.message;
   const rootError = form.formState.errors.root?.message;
-  const isSubmitting = form.formState.isSubmitting;
+  const isSubmitting =
+    form.formState.isSubmitting || scheduleForm.formState.isSubmitting;
+  const isScheduleLoading = scheduleLoad === SCHEDULE_LOAD_STATE.LOADING;
+  const isLimitBlocked = isManualOnly && isScanLimitReached;
 
   return (
-    <form onSubmit={onSubmit} className="flex flex-col gap-8">
+    // min-w-0: let this dialog grid item shrink so a long provider UID truncates instead of widening the modal
+    <form onSubmit={onSubmit} className="flex min-w-0 flex-col gap-8">
       <div className="flex items-center gap-2">
         <CloudCog className="text-text-neutral-secondary size-4" />
         <span className="text-text-neutral-secondary text-sm">
@@ -108,9 +265,7 @@ function LaunchScanForm({ providers, onClose }: LaunchScanFormProps) {
           providers={providers}
           disabledValues={disconnectedProviderIds}
           onBatchChange={(_, values) =>
-            form.setValue("providerId", values.at(-1) ?? "", {
-              shouldValidate: true,
-            })
+            handleProviderChange(values.at(-1) ?? "")
           }
           selectedValues={providerId ? [providerId] : []}
           closeOnSelect
@@ -118,23 +273,93 @@ function LaunchScanForm({ providers, onClose }: LaunchScanFormProps) {
         {providerError && <FieldError>{providerError}</FieldError>}
       </Field>
 
-      <Field>
-        <FieldLabel htmlFor="launch-scan-alias">Alias (optional)</FieldLabel>
-        <Input
-          id="launch-scan-alias"
-          aria-label="Alias"
-          {...form.register("scanAlias")}
+      {!isManualOnly && (
+        <Field>
+          <FieldLabel>Mode</FieldLabel>
+          <RadioGroup
+            value={mode}
+            onValueChange={handleModeChange}
+            className="flex flex-row flex-wrap gap-6"
+            aria-label="Scan mode"
+          >
+            <label className="flex items-center gap-2 text-sm">
+              <RadioGroupItem value={LAUNCH_MODE.NOW} aria-label="Run now" />
+              Run now
+            </label>
+            <label className="flex items-center gap-2 text-sm">
+              <RadioGroupItem
+                value={LAUNCH_MODE.SCHEDULE}
+                aria-label="On a schedule"
+                disabled={!isAdvanced}
+              />
+              On a schedule
+              {!isAdvanced && <CloudFeatureBadgeLink size="sm" />}
+            </label>
+          </RadioGroup>
+        </Field>
+      )}
+
+      {isLimitBlocked && (
+        <p className="text-text-error-primary text-sm">
+          You have reached your scan limit, so additional scans are not
+          available right now.
+        </p>
+      )}
+
+      {!isScheduleMode && (
+        <Field>
+          <FieldLabel htmlFor="launch-scan-alias">Alias (optional)</FieldLabel>
+          <Input
+            id="launch-scan-alias"
+            aria-label="Alias"
+            {...form.register("scanAlias")}
+          />
+          {aliasError && <FieldError>{aliasError}</FieldError>}
+        </Field>
+      )}
+
+      {isScheduleMode && isScheduleLoading && (
+        <div className="flex items-center gap-3 py-2">
+          <Loader2 className="size-5 animate-spin" />
+          <span className="text-sm">Loading scan schedule...</span>
+        </div>
+      )}
+
+      {isScheduleMode && scheduleLoad === SCHEDULE_LOAD_STATE.ERROR && (
+        <FieldError>
+          Failed to load the current scan schedule. Saving will overwrite it.
+        </FieldError>
+      )}
+
+      {isScheduleMode && !isScheduleLoading && (
+        <ScanScheduleFields
+          form={scheduleForm}
+          disabled={isSubmitting || !providerId}
+          showLaunchInitialScan
+          showNextScheduledCopy
         />
-        {aliasError && <FieldError>{aliasError}</FieldError>}
-      </Field>
+      )}
 
       {rootError && <FieldError>{rootError}</FieldError>}
 
       <FormButtons
         onCancel={onClose}
-        submitText={isSubmitting ? "Launching..." : "Launch Scan"}
-        loadingText="Launching..."
-        isDisabled={isSubmitting || !providers.length}
+        submitText={
+          isSubmitting
+            ? isScheduleMode
+              ? "Saving..."
+              : "Launching..."
+            : isScheduleMode
+              ? "Save Schedule"
+              : "Launch Scan"
+        }
+        loadingText={isScheduleMode ? "Saving..." : "Launching..."}
+        isDisabled={
+          isSubmitting ||
+          !providers.length ||
+          isScheduleLoading ||
+          isLimitBlocked
+        }
         rightIcon={<Rocket className="size-4" />}
       />
     </form>
@@ -145,7 +370,11 @@ export function LaunchScanModal({
   open,
   onOpenChange,
   providers,
+  capability,
+  isScanLimitReached = false,
 }: LaunchScanModalProps) {
+  const resolvedCapability = capability ?? getScanScheduleCapability(isCloud());
+
   return (
     <Modal
       open={open}
@@ -157,6 +386,8 @@ export function LaunchScanModal({
       <LaunchScanForm
         providers={providers}
         onClose={() => onOpenChange(false)}
+        capability={resolvedCapability}
+        isScanLimitReached={isScanLimitReached}
       />
     </Modal>
   );
diff --git a/ui/components/scans/no-providers-added.tsx b/ui/components/scans/no-providers-added.tsx
deleted file mode 100644
index a108009c2d..0000000000
--- a/ui/components/scans/no-providers-added.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-"use client";
-
-import { Button, Card, CardContent } from "@/components/shadcn";
-
-import { InfoIcon } from "../icons/Icons";
-
-interface NoProvidersAddedProps {
-  onOpenWizard: () => void;
-}
-
-export const NoProvidersAdded = ({ onOpenWizard }: NoProvidersAddedProps) => (
-  <div className="flex min-h-screen items-center justify-center">
-    <Card variant="base" className="mx-auto w-full max-w-3xl">
-      <CardContent className="flex flex-col items-center gap-4 p-6 text-center sm:p-8">
-        <div className="flex flex-col items-center gap-4">
-          <InfoIcon className="h-10 w-10 text-gray-800 dark:text-white" />
-          <h2 className="text-2xl font-bold text-gray-800 dark:text-white">
-            No Providers Configured
-          </h2>
-        </div>
-        <div className="flex flex-col items-center gap-3">
-          <p className="text-md leading-relaxed text-gray-600 dark:text-gray-300">
-            No providers have been configured. Start by setting up a provider.
-          </p>
-        </div>
-
-        <Button
-          aria-label="Open Add Provider modal"
-          className="w-full max-w-xs justify-center"
-          size="lg"
-          onClick={onOpenWizard}
-        >
-          Get Started
-        </Button>
-      </CardContent>
-    </Card>
-  </div>
-);
diff --git a/ui/components/scans/scans-page-shell.test.tsx b/ui/components/scans/scans-page-shell.test.tsx
index 8c3bbddd7d..d8a40407e7 100644
--- a/ui/components/scans/scans-page-shell.test.tsx
+++ b/ui/components/scans/scans-page-shell.test.tsx
@@ -302,9 +302,10 @@ describe("ScansPageShell", () => {
     expect(screen.getByRole("dialog")).toHaveTextContent(/launch scan/i);
   });
 
-  it("strips the launchScan URL param when closing the URL-opened modal", async () => {
+  it("strips the launchScan URL param via the History API when closing the URL-opened modal", async () => {
     vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
     searchParamsValue.current = "tab=completed&launchScan=true";
+    const replaceStateSpy = vi.spyOn(window.history, "replaceState");
     const user = userEvent.setup();
 
     render(
@@ -316,11 +317,17 @@ describe("ScansPageShell", () => {
     await user.click(screen.getByRole("button", { name: /close/i }));
 
     expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
-    expect(replaceMock).toHaveBeenCalledWith(
+    // History API (not router.replace) so Next.js does not refetch and reload the page;
+    // scanOnDemand's revalidatePath already refreshes the list when a scan launches.
+    expect(replaceStateSpy).toHaveBeenCalledWith(
+      null,
+      "",
       "/scans?tab=completed",
-      expect.objectContaining({ scroll: false }),
     );
+    expect(replaceMock).not.toHaveBeenCalled();
     expect(pushMock).not.toHaveBeenCalled();
+
+    replaceStateSpy.mockRestore();
   });
 
   it("opens and closes the launch scan modal from client state without navigation", async () => {
diff --git a/ui/components/scans/scans-page-shell.tsx b/ui/components/scans/scans-page-shell.tsx
index 7e068f3f58..4682ff6dfb 100644
--- a/ui/components/scans/scans-page-shell.tsx
+++ b/ui/components/scans/scans-page-shell.tsx
@@ -1,8 +1,9 @@
 "use client";
 
-import { usePathname, useRouter, useSearchParams } from "next/navigation";
-import { type ReactNode, useState } from "react";
+import { usePathname, useSearchParams } from "next/navigation";
+import { type ReactNode, Suspense, useState } from "react";
 
+import { OnboardingTrigger, PageReady } from "@/components/onboarding";
 import { MutedFindingsConfigButton } from "@/components/providers/muted-findings-config-button";
 import {
   Button,
@@ -11,13 +12,18 @@ import {
   TabsList,
   TabsTrigger,
 } from "@/components/shadcn";
+import { getFlowById } from "@/lib/onboarding";
 import {
   LAUNCH_SCAN_SEARCH_PARAM,
   LAUNCH_SCAN_SEARCH_VALUE,
 } from "@/lib/scans-navigation";
+import { buildViewFirstScanTour } from "@/lib/tours/view-first-scan.tour";
 import { useScansStore } from "@/store";
 import { SCAN_JOBS_TAB, SCAN_TAB_LABELS, type ScanJobsTab } from "@/types";
 import type { ProviderProps } from "@/types/providers";
+import type { ScanScheduleCapability } from "@/types/schedules";
+
+const viewFirstScanFlow = getFlowById("view-first-scan")!;
 
 import { CliImportBanner } from "./cli-import-banner";
 import { LaunchScanModal } from "./launch-scan-modal";
@@ -29,6 +35,9 @@ interface ScansPageShellProps {
   hasManageScansPermission: boolean;
   activeScanCount?: number;
   children: ReactNode;
+  /** Cloud overlay seam for the launch-scan modal. */
+  scanScheduleCapability?: ScanScheduleCapability;
+  isScanLimitReached?: boolean;
 }
 
 export function ScansPageShell({
@@ -36,8 +45,9 @@ export function ScansPageShell({
   hasManageScansPermission,
   activeScanCount = 0,
   children,
+  scanScheduleCapability,
+  isScanLimitReached,
 }: ScansPageShellProps) {
-  const router = useRouter();
   const pathname = usePathname();
   const searchParams = useSearchParams();
   const [urlLaunchOpen, setUrlLaunchOpen] = useState(
@@ -57,6 +67,9 @@ export function ScansPageShell({
   const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
   const launchDisabled = !hasManageScansPermission || !hasConnectedProviders;
   const launchOpen = isLaunchScanModalOpen || urlLaunchOpen;
+  // When a scan is already running, the tour highlights its row (anchored in
+  // ScanJobsTable); otherwise it falls back to the Launch Scan button + tabs.
+  const hasInProgressScan = activeScanCount > 0;
 
   const getTabLabel = (tab: ScanJobsTab) => {
     const label = SCAN_TAB_LABELS[tab];
@@ -69,17 +82,33 @@ export function ScansPageShell({
     setLaunchScanModalOpen(open);
     if (open) return;
     setUrlLaunchOpen(false);
+    // Remove ?launchScan via History API (not router.replace) to avoid an RSC
+    // refetch that reloads the page; revalidatePath in scanOnDemand already
+    // refreshes the scans list when a scan is launched.
     if (!searchParams.has(LAUNCH_SCAN_SEARCH_PARAM)) return;
     const params = new URLSearchParams(searchParams.toString());
     params.delete(LAUNCH_SCAN_SEARCH_PARAM);
     const query = params.toString();
-    router.replace(query ? `${pathname}?${query}` : pathname, {
-      scroll: false,
-    });
+    window.history.replaceState(
+      null,
+      "",
+      query ? `${pathname}?${query}` : pathname,
+    );
   };
 
   return (
     <div className="flex flex-col gap-[18px]">
+      {/* Suspense required: OnboardingTrigger reads useSearchParams */}
+      <Suspense fallback={null}>
+        <OnboardingTrigger
+          flow={{
+            ...viewFirstScanFlow,
+            tour: buildViewFirstScanTour(hasInProgressScan),
+          }}
+        />
+      </Suspense>
+      {/* Signals the navbar that this route's data has loaded (enables the replay icon). */}
+      <PageReady />
       <div
         role="group"
         aria-label="Scan filters and actions"
@@ -101,6 +130,7 @@ export function ScansPageShell({
           onClick={() => handleLaunchOpenChange(true)}
           disabled={launchDisabled}
           className="w-full md:w-auto"
+          data-tour-id="view-first-scan-launch"
         >
           Launch Scan
         </Button>
@@ -118,7 +148,10 @@ export function ScansPageShell({
           aria-label="Scan tabs"
           className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between"
         >
-          <TabsList className="overflow-x-auto">
+          <TabsList
+            className="overflow-x-auto"
+            data-tour-id="view-first-scan-tabs"
+          >
             {Object.values(SCAN_JOBS_TAB).map((tab) => (
               <TabsTrigger key={tab} value={tab}>
                 {getTabLabel(tab as ScanJobsTab)}
@@ -138,6 +171,8 @@ export function ScansPageShell({
         open={launchOpen}
         onOpenChange={handleLaunchOpenChange}
         providers={providers}
+        capability={scanScheduleCapability}
+        isScanLimitReached={isScanLimitReached}
       />
     </div>
   );
diff --git a/ui/components/scans/scans-providers-empty-state.test.tsx b/ui/components/scans/scans-providers-empty-state.test.tsx
index dc6748a785..deee8318e3 100644
--- a/ui/components/scans/scans-providers-empty-state.test.tsx
+++ b/ui/components/scans/scans-providers-empty-state.test.tsx
@@ -1,73 +1,43 @@
 import { render, screen } from "@testing-library/react";
-import userEvent from "@testing-library/user-event";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { describe, expect, it, vi } from "vitest";
+
+import { ADD_PROVIDER_HREF } from "@/lib/providers-navigation";
 
 import { ScansProvidersEmptyState } from "./scans-providers-empty-state";
 
-const { replaceMock, searchParamsValue } = vi.hoisted(() => ({
-  replaceMock: vi.fn(),
-  searchParamsValue: { current: "" },
-}));
-
-vi.mock("next/navigation", () => ({
-  usePathname: () => "/scans",
-  useRouter: () => ({
-    replace: replaceMock,
-  }),
-  useSearchParams: () => new URLSearchParams(searchParamsValue.current),
-}));
-
-vi.mock("@/components/providers/wizard", () => ({
-  ProviderWizardModal: ({ open }: { open: boolean }) =>
-    open ? <div role="dialog">Provider wizard</div> : null,
-}));
-
 vi.mock("./no-providers-connected", () => ({
   NoProvidersConnected: () => <div>No Connected Providers</div>,
 }));
 
 describe("ScansProvidersEmptyState", () => {
-  afterEach(() => {
-    vi.clearAllMocks();
-    searchParamsValue.current = "";
-  });
-
-  it("shows the add provider message and opens the provider wizard", async () => {
-    const user = userEvent.setup();
-
+  it("shows the add provider message with a providers page CTA", () => {
+    // Given/When
     render(<ScansProvidersEmptyState thereIsNoProviders />);
 
-    expect(screen.getByText("No Providers Configured")).toBeInTheDocument();
-
-    await user.click(
-      screen.getByRole("button", { name: /open add provider modal/i }),
-    );
-
-    expect(screen.getByRole("dialog")).toHaveTextContent("Provider wizard");
-  });
-
-  it("clears the launch scan URL intent before opening the provider wizard", async () => {
-    // Given
-    searchParamsValue.current = "tab=completed&launchScan=true";
-    const user = userEvent.setup();
-
-    render(<ScansProvidersEmptyState thereIsNoProviders />);
-
-    // When
-    await user.click(
-      screen.getByRole("button", { name: /open add provider modal/i }),
-    );
-
     // Then
-    expect(replaceMock).toHaveBeenCalledWith("/scans?tab=completed", {
-      scroll: false,
+    expect(screen.getByText("No Providers Configured")).toBeInTheDocument();
+    const cta = screen.getByRole("link", {
+      name: /open add provider modal/i,
     });
-    expect(screen.getByRole("dialog")).toHaveTextContent("Provider wizard");
+
+    expect(cta).toHaveAttribute("href", ADD_PROVIDER_HREF);
+    expect(cta.tagName).toBe("A");
+  });
+
+  it("does not render the provider wizard in Scans", () => {
+    // Given/When
+    render(<ScansProvidersEmptyState thereIsNoProviders />);
+
+    // Then
+    expect(screen.getByText("No Providers Configured")).toBeInTheDocument();
+    expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
   });
 
   it("shows the no connected providers message", () => {
+    // Given/When
     render(<ScansProvidersEmptyState thereIsNoProviders={false} />);
 
+    // Then
     expect(screen.getByText("No Connected Providers")).toBeInTheDocument();
     expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
   });
diff --git a/ui/components/scans/scans-providers-empty-state.tsx b/ui/components/scans/scans-providers-empty-state.tsx
index 7837dcea2c..09258320f9 100644
--- a/ui/components/scans/scans-providers-empty-state.tsx
+++ b/ui/components/scans/scans-providers-empty-state.tsx
@@ -1,12 +1,6 @@
-"use client";
+import { NoProvidersAdded } from "@/components/providers/no-providers-added";
+import { ADD_PROVIDER_HREF } from "@/lib/providers-navigation";
 
-import { usePathname, useRouter, useSearchParams } from "next/navigation";
-import { useState } from "react";
-
-import { ProviderWizardModal } from "@/components/providers/wizard";
-import { LAUNCH_SCAN_SEARCH_PARAM } from "@/lib/scans-navigation";
-
-import { NoProvidersAdded } from "./no-providers-added";
 import { NoProvidersConnected } from "./no-providers-connected";
 
 interface ScansProvidersEmptyStateProps {
@@ -16,35 +10,13 @@ interface ScansProvidersEmptyStateProps {
 export function ScansProvidersEmptyState({
   thereIsNoProviders,
 }: ScansProvidersEmptyStateProps) {
-  const pathname = usePathname();
-  const router = useRouter();
-  const searchParams = useSearchParams();
-  const [isProviderWizardOpen, setIsProviderWizardOpen] = useState(false);
-
-  const openProviderWizard = () => {
-    if (searchParams.has(LAUNCH_SCAN_SEARCH_PARAM)) {
-      const params = new URLSearchParams(searchParams.toString());
-      params.delete(LAUNCH_SCAN_SEARCH_PARAM);
-      const query = params.toString();
-      router.replace(query ? `${pathname}?${query}` : pathname, {
-        scroll: false,
-      });
-    }
-
-    setIsProviderWizardOpen(true);
-  };
-
   return (
     <>
       {thereIsNoProviders ? (
-        <NoProvidersAdded onOpenWizard={openProviderWizard} />
+        <NoProvidersAdded action="link" href={ADD_PROVIDER_HREF} />
       ) : (
         <NoProvidersConnected />
       )}
-      <ProviderWizardModal
-        open={isProviderWizardOpen}
-        onOpenChange={setIsProviderWizardOpen}
-      />
     </>
   );
 }
diff --git a/ui/components/scans/scans.utils.test.ts b/ui/components/scans/scans.utils.test.ts
index 8568f86a86..1639f8f5a6 100644
--- a/ui/components/scans/scans.utils.test.ts
+++ b/ui/components/scans/scans.utils.test.ts
@@ -1,6 +1,8 @@
 import { describe, expect, it } from "vitest";
 
 import {
+  type MetaDataProps,
+  type ProviderProps,
   SCAN_JOBS_TAB,
   type ScanAttributes,
   type ScanProps,
@@ -8,6 +10,8 @@ import {
 } from "@/types";
 
 import {
+  appendPendingScheduleRowsToPage,
+  buildPendingScheduleRows,
   formatScanDuration,
   getScanAlias,
   getScanFindingsSummary,
@@ -109,9 +113,9 @@ describe("scans.utils", () => {
   it("formats scan labels and durations for table display", () => {
     expect(getScanAlias(makeScan(""))).toBe("-");
     expect(getScanAlias(makeScan("Daily scheduled scan", "scheduled"))).toBe(
-      "scheduled scan",
+      "Scheduled Scan",
     );
-    expect(getScanAlias(makeScan("", "scheduled"))).toBe("scheduled scan");
+    expect(getScanAlias(makeScan("", "scheduled"))).toBe("Scheduled Scan");
     expect(getScanAlias(makeScan("Production scan"))).toBe("Production scan");
     expect(formatScanDuration(73)).toBe("1 min 13 sec");
     expect(formatScanDuration(null)).toBe("-");
@@ -161,3 +165,233 @@ describe("scans.utils", () => {
     expect(getScanFindingsSummary(makeScan("x").attributes)).toBeNull();
   });
 });
+
+describe("buildPendingScheduleRows", () => {
+  const now = new Date("2026-06-10T10:30:00Z");
+
+  const makeProvider = (id: string): ProviderProps => ({
+    id,
+    type: "providers",
+    attributes: {
+      provider: "aws",
+      uid: `uid-${id}`,
+      alias: `alias-${id}`,
+      status: "completed",
+      resources: 0,
+      connection: {
+        connected: true,
+        last_checked_at: "2026-06-10T10:00:00Z",
+      },
+      scanner_args: {
+        only_logs: false,
+        excluded_checks: [],
+        aws_retries_max_attempts: 3,
+      },
+      inserted_at: "2026-06-10T10:00:00Z",
+      updated_at: "2026-06-10T10:00:00Z",
+      created_by: {
+        object: "users",
+        id: "user-1",
+      },
+    },
+    relationships: {
+      secret: { data: null },
+      provider_groups: { meta: { count: 0 }, data: [] },
+    },
+  });
+
+  const makeScheduledScan = (id: string, providerId: string): ScanProps => ({
+    ...makeScan("Scheduled Scan", "scheduled"),
+    id,
+    relationships: {
+      provider: { data: { type: "providers", id: providerId } },
+      task: { data: { type: "tasks", id: `task-${id}` } },
+    },
+  });
+
+  const makeMeta = ({
+    page,
+    pages,
+    count,
+  }: {
+    page: number;
+    pages: number;
+    count: number;
+  }): MetaDataProps => ({
+    pagination: {
+      page,
+      pages,
+      count,
+      itemsPerPage: [1, 2, 10],
+    },
+    version: "v1",
+  });
+
+  const weeklySchedule = {
+    scan_enabled: true,
+    scan_frequency: "WEEKLY",
+    scan_hour: 9,
+    scan_timezone: "Europe/Madrid",
+    scan_interval_hours: null,
+    scan_day_of_week: 1,
+    scan_day_of_month: null,
+  } as const;
+
+  it("synthesizes a pending row for a configured schedule without scan rows", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: { p1: weeklySchedule },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    expect(rows).toHaveLength(1);
+    expect(rows[0].id).toBe("pending-schedule-p1");
+    expect(rows[0].attributes.state).toBe("scheduled");
+    expect(rows[0].attributes.trigger).toBe("scheduled");
+    expect(rows[0].pendingSchedule?.summary).toBe(
+      "Weekly on Monday @ 9:00am (Europe/Madrid)",
+    );
+    expect(rows[0].pendingSchedule?.cadence).toBe("Weekly on Monday");
+    expect(rows[0].providerInfo?.uid).toBe("uid-p1");
+  });
+
+  it("uses global covered providers when appending pending rows", () => {
+    // Given - p1 has a real scheduled scan on a previous page, p2 only has a configured schedule.
+    const result = appendPendingScheduleRowsToPage({
+      scans: [],
+      meta: makeMeta({ page: 2, pages: 1, count: 1 }),
+      page: 2,
+      pageSize: 1,
+      providers: [makeProvider("p1"), makeProvider("p2")],
+      schedulesByProviderId: {
+        p1: weeklySchedule,
+        p2: weeklySchedule,
+      },
+      coveredProviderIds: new Set(["p1"]),
+      now,
+    });
+
+    // Then - p1 is not duplicated as a synthetic pending row.
+    expect(result.data.map((scan) => scan.id)).toEqual(["pending-schedule-p2"]);
+    expect(result.meta?.pagination.count).toBe(2);
+    expect(result.meta?.pagination.pages).toBe(2);
+  });
+
+  it("keeps the last real page within page size and carries pending rows to the next page", () => {
+    // Given - three real scheduled scans and two pending schedules at page size 2.
+    const providers = ["p1", "p2", "p3", "p4", "p5"].map(makeProvider);
+    const schedulesByProviderId = Object.fromEntries(
+      providers.map((provider) => [provider.id, weeklySchedule]),
+    );
+
+    const lastRealPage = appendPendingScheduleRowsToPage({
+      scans: [makeScheduledScan("scan-3", "p3")],
+      meta: makeMeta({ page: 2, pages: 2, count: 3 }),
+      page: 2,
+      pageSize: 2,
+      providers,
+      schedulesByProviderId,
+      coveredProviderIds: new Set(["p1", "p2", "p3"]),
+      now,
+    });
+
+    const firstPendingOnlyPage = appendPendingScheduleRowsToPage({
+      scans: [],
+      meta: makeMeta({ page: 3, pages: 2, count: 3 }),
+      page: 3,
+      pageSize: 2,
+      providers,
+      schedulesByProviderId,
+      coveredProviderIds: new Set(["p1", "p2", "p3"]),
+      now,
+    });
+
+    // Then - page 2 gets one pending row, page 3 gets the remaining pending row.
+    expect(lastRealPage.data.map((scan) => scan.id)).toEqual([
+      "scan-3",
+      "pending-schedule-p4",
+    ]);
+    expect(lastRealPage.meta?.pagination.count).toBe(5);
+    expect(lastRealPage.meta?.pagination.pages).toBe(3);
+    expect(firstPendingOnlyPage.data.map((scan) => scan.id)).toEqual([
+      "pending-schedule-p5",
+    ]);
+  });
+
+  it("shows pending rows on an otherwise empty scheduled tab with coherent metadata", () => {
+    // Given
+    const result = appendPendingScheduleRowsToPage({
+      scans: [],
+      meta: makeMeta({ page: 1, pages: 0, count: 0 }),
+      page: 1,
+      pageSize: 10,
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: { p1: weeklySchedule },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    // Then
+    expect(result.data.map((scan) => scan.id)).toEqual(["pending-schedule-p1"]);
+    expect(result.meta?.pagination.count).toBe(1);
+    expect(result.meta?.pagination.pages).toBe(1);
+    expect(result.meta?.pagination.page).toBe(1);
+  });
+
+  it("prefers the server-computed next_scan_at and carries last_scan_at", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: {
+        p1: {
+          ...weeklySchedule,
+          next_scan_at: "2026-06-15T00:00:00Z",
+          last_scan_at: "2026-06-01T10:00:00Z",
+        },
+      },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    expect(rows[0].attributes.scheduled_at).toBe("2026-06-15T00:00:00Z");
+    expect(rows[0].pendingSchedule?.nextScanAt).toBe("2026-06-15T00:00:00Z");
+    expect(rows[0].pendingSchedule?.lastScanAt).toBe("2026-06-01T10:00:00Z");
+  });
+
+  it("falls back to a client estimate when next_scan_at is absent", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: { p1: weeklySchedule },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    expect(rows[0].attributes.scheduled_at).not.toBeNull();
+    expect(rows[0].pendingSchedule?.lastScanAt).toBeNull();
+  });
+
+  it("skips providers already covered by a real scheduled scan row", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: { p1: weeklySchedule },
+      coveredProviderIds: new Set(["p1"]),
+      now,
+    });
+
+    expect(rows).toHaveLength(0);
+  });
+
+  it("skips unconfigured and disabled schedules", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1"), makeProvider("p2"), makeProvider("p3")],
+      schedulesByProviderId: {
+        p1: { ...weeklySchedule, scan_hour: null },
+        p2: { ...weeklySchedule, scan_enabled: false },
+      },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    expect(rows).toHaveLength(0);
+  });
+});
diff --git a/ui/components/scans/scans.utils.ts b/ui/components/scans/scans.utils.ts
index f7c8f546f4..4d96046019 100644
--- a/ui/components/scans/scans.utils.ts
+++ b/ui/components/scans/scans.utils.ts
@@ -1,5 +1,13 @@
+import {
+  describeScheduleCadence,
+  getNextScheduledRunInTimezone,
+  getScheduleCadenceParts,
+  isScheduleConfigured,
+} from "@/lib/schedules";
 import {
   DEFAULT_SCAN_JOBS_TAB,
+  type MetaDataProps,
+  type ProviderProps,
   SCAN_JOBS_TAB,
   SCAN_STATE,
   SCAN_TRIGGER,
@@ -9,6 +17,7 @@ import {
   type ScanProps,
   type ScanState,
   type ScanTrigger,
+  type ScheduleAttributes,
   type SearchParamsProps,
 } from "@/types";
 
@@ -136,7 +145,7 @@ export function getScanJobsTabFilters(
 
 export function getScanAlias(scan: ScanProps): string {
   if (scan.attributes.trigger === SCAN_TRIGGER.SCHEDULED)
-    return "scheduled scan";
+    return "Scheduled Scan";
   return scan.attributes.name?.trim() || "-";
 }
 
@@ -179,6 +188,142 @@ export function getScanStatusFilterOptions(
   ];
 }
 
+export interface BuildPendingScheduleRowsParams {
+  providers: ProviderProps[];
+  schedulesByProviderId: Record<string, ScheduleAttributes>;
+  /** Providers that already have a real `state=scheduled` Scan row. */
+  coveredProviderIds: Set<string>;
+  now: Date;
+}
+
+interface AppendPendingScheduleRowsToPageParams
+  extends BuildPendingScheduleRowsParams {
+  scans: ScanProps[];
+  meta?: MetaDataProps;
+  page: number;
+  pageSize: number;
+}
+
+/**
+ * Synthesizes Scheduled-tab rows for configured schedules without a Scan row
+ * yet (the backend only creates one after each run).
+ */
+export function buildPendingScheduleRows({
+  providers,
+  schedulesByProviderId,
+  coveredProviderIds,
+  now,
+}: BuildPendingScheduleRowsParams): ScanProps[] {
+  return providers.flatMap((provider) => {
+    if (coveredProviderIds.has(provider.id)) return [];
+
+    const schedule = schedulesByProviderId[provider.id];
+    if (!schedule || !isScheduleConfigured(schedule) || !schedule.scan_enabled)
+      return [];
+
+    // Prefer the server-computed next fire time; fall back to a client estimate.
+    const nextScanAt =
+      schedule.next_scan_at ??
+      getNextScheduledRunInTimezone(schedule, now)?.toISOString() ??
+      null;
+
+    return [
+      {
+        type: "scans" as const,
+        id: `pending-schedule-${provider.id}`,
+        attributes: {
+          name: "",
+          trigger: SCAN_TRIGGER.SCHEDULED,
+          state: SCAN_STATE.SCHEDULED,
+          unique_resource_count: 0,
+          progress: 0,
+          scanner_args: null,
+          duration: null,
+          started_at: null,
+          inserted_at: now.toISOString(),
+          completed_at: null,
+          scheduled_at: nextScanAt,
+          next_scan_at: null,
+        },
+        relationships: {
+          provider: { data: { type: "providers", id: provider.id } },
+          // No Celery task behind synthetic rows.
+          task: { data: { type: "tasks", id: "" } },
+        },
+        providerInfo: {
+          provider: provider.attributes.provider,
+          uid: provider.attributes.uid,
+          alias: provider.attributes.alias,
+        },
+        pendingSchedule: {
+          summary: describeScheduleCadence(schedule),
+          cadence: getScheduleCadenceParts(schedule).cadence,
+          nextScanAt,
+          lastScanAt: schedule.last_scan_at ?? null,
+        },
+      },
+    ];
+  });
+}
+
+export function getProviderIdsFromScans(scans: ScanProps[]): Set<string> {
+  return new Set(
+    scans
+      .map((scan) => scan.relationships?.provider?.data?.id)
+      .filter((id): id is string => Boolean(id)),
+  );
+}
+
+export function appendPendingScheduleRowsToPage({
+  scans,
+  meta,
+  page,
+  pageSize,
+  providers,
+  schedulesByProviderId,
+  coveredProviderIds,
+  now,
+}: AppendPendingScheduleRowsToPageParams): {
+  data: ScanProps[];
+  meta?: MetaDataProps;
+} {
+  // The API paginates real scheduled scans, while pending rows come from
+  // configured schedules without a scan yet. Reconcile both sources here so the
+  // rendered rows and pagination metadata describe the same combined list.
+  const pendingRows = buildPendingScheduleRows({
+    providers,
+    schedulesByProviderId,
+    coveredProviderIds,
+    now,
+  });
+  const safePageSize = Math.max(1, pageSize);
+  const realCount = meta?.pagination.count ?? scans.length;
+  const pendingStart = Math.max(0, (page - 1) * safePageSize - realCount);
+  const pendingSlots = Math.max(0, safePageSize - scans.length);
+  const pagePendingRows = pendingRows.slice(
+    pendingStart,
+    pendingStart + pendingSlots,
+  );
+  const combinedCount = realCount + pendingRows.length;
+  const combinedPages =
+    combinedCount === 0 ? 0 : Math.ceil(combinedCount / safePageSize);
+
+  return {
+    data: [...scans, ...pagePendingRows],
+    meta: meta
+      ? {
+          ...meta,
+          pagination: {
+            ...meta.pagination,
+            page,
+            count: combinedCount,
+            pages: combinedPages,
+          },
+        }
+      : undefined,
+  };
+}
+
 function getNumericValue(
   source: Record<string, unknown>,
   keys: string[],
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
new file mode 100644
index 0000000000..9d1e96b46a
--- /dev/null
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
@@ -0,0 +1,165 @@
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { refreshMock, removeScheduleMock, toastMock, updateScheduleMock } =
+  vi.hoisted(() => ({
+    refreshMock: vi.fn(),
+    removeScheduleMock: vi.fn(),
+    toastMock: vi.fn(),
+    updateScheduleMock: vi.fn(),
+  }));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ refresh: refreshMock }),
+}));
+
+vi.mock("@/actions/schedules", () => ({
+  removeSchedule: removeScheduleMock,
+  updateSchedule: updateScheduleMock,
+}));
+
+vi.mock("@/components/ui/toast", () => ({
+  toast: toastMock,
+}));
+
+vi.mock("@/components/ui/entities", () => ({
+  EntityInfo: () => null,
+}));
+
+vi.mock("@/components/shadcn/modal", () => ({
+  Modal: ({
+    children,
+    open,
+    title,
+  }: {
+    children: React.ReactNode;
+    open: boolean;
+    title: string;
+  }) =>
+    open ? (
+      <div role="dialog" aria-label={title}>
+        {children}
+      </div>
+    ) : null,
+}));
+
+import type { ScheduleProps } from "@/types/schedules";
+
+import {
+  EDIT_SCAN_SCHEDULE_STATE,
+  EditScanScheduleModal,
+} from "./edit-scan-schedule-modal";
+
+const provider = {
+  providerId: "p1",
+  providerType: "aws" as const,
+  providerUid: "123456789012",
+  providerAlias: "Production",
+};
+
+const schedule: ScheduleProps = {
+  type: "schedules",
+  id: "p1",
+  attributes: {
+    scan_enabled: true,
+    scan_frequency: "DAILY",
+    scan_hour: 4,
+    scan_timezone: "UTC",
+    scan_interval_hours: null,
+    scan_day_of_week: null,
+    scan_day_of_month: null,
+  },
+  relationships: {
+    provider: { data: { type: "providers", id: "p1" } },
+  },
+};
+
+const renderLoaded = () =>
+  render(
+    <EditScanScheduleModal
+      open
+      onOpenChange={vi.fn()}
+      provider={provider}
+      state={{ kind: EDIT_SCAN_SCHEDULE_STATE.LOADED, schedule }}
+    />,
+  );
+
+describe("EditScanScheduleModal remove flow", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    removeScheduleMock.mockResolvedValue({ success: true });
+  });
+
+  it("asks for confirmation before removing the schedule", async () => {
+    const user = userEvent.setup();
+    renderLoaded();
+
+    await user.click(
+      screen.getByRole("button", { name: /remove scan schedule/i }),
+    );
+
+    expect(removeScheduleMock).not.toHaveBeenCalled();
+    expect(
+      screen.getByRole("dialog", { name: "Are you absolutely sure?" }),
+    ).toBeInTheDocument();
+  });
+
+  it("removes the schedule only after confirming", async () => {
+    const user = userEvent.setup();
+    renderLoaded();
+
+    await user.click(
+      screen.getByRole("button", { name: /remove scan schedule/i }),
+    );
+    const confirmDialog = screen.getByRole("dialog", {
+      name: "Are you absolutely sure?",
+    });
+    await user.click(
+      within(confirmDialog).getByRole("button", { name: "Remove" }),
+    );
+
+    await waitFor(() => expect(removeScheduleMock).toHaveBeenCalledWith("p1"));
+    expect(toastMock).toHaveBeenCalledWith(
+      expect.objectContaining({ title: "Scan schedule removed" }),
+    );
+  });
+
+  it("hides the remove button when the provider has no configured schedule", () => {
+    render(
+      <EditScanScheduleModal
+        open
+        onOpenChange={vi.fn()}
+        provider={provider}
+        state={{
+          kind: EDIT_SCAN_SCHEDULE_STATE.LOADED,
+          schedule: {
+            ...schedule,
+            attributes: { ...schedule.attributes, scan_hour: null },
+          },
+        }}
+      />,
+    );
+
+    expect(
+      screen.queryByRole("button", { name: /remove scan schedule/i }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("keeps the schedule when the confirmation is cancelled", async () => {
+    const user = userEvent.setup();
+    renderLoaded();
+
+    await user.click(
+      screen.getByRole("button", { name: /remove scan schedule/i }),
+    );
+    const confirmDialog = screen.getByRole("dialog", {
+      name: "Are you absolutely sure?",
+    });
+    await user.click(
+      within(confirmDialog).getByRole("button", { name: "Cancel" }),
+    );
+
+    expect(removeScheduleMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
new file mode 100644
index 0000000000..c84d79e7f3
--- /dev/null
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
@@ -0,0 +1,227 @@
+"use client";
+
+import { zodResolver } from "@hookform/resolvers/zod";
+import { CircleX, Loader2 } from "lucide-react";
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+import { useForm } from "react-hook-form";
+
+import { removeSchedule, updateSchedule } from "@/actions/schedules";
+import { Button, FieldError } from "@/components/shadcn";
+import { Modal } from "@/components/shadcn/modal";
+import { EntityInfo } from "@/components/ui/entities";
+import { FormButtons } from "@/components/ui/form";
+import { toast } from "@/components/ui/toast";
+import {
+  buildScheduleUpdatePayload,
+  getScheduleFormValues,
+  isScheduleConfigured,
+  scheduleFormSchema,
+} from "@/lib/schedules";
+import type { ProviderType, ScheduleProps } from "@/types";
+import type { ScheduleFormValues } from "@/types/schedules";
+
+import { ScanScheduleFields } from "./scan-schedule-fields";
+
+export interface ScanScheduleProvider {
+  providerId: string;
+  providerType: ProviderType;
+  providerUid: string;
+  providerAlias: string | null;
+}
+
+export const EDIT_SCAN_SCHEDULE_STATE = {
+  LOADING: "loading",
+  LOADED: "loaded",
+  ERROR: "error",
+} as const;
+
+export type EditScanScheduleState =
+  | { kind: typeof EDIT_SCAN_SCHEDULE_STATE.LOADING }
+  | {
+      kind: typeof EDIT_SCAN_SCHEDULE_STATE.LOADED;
+      schedule: ScheduleProps | null;
+    }
+  | { kind: typeof EDIT_SCAN_SCHEDULE_STATE.ERROR; message: string };
+
+interface EditScanScheduleFormProps {
+  provider: ScanScheduleProvider;
+  schedule: ScheduleProps | null;
+  onClose: () => void;
+}
+
+interface EditScanScheduleModalProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  provider?: ScanScheduleProvider;
+  state: EditScanScheduleState;
+}
+
+function EditScanScheduleForm({
+  provider,
+  schedule,
+  onClose,
+}: EditScanScheduleFormProps) {
+  const router = useRouter();
+  const [isConfirmRemoveOpen, setIsConfirmRemoveOpen] = useState(false);
+  const [isRemoving, setIsRemoving] = useState(false);
+  const form = useForm<ScheduleFormValues>({
+    resolver: zodResolver(scheduleFormSchema),
+    defaultValues: getScheduleFormValues(schedule?.attributes),
+  });
+  const hasSchedule = schedule
+    ? isScheduleConfigured(schedule.attributes)
+    : false;
+
+  const onSubmit = form.handleSubmit(async (values) => {
+    const result = await updateSchedule(
+      provider.providerId,
+      buildScheduleUpdatePayload(values),
+    );
+
+    if (result?.error) {
+      form.setError("root", { message: String(result.error) });
+      return;
+    }
+
+    toast({
+      title: "Scan schedule saved",
+      description: "The scan schedule was updated successfully.",
+    });
+    onClose();
+    router.refresh();
+  });
+
+  const handleRemove = async () => {
+    setIsRemoving(true);
+    const result = await removeSchedule(provider.providerId);
+    setIsRemoving(false);
+    setIsConfirmRemoveOpen(false);
+
+    if (result?.error) {
+      form.setError("root", { message: String(result.error) });
+      return;
+    }
+
+    toast({
+      title: "Scan schedule removed",
+      description: "The scan schedule was removed successfully.",
+    });
+    onClose();
+    router.refresh();
+  };
+
+  const isSubmitting = form.formState.isSubmitting;
+  const rootError = form.formState.errors.root?.message;
+
+  return (
+    <form onSubmit={onSubmit} className="flex flex-col gap-8">
+      <EntityInfo
+        cloudProvider={provider.providerType}
+        entityAlias={provider.providerAlias ?? provider.providerUid}
+        entityId={provider.providerUid}
+      />
+
+      <ScanScheduleFields
+        form={form}
+        disabled={isSubmitting || isRemoving}
+        headerAction={
+          hasSchedule ? (
+            <Button
+              type="button"
+              variant="ghost"
+              onClick={() => setIsConfirmRemoveOpen(true)}
+              disabled={isSubmitting || isRemoving}
+              className="text-text-error-primary"
+            >
+              <CircleX className="size-4" />
+              Remove Scan Schedule
+            </Button>
+          ) : undefined
+        }
+      />
+
+      {rootError && <FieldError>{rootError}</FieldError>}
+
+      <FormButtons
+        onCancel={onClose}
+        submitText={isSubmitting ? "Saving..." : "Save"}
+        loadingText="Saving..."
+        isDisabled={isSubmitting || isRemoving}
+      />
+
+      <Modal
+        open={isConfirmRemoveOpen}
+        onOpenChange={setIsConfirmRemoveOpen}
+        title="Are you absolutely sure?"
+        description="This action cannot be undone. The scan schedule for this provider will be removed and scans will no longer run automatically."
+      >
+        <div className="flex w-full justify-end gap-4">
+          <Button
+            type="button"
+            variant="ghost"
+            size="lg"
+            onClick={() => setIsConfirmRemoveOpen(false)}
+            disabled={isRemoving}
+          >
+            Cancel
+          </Button>
+          <Button
+            type="button"
+            variant="destructive"
+            size="lg"
+            onClick={() => void handleRemove()}
+            disabled={isRemoving}
+          >
+            <CircleX className="size-4" />
+            {isRemoving ? "Removing..." : "Remove"}
+          </Button>
+        </div>
+      </Modal>
+    </form>
+  );
+}
+
+export function EditScanScheduleModal({
+  open,
+  onOpenChange,
+  provider,
+  state,
+}: EditScanScheduleModalProps) {
+  const close = () => onOpenChange(false);
+
+  return (
+    <Modal
+      open={open}
+      onOpenChange={onOpenChange}
+      title="Edit Scan Schedule"
+      size="2xl"
+      className="gap-8"
+    >
+      {state.kind === EDIT_SCAN_SCHEDULE_STATE.LOADING && (
+        <div className="flex min-h-[240px] items-center justify-center gap-3">
+          <Loader2 className="size-5 animate-spin" />
+          <span className="text-sm">Loading scan schedule...</span>
+        </div>
+      )}
+
+      {state.kind === EDIT_SCAN_SCHEDULE_STATE.ERROR && (
+        <div className="flex flex-col gap-6">
+          <FieldError>{state.message}</FieldError>
+          <Button type="button" variant="outline" onClick={close}>
+            Close
+          </Button>
+        </div>
+      )}
+
+      {state.kind === EDIT_SCAN_SCHEDULE_STATE.LOADED && provider && (
+        <EditScanScheduleForm
+          key={`${provider.providerId}-${state.schedule?.attributes.scan_hour ?? "none"}`}
+          provider={provider}
+          schedule={state.schedule}
+          onClose={close}
+        />
+      )}
+    </Modal>
+  );
+}
diff --git a/ui/components/scans/schedule/save-schedule.test.ts b/ui/components/scans/schedule/save-schedule.test.ts
new file mode 100644
index 0000000000..cf56f1fb18
--- /dev/null
+++ b/ui/components/scans/schedule/save-schedule.test.ts
@@ -0,0 +1,115 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { SCHEDULE_FREQUENCY, type ScheduleFormValues } from "@/types/schedules";
+
+const { scanOnDemandMock, scheduleDailyMock, updateScheduleMock } = vi.hoisted(
+  () => ({
+    scanOnDemandMock: vi.fn(),
+    scheduleDailyMock: vi.fn(),
+    updateScheduleMock: vi.fn(),
+  }),
+);
+
+vi.mock("@/actions/scans", () => ({
+  scanOnDemand: scanOnDemandMock,
+  scheduleDaily: scheduleDailyMock,
+}));
+
+vi.mock("@/actions/schedules", () => ({
+  updateSchedule: updateScheduleMock,
+}));
+
+import {
+  SAVE_SCHEDULE_STATUS,
+  saveScheduleWithInitialScan,
+} from "./save-schedule";
+
+const values: ScheduleFormValues = {
+  frequency: SCHEDULE_FREQUENCY.WEEKLY,
+  hour: 9,
+  dayOfWeek: 1,
+  dayOfMonth: 1,
+  intervalHours: 48,
+  launchInitialScan: false,
+};
+
+describe("saveScheduleWithInitialScan", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    updateScheduleMock.mockResolvedValue({});
+    scheduleDailyMock.mockResolvedValue({});
+    scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
+  });
+
+  it("saves through the schedules API with the mapped payload", async () => {
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values,
+    });
+
+    expect(result.status).toBe(SAVE_SCHEDULE_STATUS.SAVED);
+    expect(updateScheduleMock).toHaveBeenCalledWith(
+      "p1",
+      expect.objectContaining({
+        scan_enabled: true,
+        scan_frequency: SCHEDULE_FREQUENCY.WEEKLY,
+        scan_hour: 9,
+        scan_day_of_week: 1,
+      }),
+    );
+    expect(scheduleDailyMock).not.toHaveBeenCalled();
+    expect(scanOnDemandMock).not.toHaveBeenCalled();
+  });
+
+  it("uses the legacy daily endpoint when requested", async () => {
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values,
+      useLegacyDaily: true,
+    });
+
+    expect(result.status).toBe(SAVE_SCHEDULE_STATUS.SAVED);
+    expect(scheduleDailyMock).toHaveBeenCalledTimes(1);
+    expect(updateScheduleMock).not.toHaveBeenCalled();
+  });
+
+  it("returns an error status when the schedule save fails", async () => {
+    updateScheduleMock.mockResolvedValue({ error: "boom" });
+
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values,
+    });
+
+    expect(result).toEqual({
+      status: SAVE_SCHEDULE_STATUS.ERROR,
+      message: "boom",
+    });
+    expect(scanOnDemandMock).not.toHaveBeenCalled();
+  });
+
+  it("launches the initial scan when requested", async () => {
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values: { ...values, launchInitialScan: true },
+    });
+
+    expect(result.status).toBe(SAVE_SCHEDULE_STATUS.SAVED_AND_LAUNCHED);
+    const formData = scanOnDemandMock.mock.calls[0][0] as FormData;
+    expect(formData.get("providerId")).toBe("p1");
+  });
+
+  it("reports partial success when the initial scan fails", async () => {
+    scanOnDemandMock.mockResolvedValue({ error: "limit reached" });
+
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values: { ...values, launchInitialScan: true },
+    });
+
+    expect(result).toEqual({
+      status: SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED,
+      message: "limit reached",
+    });
+  });
+});
diff --git a/ui/components/scans/schedule/save-schedule.ts b/ui/components/scans/schedule/save-schedule.ts
new file mode 100644
index 0000000000..7e3cfabb45
--- /dev/null
+++ b/ui/components/scans/schedule/save-schedule.ts
@@ -0,0 +1,70 @@
+import { scanOnDemand, scheduleDaily } from "@/actions/scans";
+import { updateSchedule } from "@/actions/schedules";
+import { buildScheduleUpdatePayload } from "@/lib/schedules";
+import type { ScheduleFormValues } from "@/types/schedules";
+
+export const SAVE_SCHEDULE_STATUS = {
+  ERROR: "error",
+  SAVED: "saved",
+  SAVED_AND_LAUNCHED: "saved_and_launched",
+  SAVED_SCAN_FAILED: "saved_scan_failed",
+} as const;
+
+export type SaveScheduleStatus =
+  (typeof SAVE_SCHEDULE_STATUS)[keyof typeof SAVE_SCHEDULE_STATUS];
+
+export interface SaveScheduleParams {
+  providerId: string;
+  values: ScheduleFormValues;
+  /** Save through the legacy `/schedules/daily` endpoint (OSS / non-Cloud). */
+  useLegacyDaily?: boolean;
+}
+
+export interface SaveScheduleResult {
+  status: SaveScheduleStatus;
+  message?: string;
+}
+
+/** Saves a provider's scan schedule and optionally launches the initial scan. */
+export async function saveScheduleWithInitialScan({
+  providerId,
+  values,
+  useLegacyDaily = false,
+}: SaveScheduleParams): Promise<SaveScheduleResult> {
+  let scheduleResult: { error?: unknown } | null;
+
+  if (useLegacyDaily) {
+    const formData = new FormData();
+    formData.set("providerId", providerId);
+    scheduleResult = await scheduleDaily(formData);
+  } else {
+    scheduleResult = await updateSchedule(
+      providerId,
+      buildScheduleUpdatePayload(values),
+    );
+  }
+
+  if (scheduleResult?.error) {
+    return {
+      status: SAVE_SCHEDULE_STATUS.ERROR,
+      message: String(scheduleResult.error),
+    };
+  }
+
+  if (!values.launchInitialScan) {
+    return { status: SAVE_SCHEDULE_STATUS.SAVED };
+  }
+
+  const formData = new FormData();
+  formData.set("providerId", providerId);
+  const scanResult = await scanOnDemand(formData);
+
+  if (scanResult?.error) {
+    return {
+      status: SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED,
+      message: String(scanResult.error),
+    };
+  }
+
+  return { status: SAVE_SCHEDULE_STATUS.SAVED_AND_LAUNCHED };
+}
diff --git a/ui/components/scans/schedule/scan-schedule-fields.test.tsx b/ui/components/scans/schedule/scan-schedule-fields.test.tsx
new file mode 100644
index 0000000000..ed8774db5f
--- /dev/null
+++ b/ui/components/scans/schedule/scan-schedule-fields.test.tsx
@@ -0,0 +1,76 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { useForm } from "react-hook-form";
+import { beforeAll, describe, expect, it, vi } from "vitest";
+
+import { getScheduleFormDefaults } from "@/lib/schedules";
+import type { ScheduleFormValues } from "@/types/schedules";
+
+import { ScanScheduleFields } from "./scan-schedule-fields";
+
+beforeAll(() => {
+  Object.defineProperty(HTMLElement.prototype, "hasPointerCapture", {
+    configurable: true,
+    value: vi.fn(() => false),
+  });
+  Object.defineProperty(HTMLElement.prototype, "setPointerCapture", {
+    configurable: true,
+    value: vi.fn(),
+  });
+  Object.defineProperty(HTMLElement.prototype, "releasePointerCapture", {
+    configurable: true,
+    value: vi.fn(),
+  });
+  Object.defineProperty(HTMLElement.prototype, "scrollIntoView", {
+    configurable: true,
+    value: vi.fn(),
+  });
+});
+
+function ScheduleFieldsHarness() {
+  const form = useForm<ScheduleFormValues>({
+    defaultValues: getScheduleFormDefaults(),
+  });
+
+  return (
+    <ScanScheduleFields
+      form={form}
+      showNextScheduledCopy
+      canUseAdvancedSchedule
+    />
+  );
+}
+
+function getHelperCopy(text: RegExp) {
+  return screen.getByText((_, element) => {
+    return (
+      element?.tagName.toLowerCase() === "p" &&
+      text.test(element.textContent ?? "")
+    );
+  });
+}
+
+describe("ScanScheduleFields", () => {
+  it("updates the helper copy when the cadence changes to interval", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(<ScheduleFieldsHarness />);
+
+    expect(getHelperCopy(/Daily/)).toBeInTheDocument();
+
+    // When
+    await user.click(screen.getByRole("combobox", { name: /repeats/i }));
+    await user.click(screen.getByRole("option", { name: /every 48 hours/i }));
+
+    // Then
+    expect(getHelperCopy(/Every 48 hours/)).toBeInTheDocument();
+    expect(
+      screen.queryByText((_, element) => {
+        return (
+          element?.tagName.toLowerCase() === "p" &&
+          /Daily/.test(element.textContent ?? "")
+        );
+      }),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/ui/components/scans/schedule/scan-schedule-fields.tsx b/ui/components/scans/schedule/scan-schedule-fields.tsx
new file mode 100644
index 0000000000..d01883b23c
--- /dev/null
+++ b/ui/components/scans/schedule/scan-schedule-fields.tsx
@@ -0,0 +1,301 @@
+"use client";
+
+import { format } from "date-fns";
+import { CalendarClock } from "lucide-react";
+import type { ReactNode } from "react";
+import { Controller, type UseFormReturn, useWatch } from "react-hook-form";
+
+import {
+  Checkbox,
+  Field,
+  FieldLabel,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/shadcn";
+import { CloudFeatureBadgeLink } from "@/components/shared/cloud-feature-badge";
+import {
+  formatScheduleHour,
+  getBrowserTimezone,
+  getNextScheduledRun,
+} from "@/lib/schedules";
+import {
+  SCHEDULE_FREQUENCY,
+  SCHEDULE_WEEKDAY_LABELS,
+  type ScheduleFormValues,
+} from "@/types/schedules";
+
+// The INTERVAL label is resolved at render time from the form's intervalHours.
+const FREQUENCY_OPTIONS = [
+  { value: SCHEDULE_FREQUENCY.DAILY, label: "Daily" },
+  { value: SCHEDULE_FREQUENCY.INTERVAL, label: null },
+  { value: SCHEDULE_FREQUENCY.WEEKLY, label: "Weekly" },
+  { value: SCHEDULE_FREQUENCY.MONTHLY, label: "Monthly" },
+] as const;
+
+const WEEKDAY_OPTIONS = SCHEDULE_WEEKDAY_LABELS.map((label, value) => ({
+  value,
+  label,
+}));
+
+const HOUR_OPTIONS = Array.from({ length: 24 }, (_, hour) => ({
+  value: hour,
+  label: formatScheduleHour(hour),
+}));
+
+const MONTH_DAY_OPTIONS = Array.from({ length: 28 }, (_, index) => index + 1);
+
+interface ScanScheduleFieldsProps {
+  form: UseFormReturn<ScheduleFormValues>;
+  disabled?: boolean;
+  showLaunchInitialScan?: boolean;
+  showNextScheduledCopy?: boolean;
+  /** Rendered at the right of the "Scan Schedule" header row. */
+  headerAction?: ReactNode;
+  /**
+   * When false, the frequency is locked to `Daily` and the advanced cadences
+   * (interval/weekly/monthly) are disabled. Used for non-Cloud (OSS) accounts.
+   */
+  canUseAdvancedSchedule?: boolean;
+  /** Render the "Available in Prowler Cloud" upsell badge on locked controls. */
+  showCloudUpgradeBadge?: boolean;
+}
+
+function NumberSelect({
+  label,
+  labelAddon,
+  value,
+  values,
+  onChange,
+  disabled,
+}: {
+  label: string;
+  labelAddon?: ReactNode;
+  value: number;
+  values: ReadonlyArray<{ value: number; label: string }>;
+  onChange: (value: number) => void;
+  disabled?: boolean;
+}) {
+  return (
+    <Field>
+      <div className="flex items-center justify-between gap-2">
+        <FieldLabel>{label}</FieldLabel>
+        {labelAddon}
+      </div>
+      <Select
+        value={String(value)}
+        onValueChange={(nextValue) => onChange(Number(nextValue))}
+        disabled={disabled}
+      >
+        <SelectTrigger aria-label={label}>
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent>
+          {values.map((option) => (
+            <SelectItem key={option.value} value={String(option.value)}>
+              {option.label}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    </Field>
+  );
+}
+
+function getScheduleSummary({
+  frequency,
+  intervalHours,
+  dayOfWeek,
+  dayOfMonth,
+}: Pick<
+  ScheduleFormValues,
+  "frequency" | "intervalHours" | "dayOfWeek" | "dayOfMonth"
+>) {
+  switch (frequency) {
+    case SCHEDULE_FREQUENCY.INTERVAL:
+      return `Every ${intervalHours} hours`;
+    case SCHEDULE_FREQUENCY.WEEKLY:
+      return `Weekly on ${SCHEDULE_WEEKDAY_LABELS[dayOfWeek] ?? SCHEDULE_WEEKDAY_LABELS[0]}`;
+    case SCHEDULE_FREQUENCY.MONTHLY:
+      return `Monthly on day ${dayOfMonth}`;
+    default:
+      return "Daily";
+  }
+}
+
+export function ScanScheduleFields({
+  form,
+  disabled = false,
+  showLaunchInitialScan = false,
+  showNextScheduledCopy = false,
+  headerAction,
+  canUseAdvancedSchedule = true,
+  showCloudUpgradeBadge = false,
+}: ScanScheduleFieldsProps) {
+  // useWatch, not form.watch: form.watch re-renders are dropped by React Compiler memoization.
+  const control = form.control;
+  const [frequency, hour, dayOfWeek, dayOfMonth, intervalHours] = useWatch({
+    control,
+    name: ["frequency", "hour", "dayOfWeek", "dayOfMonth", "intervalHours"],
+  });
+  const timezone = getBrowserTimezone();
+  const scheduleSummary = getScheduleSummary({
+    frequency,
+    intervalHours,
+    dayOfWeek,
+    dayOfMonth,
+  });
+  const frequencyLabel = (option: (typeof FREQUENCY_OPTIONS)[number]) =>
+    option.label ?? `Every ${intervalHours} hours`;
+  // In OSS (non-Cloud) the advanced cadence and time are locked: `/schedules/daily`
+  // ignores them, so they are display-only with a Cloud upsell.
+  const advancedDisabled = disabled || !canUseAdvancedSchedule;
+  const cloudUpgradeBadge = showCloudUpgradeBadge ? (
+    <CloudFeatureBadgeLink size="sm" />
+  ) : null;
+
+  return (
+    <div className="flex flex-col gap-6">
+      <div className="flex items-center justify-between gap-2">
+        <div className="flex items-center gap-2">
+          <CalendarClock className="text-text-neutral-primary size-5" />
+          <h3 className="text-text-neutral-primary text-sm font-medium">
+            Scan Schedule
+          </h3>
+        </div>
+        {headerAction}
+      </div>
+
+      <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+        <Controller
+          control={form.control}
+          name="hour"
+          render={({ field }) => (
+            <NumberSelect
+              label="Scan Time"
+              labelAddon={cloudUpgradeBadge}
+              value={field.value}
+              values={HOUR_OPTIONS}
+              onChange={field.onChange}
+              disabled={advancedDisabled}
+            />
+          )}
+        />
+
+        <Controller
+          control={form.control}
+          name="frequency"
+          render={({ field }) => (
+            <Field>
+              <div className="flex items-center justify-between gap-2">
+                <FieldLabel>Repeats</FieldLabel>
+                {cloudUpgradeBadge}
+              </div>
+              <Select
+                value={
+                  canUseAdvancedSchedule
+                    ? field.value
+                    : SCHEDULE_FREQUENCY.DAILY
+                }
+                onValueChange={field.onChange}
+                disabled={advancedDisabled}
+              >
+                <SelectTrigger aria-label="Repeats">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {FREQUENCY_OPTIONS.map((option) => (
+                    <SelectItem key={option.value} value={option.value}>
+                      {frequencyLabel(option)}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </Field>
+          )}
+        />
+      </div>
+
+      {frequency === SCHEDULE_FREQUENCY.WEEKLY && (
+        <Controller
+          control={form.control}
+          name="dayOfWeek"
+          render={({ field }) => (
+            <NumberSelect
+              label="Day of week"
+              value={field.value}
+              values={WEEKDAY_OPTIONS}
+              onChange={field.onChange}
+              disabled={disabled}
+            />
+          )}
+        />
+      )}
+
+      {frequency === SCHEDULE_FREQUENCY.MONTHLY && (
+        <Controller
+          control={form.control}
+          name="dayOfMonth"
+          render={({ field }) => (
+            <NumberSelect
+              label="Day of month"
+              value={field.value}
+              values={MONTH_DAY_OPTIONS.map((day) => ({
+                value: day,
+                label: String(day),
+              }))}
+              onChange={field.onChange}
+              disabled={disabled}
+            />
+          )}
+        />
+      )}
+
+      {showNextScheduledCopy &&
+        (canUseAdvancedSchedule ? (
+          <p className="text-text-neutral-secondary text-sm">
+            {scheduleSummary}. The next scheduled scan will start on:{" "}
+            {format(
+              getNextScheduledRun(
+                {
+                  frequency,
+                  hour,
+                  dayOfWeek,
+                  dayOfMonth,
+                  intervalHours,
+                  launchInitialScan: false,
+                },
+                new Date(),
+              ),
+              "MMM d, yyyy",
+            )}{" "}
+            @ {formatScheduleHour(hour)} {timezone}
+          </p>
+        ) : (
+          <p className="text-text-neutral-secondary text-sm">
+            A daily scan will run automatically once the account is connected.
+          </p>
+        ))}
+
+      {showLaunchInitialScan && (
+        <Controller
+          control={form.control}
+          name="launchInitialScan"
+          render={({ field }) => (
+            <label className="flex items-center gap-3 text-sm font-medium">
+              <Checkbox
+                checked={field.value}
+                onCheckedChange={(checked) => field.onChange(checked === true)}
+                disabled={disabled}
+                aria-label="Launch an initial scan now for immediate findings"
+              />
+              <span>Launch an initial scan now for immediate findings</span>
+            </label>
+          )}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx b/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx
new file mode 100644
index 0000000000..8251bdddc4
--- /dev/null
+++ b/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx
@@ -0,0 +1,77 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { SCAN_JOBS_TAB, type ScanProps } from "@/types";
+
+import { ScanJobsTable } from "../scan-jobs-table";
+
+// Mock DataTable to a minimal table that applies getRowAttributes per row, so we can
+// assert the view-first-scan "in-progress" anchor lands on the right row/tab.
+vi.mock("@/components/ui/table", () => ({
+  DataTable: ({
+    data,
+    getRowAttributes,
+  }: {
+    data?: ScanProps[];
+    getRowAttributes?: (row: {
+      index: number;
+      original: ScanProps;
+    }) => Record<string, string | undefined>;
+  }) => (
+    <table>
+      <tbody>
+        {(data ?? []).map((original, index) => (
+          <tr
+            key={index}
+            data-testid={`row-${index}`}
+            {...getRowAttributes?.({ index, original })}
+          >
+            <td>scan</td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  ),
+}));
+
+// AutoRefresh polls via router on a timer; irrelevant to anchor placement.
+vi.mock("../../auto-refresh", () => ({ AutoRefresh: () => null }));
+vi.mock("../scan-jobs-columns", () => ({ getScanJobsColumns: () => [] }));
+// Not rendered (data is non-empty), but mocked so its server/auth import chain
+// doesn't load under vitest.
+vi.mock("../../no-scans-empty-state", () => ({
+  NoScansEmptyState: () => null,
+}));
+
+const scan = (state: string): ScanProps =>
+  ({ attributes: { state } }) as unknown as ScanProps;
+
+describe("ScanJobsTable in-progress tour anchor", () => {
+  it("anchors the tour to the first row on the active (In Progress) tab", () => {
+    render(
+      <ScanJobsTable
+        data={[scan("executing"), scan("executing")]}
+        tab={SCAN_JOBS_TAB.ACTIVE}
+      />,
+    );
+
+    // Only the first active-tab row carries the anchor — driver.js resolves the
+    // running scan from it.
+    expect(screen.getByTestId("row-0")).toHaveAttribute(
+      "data-tour-id",
+      "view-first-scan-in-progress",
+    );
+    expect(screen.getByTestId("row-1")).not.toHaveAttribute("data-tour-id");
+  });
+
+  it("never anchors on a non-active tab (no running scan to point at)", () => {
+    render(
+      <ScanJobsTable
+        data={[scan("completed")]}
+        tab={SCAN_JOBS_TAB.COMPLETED}
+      />,
+    );
+
+    expect(screen.getByTestId("row-0")).not.toHaveAttribute("data-tour-id");
+  });
+});
diff --git a/ui/components/scans/table/cells/scan-info-cell.tsx b/ui/components/scans/table/cells/scan-info-cell.tsx
index aa61a118d0..7731a2fae1 100644
--- a/ui/components/scans/table/cells/scan-info-cell.tsx
+++ b/ui/components/scans/table/cells/scan-info-cell.tsx
@@ -1,10 +1,31 @@
 "use client";
 
 import { getScanAlias } from "@/components/scans/scans.utils";
+import {
+  Badge,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/shadcn";
 import { EntityInfo } from "@/components/ui/entities";
 import type { ScanProps } from "@/types";
 
 export function ScanInfoCell({ scan }: { scan: ScanProps }) {
+  // Synthetic pending rows have no Scan behind them yet, so there is no id.
+  if (scan.pendingSchedule) {
+    return (
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <Badge variant="tag">Pending</Badge>
+        </TooltipTrigger>
+        <TooltipContent>
+          This scan has not been created yet. Its details will appear after the
+          first scheduled run.
+        </TooltipContent>
+      </Tooltip>
+    );
+  }
+
   return (
     <div className="max-w-[240px] min-w-0">
       <EntityInfo
diff --git a/ui/components/scans/table/cells/schedule-cell.tsx b/ui/components/scans/table/cells/schedule-cell.tsx
index 7e70dde52d..a3f8e0f469 100644
--- a/ui/components/scans/table/cells/schedule-cell.tsx
+++ b/ui/components/scans/table/cells/schedule-cell.tsx
@@ -1,18 +1,23 @@
 "use client";
 
 import { getScanScheduleLabel } from "@/components/scans/scans.utils";
-import { DateWithTime } from "@/components/ui/entities";
+import { StackedCell } from "@/components/shadcn";
+import { formatLocalTimeWithZone } from "@/lib/date-utils";
 import type { ScanProps } from "@/types";
 
+// Trigger label on top, cadence (in the browser's timezone) underneath.
 export function ScheduleCell({ scan }: { scan: ScanProps }) {
+  const schedule = scan.providerSchedule;
+  const localTime = formatLocalTimeWithZone(schedule?.nextScanAt ?? null);
+
   return (
-    <div className="flex flex-col gap-1">
-      <span className="text-text-neutral-primary text-sm">
-        {getScanScheduleLabel(scan.attributes.trigger)}
-      </span>
-      {scan.attributes.scheduled_at && (
-        <DateWithTime dateTime={scan.attributes.scheduled_at} showTime />
-      )}
-    </div>
+    <StackedCell
+      primary={getScanScheduleLabel(scan.attributes.trigger)}
+      secondary={
+        schedule
+          ? `${schedule.cadence ?? schedule.summary}${localTime ? ` @ ${localTime}` : ""}`
+          : undefined
+      }
+    />
   );
 }
diff --git a/ui/components/scans/table/scan-jobs-columns.test.tsx b/ui/components/scans/table/scan-jobs-columns.test.tsx
index 829f24ed7f..3df5270034 100644
--- a/ui/components/scans/table/scan-jobs-columns.test.tsx
+++ b/ui/components/scans/table/scan-jobs-columns.test.tsx
@@ -1,14 +1,25 @@
 import type { CellContext, HeaderContext } from "@tanstack/react-table";
 import { render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
 import { describe, expect, it, vi } from "vitest";
 
 import { type ScanProps, SCAN_JOBS_TAB, type ScanJobsTab } from "@/types";
 
 vi.mock("@/components/shadcn", () => ({
-  Badge: ({ children }: { children: React.ReactNode }) => (
-    <span>{children}</span>
-  ),
+  Badge: ({ children }: { children: ReactNode }) => <span>{children}</span>,
   Progress: () => <div />,
+  StackedCell: ({
+    primary,
+    secondary,
+  }: {
+    primary: ReactNode;
+    secondary?: ReactNode;
+  }) => (
+    <div>
+      <span>{primary}</span>
+      {secondary ? <span>{secondary}</span> : null}
+    </div>
+  ),
 }));
 
 vi.mock("@/components/ui/entities", () => ({
@@ -146,6 +157,8 @@ describe("getScanJobsColumns", () => {
       "account",
       "scanInfo",
       "scanSchedule",
+      "nextScan",
+      "lastScan",
       "actions",
     ]);
   });
diff --git a/ui/components/scans/table/scan-jobs-columns.tsx b/ui/components/scans/table/scan-jobs-columns.tsx
index deacc58c4a..8bdf4cc911 100644
--- a/ui/components/scans/table/scan-jobs-columns.tsx
+++ b/ui/components/scans/table/scan-jobs-columns.tsx
@@ -2,9 +2,10 @@
 
 import type { ColumnDef } from "@tanstack/react-table";
 
-import { DateWithTime } from "@/components/ui/entities";
+import { StackedCell } from "@/components/shadcn";
 import { DataTableColumnHeader } from "@/components/ui/table";
 import { StatusBadge } from "@/components/ui/table/status-badge";
+import { formatLocalDate, formatLocalTimeWithZone } from "@/lib/date-utils";
 import { SCAN_JOBS_TAB, type ScanJobsTab, type ScanProps } from "@/types";
 
 import { formatScanDuration } from "../scans.utils";
@@ -49,15 +50,59 @@ const getScanScheduleColumn = (title: string): ColumnDef<ScanProps> => ({
   cell: ({ row }) => <ScheduleCell scan={row.original} />,
 });
 
+const getScheduleSummary = (scan: ScanProps) =>
+  scan.pendingSchedule ?? scan.providerSchedule;
+
+const renderDateCell = (value: string | null) => {
+  const date = formatLocalDate(value);
+  if (!date) return <span>-</span>;
+
+  return (
+    <StackedCell primary={date} secondary={formatLocalTimeWithZone(value)} />
+  );
+};
+
 const scheduledScanScheduleColumn: ColumnDef<ScanProps> = {
   id: "scanSchedule",
   accessorFn: (row) => row.attributes.scheduled_at,
   header: ({ column }) => (
     <DataTableColumnHeader column={column} title="Schedule" />
   ),
-  cell: ({ row }) => (
-    <DateWithTime dateTime={row.original.attributes.scheduled_at} showTime />
+  // Cadence on top, local fire time underneath.
+  cell: ({ row }) => {
+    const schedule = getScheduleSummary(row.original);
+    if (!schedule) return <span>-</span>;
+
+    return (
+      <StackedCell
+        primary={schedule.cadence ?? schedule.summary}
+        secondary={formatLocalTimeWithZone(
+          row.original.attributes.scheduled_at,
+        )}
+      />
+    );
+  },
+  enableSorting: false,
+};
+
+const nextScanColumn: ColumnDef<ScanProps> = {
+  id: "nextScan",
+  header: ({ column }) => (
+    <DataTableColumnHeader column={column} title="Next Scan" />
   ),
+  // Real rows carry their fire time in scheduled_at; pending rows are
+  // synthesized with the server-computed next_scan_at in the same field.
+  cell: ({ row }) => renderDateCell(row.original.attributes.scheduled_at),
+  enableSorting: false,
+};
+
+const lastScanColumn: ColumnDef<ScanProps> = {
+  id: "lastScan",
+  header: ({ column }) => (
+    <DataTableColumnHeader column={column} title="Last Scan" />
+  ),
+  cell: ({ row }) =>
+    renderDateCell(getScheduleSummary(row.original)?.lastScanAt ?? null),
   enableSorting: false,
 };
 
@@ -105,14 +150,11 @@ const activeColumns = (): ColumnDef<ScanProps>[] => [
     header: ({ column }) => (
       <DataTableColumnHeader column={column} title="Launched" />
     ),
-    cell: ({ row }) => (
-      <DateWithTime
-        dateTime={
-          row.original.attributes.started_at ||
-          row.original.attributes.inserted_at
-        }
-      />
-    ),
+    cell: ({ row }) =>
+      renderDateCell(
+        row.original.attributes.started_at ||
+          row.original.attributes.inserted_at,
+      ),
     enableSorting: false,
   },
   actionsColumn,
@@ -142,9 +184,7 @@ const completedColumns = (): ColumnDef<ScanProps>[] => [
         param="updated_at"
       />
     ),
-    cell: ({ row }) => (
-      <DateWithTime dateTime={row.original.attributes.completed_at} />
-    ),
+    cell: ({ row }) => renderDateCell(row.original.attributes.completed_at),
   },
   actionsColumn,
 ];
@@ -153,19 +193,8 @@ const scheduledColumns = (): ColumnDef<ScanProps>[] => [
   accountColumn,
   scanInfoColumn,
   scheduledScanScheduleColumn,
-  /*
-   * TODO: Restore this column when the API exposes the last completed scan date for this schedule.
-   * {
-   *   id: "lastScan",
-   *   header: ({ column }) => (
-   *     <DataTableColumnHeader column={column} title="Last Run" />
-   *   ),
-   *   cell: ({ row }) => (
-   *     <DateWithTime dateTime={row.original.attributes.completed_at} />
-   *   ),
-   *   enableSorting: false,
-   * },
-   */
+  nextScanColumn,
+  lastScanColumn,
   actionsColumn,
 ];
 
diff --git a/ui/components/scans/table/scan-jobs-row-actions.test.tsx b/ui/components/scans/table/scan-jobs-row-actions.test.tsx
index 9475dcd8ce..7fcc97ecd6 100644
--- a/ui/components/scans/table/scan-jobs-row-actions.test.tsx
+++ b/ui/components/scans/table/scan-jobs-row-actions.test.tsx
@@ -1,19 +1,24 @@
 import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { ScanProps } from "@/types";
 
 import { ScanJobsRowActions } from "./scan-jobs-row-actions";
 
-const { downloadScanZipMock, getTaskMock, pushMock, toastMock } = vi.hoisted(
-  () => ({
-    downloadScanZipMock: vi.fn(),
-    getTaskMock: vi.fn(),
-    pushMock: vi.fn(),
-    toastMock: vi.fn(),
-  }),
-);
+const {
+  downloadScanZipMock,
+  getScheduleMock,
+  getTaskMock,
+  pushMock,
+  toastMock,
+} = vi.hoisted(() => ({
+  downloadScanZipMock: vi.fn(),
+  getScheduleMock: vi.fn(),
+  getTaskMock: vi.fn(),
+  pushMock: vi.fn(),
+  toastMock: vi.fn(),
+}));
 
 vi.mock("next/navigation", () => ({
   useRouter: () => ({
@@ -29,6 +34,10 @@ vi.mock("@/actions/task", () => ({
   getTask: getTaskMock,
 }));
 
+vi.mock("@/actions/schedules", () => ({
+  getSchedule: getScheduleMock,
+}));
+
 vi.mock("@/lib/helper", () => ({
   downloadScanZip: downloadScanZipMock,
 }));
@@ -53,6 +62,26 @@ vi.mock("@/components/scans/edit-alias-modal", () => ({
     ) : null,
 }));
 
+vi.mock("@/components/scans/schedule/edit-scan-schedule-modal", () => ({
+  EDIT_SCAN_SCHEDULE_STATE: {
+    LOADING: "loading",
+    LOADED: "loaded",
+    ERROR: "error",
+  },
+  EditScanScheduleModal: ({
+    open,
+    provider,
+  }: {
+    open: boolean;
+    provider?: { providerId: string };
+  }) =>
+    open ? (
+      <div role="dialog" aria-label="Edit Scan Schedule">
+        Editing schedule for {provider?.providerId}
+      </div>
+    ) : null,
+}));
+
 const makeScan = (
   overrides: Partial<ScanProps["attributes"]> = {},
 ): ScanProps => ({
@@ -80,6 +109,19 @@ const makeScan = (
 });
 
 describe("ScanJobsRowActions", () => {
+  beforeEach(() => {
+    getScheduleMock.mockResolvedValue({
+      data: {
+        type: "schedules",
+        id: "provider-1",
+        attributes: { scan_hour: null },
+        relationships: {
+          provider: { data: { type: "providers", id: "provider-1" } },
+        },
+      },
+    });
+  });
+
   afterEach(() => {
     vi.unstubAllEnvs();
     vi.clearAllMocks();
@@ -95,7 +137,9 @@ describe("ScanJobsRowActions", () => {
     await user.click(
       screen.getByRole("button", { name: /open actions menu/i }),
     );
-    await user.click(screen.getByRole("menuitem", { name: /^edit$/i }));
+    await user.click(
+      screen.getByRole("menuitem", { name: /edit scan alias/i }),
+    );
 
     // Then
     expect(
@@ -103,8 +147,31 @@ describe("ScanJobsRowActions", () => {
     ).toHaveTextContent("Editing Production scan");
   });
 
-  it("does not render the legacy Edit Scan Schedule option", async () => {
+  it("opens Edit Scan Schedule for Prowler Cloud subscribed scan rows", async () => {
     // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    const user = userEvent.setup();
+
+    render(<ScanJobsRowActions scan={makeScan()} />);
+
+    // When
+    await user.click(
+      screen.getByRole("button", { name: /open actions menu/i }),
+    );
+
+    await user.click(
+      screen.getByRole("menuitem", { name: /edit scan schedule/i }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("dialog", { name: /edit scan schedule/i }),
+    ).toHaveTextContent("Editing schedule for provider-1");
+  });
+
+  it("hides Edit Scan Schedule outside Prowler Cloud (OSS)", async () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
     const user = userEvent.setup();
 
     render(<ScanJobsRowActions scan={makeScan()} />);
@@ -120,24 +187,6 @@ describe("ScanJobsRowActions", () => {
     ).not.toBeInTheDocument();
   });
 
-  it("does not render cancel scan while the scan cancellation API is missing", async () => {
-    // Given
-    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
-    const user = userEvent.setup();
-
-    render(<ScanJobsRowActions scan={makeScan()} />);
-
-    // When
-    await user.click(
-      screen.getByRole("button", { name: /open actions menu/i }),
-    );
-
-    // Then
-    expect(
-      screen.queryByRole("menuitem", { name: /cancel scan/i }),
-    ).not.toBeInTheDocument();
-  });
-
   it("links completed scans to compliance from the actions menu", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/components/scans/table/scan-jobs-row-actions.tsx b/ui/components/scans/table/scan-jobs-row-actions.tsx
index f5847ade6b..ff9991a842 100644
--- a/ui/components/scans/table/scan-jobs-row-actions.tsx
+++ b/ui/components/scans/table/scan-jobs-row-actions.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import {
+  CalendarClock,
   Download,
   Eye,
   Pencil,
@@ -10,6 +11,7 @@ import {
 import { useRouter } from "next/navigation";
 import { useState } from "react";
 
+import { getSchedule } from "@/actions/schedules";
 import { getTask } from "@/actions/task";
 import { getScanErrorDetails } from "@/actions/task/task.adapter";
 import { EditAliasModal } from "@/components/scans/edit-alias-modal";
@@ -17,6 +19,12 @@ import {
   ScanErrorDetailsModal,
   type ScanErrorDetailsState,
 } from "@/components/scans/scan-error-details-modal";
+import {
+  EDIT_SCAN_SCHEDULE_STATE,
+  EditScanScheduleModal,
+  type EditScanScheduleState,
+  type ScanScheduleProvider,
+} from "@/components/scans/schedule/edit-scan-schedule-modal";
 import {
   ActionDropdown,
   ActionDropdownItem,
@@ -24,16 +32,36 @@ import {
 import { useToast } from "@/components/ui";
 import { toLocalDateString } from "@/lib/date-utils";
 import { downloadScanZip } from "@/lib/helper";
-import type { ScanProps } from "@/types";
+import { getScanScheduleCapability } from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
+import type { ProviderType, ScanProps, ScheduleApiResponse } from "@/types";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+} from "@/types/schedules";
 
 interface ScanJobsRowActionsProps {
   scan: ScanProps;
+  /**
+   * Schedule capability override. Only for Prowler Cloud.
+   */
+  capability?: ScanScheduleCapability;
 }
 
-export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
+export function ScanJobsRowActions({
+  scan,
+  capability,
+}: ScanJobsRowActionsProps) {
   const router = useRouter();
+  const canEditSchedule =
+    (capability ?? getScanScheduleCapability(isCloud())) ===
+    SCAN_SCHEDULE_CAPABILITY.ADVANCED;
   const { toast } = useToast();
   const [editOpen, setEditOpen] = useState(false);
+  const [scheduleOpen, setScheduleOpen] = useState(false);
+  const [scheduleState, setScheduleState] = useState<EditScanScheduleState>({
+    kind: EDIT_SCAN_SCHEDULE_STATE.LOADING,
+  });
   const [errorOpen, setErrorOpen] = useState(false);
   const [errorState, setErrorState] = useState<ScanErrorDetailsState>({
     kind: "idle",
@@ -43,6 +71,15 @@ export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
   const isFailed = scanState === "failed";
   const taskId = scan.relationships.task.data?.id;
   const scanDate = toLocalDateString(scan.attributes.completed_at);
+  const providerId = scan.relationships.provider.data?.id;
+  const scheduleProvider: ScanScheduleProvider | undefined = providerId
+    ? {
+        providerId,
+        providerType: (scan.providerInfo?.provider ?? "aws") as ProviderType,
+        providerUid: scan.providerInfo?.uid ?? providerId,
+        providerAlias: scan.providerInfo?.alias ?? null,
+      }
+    : undefined;
 
   const openFindings = () => {
     if (!isCompleted || !scanDate) return;
@@ -96,9 +133,58 @@ export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
     setErrorState({ kind: "loaded", details });
   };
 
+  const openScheduleEditor = async () => {
+    if (!providerId) {
+      setScheduleState({
+        kind: EDIT_SCAN_SCHEDULE_STATE.ERROR,
+        message: "Provider ID is not available for this scan.",
+      });
+      setScheduleOpen(true);
+      return;
+    }
+
+    setScheduleState({ kind: EDIT_SCAN_SCHEDULE_STATE.LOADING });
+    setScheduleOpen(true);
+
+    const response = (await getSchedule(providerId)) as
+      | ScheduleApiResponse
+      | { error?: string };
+
+    if (!response || ("error" in response && response.error)) {
+      setScheduleState({
+        kind: EDIT_SCAN_SCHEDULE_STATE.ERROR,
+        message:
+          response && "error" in response && response.error
+            ? response.error
+            : "Failed to load scan schedule.",
+      });
+      return;
+    }
+
+    setScheduleState({
+      kind: EDIT_SCAN_SCHEDULE_STATE.LOADED,
+      schedule: "data" in response ? response.data : null,
+    });
+  };
+
   return (
     <div className="flex items-center justify-end">
       <ActionDropdown>
+        {canEditSchedule && (
+          <ActionDropdownItem
+            icon={<CalendarClock />}
+            label="Edit Scan Schedule"
+            onSelect={() => void openScheduleEditor()}
+          />
+        )}
+        {/* Synthetic pending rows have no Scan to alias. */}
+        {!scan.pendingSchedule && (
+          <ActionDropdownItem
+            icon={<Pencil />}
+            label="Edit Scan Alias"
+            onSelect={() => setEditOpen(true)}
+          />
+        )}
         {isCompleted && (
           <>
             <ActionDropdownItem
@@ -126,12 +212,6 @@ export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
             onSelect={() => void openErrorDetails()}
           />
         )}
-        {/* TODO: Expand Edit to also cover schedule once the backend exposes a schedule update endpoint. */}
-        <ActionDropdownItem
-          icon={<Pencil />}
-          label="Edit"
-          onSelect={() => setEditOpen(true)}
-        />
         {/* TODO: Restore Cancel Scan once the backend exposes a public scan cancellation endpoint. */}
       </ActionDropdown>
 
@@ -147,6 +227,13 @@ export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
         onOpenChange={setErrorOpen}
         state={errorState}
       />
+
+      <EditScanScheduleModal
+        open={scheduleOpen}
+        onOpenChange={setScheduleOpen}
+        provider={scheduleProvider}
+        state={scheduleState}
+      />
     </div>
   );
 }
diff --git a/ui/components/scans/table/scan-jobs-table.tsx b/ui/components/scans/table/scan-jobs-table.tsx
index ee13bb46c1..91c3980777 100644
--- a/ui/components/scans/table/scan-jobs-table.tsx
+++ b/ui/components/scans/table/scan-jobs-table.tsx
@@ -2,6 +2,7 @@
 
 import { DataTable } from "@/components/ui/table";
 import type { MetaDataProps, ScanJobsTab, ScanProps } from "@/types";
+import { SCAN_JOBS_TAB } from "@/types";
 
 import { AutoRefresh } from "../auto-refresh";
 import { NoScansEmptyState } from "../no-scans-empty-state";
@@ -42,6 +43,14 @@ export function ScanJobsTable({
           columns={columns}
           data={data}
           metadata={meta}
+          // Anchor the view-first-scan tour's "in-progress" step to the first row of
+          // the active (In Progress) tab; absent on other tabs so the tour only points
+          // at a running scan.
+          getRowAttributes={(row) =>
+            row.index === 0 && tab === SCAN_JOBS_TAB.ACTIVE
+              ? { "data-tour-id": "view-first-scan-in-progress" }
+              : {}
+          }
         />
       )}
     </>
diff --git a/ui/components/shadcn/badge/badge.test.tsx b/ui/components/shadcn/badge/badge.test.tsx
new file mode 100644
index 0000000000..adae2f54b8
--- /dev/null
+++ b/ui/components/shadcn/badge/badge.test.tsx
@@ -0,0 +1,30 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { Badge } from "./badge";
+
+describe("Badge", () => {
+  it("renders its children", () => {
+    render(<Badge variant="info">Assessment</Badge>);
+    expect(screen.getByText("Assessment")).toBeInTheDocument();
+  });
+
+  it("applies the info variant token classes", () => {
+    const { container } = render(<Badge variant="info">Info</Badge>);
+    const badge = container.querySelector("[data-slot='badge']");
+    // The info variant is built from the existing design-system blue token
+    // (bg-data-info) rather than a bespoke palette.
+    expect(badge?.className).toContain("bg-bg-data-info/15");
+    expect(badge?.className).toContain("text-bg-data-info");
+  });
+
+  it("merges a custom className", () => {
+    const { container } = render(
+      <Badge variant="tag" className="extra-class">
+        Tag
+      </Badge>,
+    );
+    const badge = container.querySelector("[data-slot='badge']");
+    expect(badge?.className).toContain("extra-class");
+  });
+});
diff --git a/ui/components/shadcn/badge/badge.tsx b/ui/components/shadcn/badge/badge.tsx
index f200fda7e2..fd1a6efd11 100644
--- a/ui/components/shadcn/badge/badge.tsx
+++ b/ui/components/shadcn/badge/badge.tsx
@@ -24,6 +24,7 @@ const badgeVariants = cva(
           "border-bg-warning/30 bg-bg-warning-secondary/20 text-text-warning-primary",
         error:
           "border-transparent bg-bg-fail-secondary text-text-error-primary",
+        info: "border-transparent bg-bg-data-info/15 text-bg-data-info",
       },
     },
     defaultVariants: {
diff --git a/ui/components/shadcn/button/button.test.tsx b/ui/components/shadcn/button/button.test.tsx
index 975a1a35f8..bbf019f45b 100644
--- a/ui/components/shadcn/button/button.test.tsx
+++ b/ui/components/shadcn/button/button.test.tsx
@@ -32,4 +32,29 @@ describe("Button", () => {
       "text-xs",
     );
   });
+
+  it("supports extra-small icon buttons", () => {
+    render(
+      <Button size="icon-xs" aria-label="Open tour">
+        Open tour
+      </Button>,
+    );
+
+    expect(screen.getByRole("button", { name: "Open tour" })).toHaveClass(
+      "size-7",
+    );
+  });
+
+  it("renders the bare variant chrome-free (no background or border)", () => {
+    render(
+      <Button variant="bare" size="icon-sm" aria-label="Toggle sidebar">
+        <svg />
+      </Button>,
+    );
+
+    const button = screen.getByRole("button", { name: "Toggle sidebar" });
+    expect(button).toHaveClass("bg-transparent");
+    expect(button).toHaveClass("border-0");
+    expect(button).toHaveClass("p-0");
+  });
 });
diff --git a/ui/components/shadcn/button/button.tsx b/ui/components/shadcn/button/button.tsx
index b2a251d562..44c7788cb4 100644
--- a/ui/components/shadcn/button/button.tsx
+++ b/ui/components/shadcn/button/button.tsx
@@ -22,6 +22,9 @@ const buttonVariants = cva(
         ghost:
           "border border-transparent text-text-neutral-primary hover:bg-bg-neutral-tertiary active:bg-border-neutral-secondary focus-visible:ring-border-neutral-secondary/50",
         link: "text-button-tertiary underline-offset-4 hover:text-button-tertiary-hover disabled:bg-transparent",
+        // Chrome-free: no border/background, only the icon shows. Hover/active shift
+        // the icon color instead of painting a box. Pair with an `icon*` size.
+        bare: "border-0 bg-transparent p-0 text-text-neutral-secondary hover:text-text-neutral-primary active:text-text-neutral-primary focus-visible:ring-border-neutral-secondary/50 disabled:bg-transparent",
         // Menu variant like secondary but more padding and the back is almost transparent
         menu: "backdrop-blur-xl bg-white/60 dark:bg-white/5 border border-white/80 dark:border-white/10 text-text-neutral-primary dark:text-white shadow-lg hover:bg-white/70 dark:hover:bg-white/10 hover:border-white/90 dark:hover:border-white/30 active:bg-white/80 dark:active:bg-white/15 active:scale-[0.98] focus-visible:ring-button-primary/50 transition-all duration-200",
         "menu-active":
@@ -35,6 +38,7 @@ const buttonVariants = cva(
         lg: "h-10 px-6 has-[>svg]:px-4",
         xl: "h-12 px-8 text-base has-[>svg]:px-6",
         icon: "size-9",
+        "icon-xs": "size-7",
         "icon-sm": "size-8",
         "icon-lg": "size-10",
         "link-xs": "text-xs",
diff --git a/ui/components/shadcn/index.ts b/ui/components/shadcn/index.ts
index 91c08ef72e..18ac317ef5 100644
--- a/ui/components/shadcn/index.ts
+++ b/ui/components/shadcn/index.ts
@@ -20,6 +20,7 @@ export * from "./select/multiselect";
 export * from "./select/select";
 export * from "./separator/separator";
 export * from "./skeleton/skeleton";
+export * from "./stacked-cell/stacked-cell";
 export * from "./tabs/generic-tabs";
 export * from "./tabs/tabs";
 export * from "./textarea/textarea";
diff --git a/ui/components/shadcn/radio-group/radio-group.tsx b/ui/components/shadcn/radio-group/radio-group.tsx
index 5765073031..5d2f286a4e 100644
--- a/ui/components/shadcn/radio-group/radio-group.tsx
+++ b/ui/components/shadcn/radio-group/radio-group.tsx
@@ -35,9 +35,9 @@ function RadioGroupItem({
     >
       <RadioGroupPrimitive.Indicator
         data-slot="radio-group-indicator"
-        className="grid place-content-center"
+        className="relative flex items-center justify-center"
       >
-        <span className="bg-button-primary size-2 rounded-full" />
+        <span className="bg-button-primary absolute top-1/2 left-1/2 size-2 -translate-x-1/2 -translate-y-1/2 rounded-full" />
       </RadioGroupPrimitive.Indicator>
     </RadioGroupPrimitive.Item>
   );
diff --git a/ui/components/shadcn/select/multiselect.test.tsx b/ui/components/shadcn/select/multiselect.test.tsx
index 94d03b3bd5..3959d16053 100644
--- a/ui/components/shadcn/select/multiselect.test.tsx
+++ b/ui/components/shadcn/select/multiselect.test.tsx
@@ -214,7 +214,7 @@ describe("MultiSelect", () => {
     ).not.toBeInTheDocument();
   });
 
-  it("uses a normalized dropdown width instead of growing with the longest item", async () => {
+  it("sizes the dropdown to its content with a capped width", async () => {
     const user = userEvent.setup();
 
     render(
@@ -233,10 +233,8 @@ describe("MultiSelect", () => {
 
     await user.click(screen.getByRole("combobox"));
 
-    expect(screen.getByRole("dialog")).toHaveClass(
-      "w-[min(var(--radix-popover-trigger-width),calc(100vw-2rem))]",
-    );
-    expect(screen.getByRole("dialog")).toHaveClass("max-w-[24rem]");
+    expect(screen.getByRole("dialog")).toHaveClass("sm:w-max");
+    expect(screen.getByRole("dialog")).toHaveClass("sm:max-w-[22rem]");
   });
 
   it("keeps long option lists scrollable inside the dropdown", async () => {
diff --git a/ui/components/shadcn/select/multiselect.tsx b/ui/components/shadcn/select/multiselect.tsx
index f89c1394ba..209edbe599 100644
--- a/ui/components/shadcn/select/multiselect.tsx
+++ b/ui/components/shadcn/select/multiselect.tsx
@@ -313,8 +313,8 @@ export function MultiSelectContent({
 
   const widthClasses =
     width === "wide"
-      ? "w-[min(max(var(--radix-popover-trigger-width),24rem),calc(100vw-2rem))] max-w-[32rem]"
-      : "w-[min(var(--radix-popover-trigger-width),calc(100vw-2rem))] max-w-[24rem]";
+      ? "w-[calc(100vw-2rem)] sm:w-max sm:min-w-[min(max(var(--radix-popover-trigger-width),24rem),32rem)] sm:max-w-[32rem]"
+      : "w-[calc(100vw-2rem)] sm:w-max sm:min-w-[min(var(--radix-popover-trigger-width),22rem)] sm:max-w-[22rem]";
 
   function handleSearchValueChange(searchValue: string) {
     if (!canSearch || !searchValue.trim()) return;
@@ -426,7 +426,7 @@ export function MultiSelectItem({
         onSelect?.(value);
       }}
     >
-      <span className="flex min-w-0 flex-1 items-center gap-2 overflow-hidden">
+      <span className="flex min-w-0 flex-1 items-center gap-2 overflow-hidden whitespace-nowrap">
         {children}
       </span>
       <CheckIcon
diff --git a/ui/components/shadcn/stacked-cell/stacked-cell.test.tsx b/ui/components/shadcn/stacked-cell/stacked-cell.test.tsx
new file mode 100644
index 0000000000..61a8cd3e8a
--- /dev/null
+++ b/ui/components/shadcn/stacked-cell/stacked-cell.test.tsx
@@ -0,0 +1,20 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { StackedCell } from "./stacked-cell";
+
+describe("StackedCell", () => {
+  it("renders primary and secondary lines", () => {
+    render(<StackedCell primary="Jun 15, 2026" secondary="12:00AM MAD" />);
+
+    expect(screen.getByText("Jun 15, 2026")).toBeInTheDocument();
+    expect(screen.getByText("12:00AM MAD")).toBeInTheDocument();
+  });
+
+  it("omits the secondary line when not provided", () => {
+    const { container } = render(<StackedCell primary="Manual" />);
+
+    expect(screen.getByText("Manual")).toBeInTheDocument();
+    expect(container.querySelectorAll("span")).toHaveLength(1);
+  });
+});
diff --git a/ui/components/shadcn/stacked-cell/stacked-cell.tsx b/ui/components/shadcn/stacked-cell/stacked-cell.tsx
new file mode 100644
index 0000000000..3c3184ed3e
--- /dev/null
+++ b/ui/components/shadcn/stacked-cell/stacked-cell.tsx
@@ -0,0 +1,36 @@
+import type { ReactNode } from "react";
+
+import { cn } from "@/lib/utils";
+
+interface StackedCellProps {
+  primary: ReactNode;
+  secondary?: ReactNode;
+  className?: string;
+}
+
+/**
+ * Presentational shell for two-line table cells (the DateWithTime look):
+ * primary line on top, muted secondary line underneath. Content/formatting
+ * belongs to the caller.
+ */
+export function StackedCell({
+  primary,
+  secondary,
+  className,
+}: StackedCellProps) {
+  return (
+    <div
+      data-slot="stacked-cell"
+      className={cn("flex flex-col gap-1", className)}
+    >
+      <span className="text-text-neutral-primary text-sm whitespace-nowrap">
+        {primary}
+      </span>
+      {secondary ? (
+        <span className="text-text-neutral-tertiary text-xs font-medium">
+          {secondary}
+        </span>
+      ) : null}
+    </div>
+  );
+}
diff --git a/ui/components/shadcn/tabs/tabs.test.tsx b/ui/components/shadcn/tabs/tabs.test.tsx
new file mode 100644
index 0000000000..8d9a54816d
--- /dev/null
+++ b/ui/components/shadcn/tabs/tabs.test.tsx
@@ -0,0 +1,27 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { Tabs, TabsList, TabsTrigger } from "./tabs";
+
+describe("TabsTrigger", () => {
+  it("keeps active styling available when rendered with a tooltip", () => {
+    render(
+      <Tabs defaultValue="overview">
+        <TabsList>
+          <TabsTrigger value="overview" tooltip="Overview">
+            Overview
+          </TabsTrigger>
+          <TabsTrigger value="remediation" tooltip="Remediation">
+            Remediation
+          </TabsTrigger>
+        </TabsList>
+      </Tabs>,
+    );
+
+    const activeTrigger = screen.getByRole("tab", { name: "Overview" });
+
+    expect(activeTrigger).toHaveAttribute("aria-selected", "true");
+    expect(activeTrigger).toHaveClass("aria-selected:text-slate-900");
+    expect(activeTrigger).toHaveClass("aria-selected:after:scale-x-100");
+  });
+});
diff --git a/ui/components/shadcn/tabs/tabs.tsx b/ui/components/shadcn/tabs/tabs.tsx
index 92ca5575c8..d66d4bfa2c 100644
--- a/ui/components/shadcn/tabs/tabs.tsx
+++ b/ui/components/shadcn/tabs/tabs.tsx
@@ -10,31 +10,22 @@ import {
 } from "@/components/shadcn/tooltip";
 import { cn } from "@/lib/utils";
 
-/**
- * Trigger component style parts using semantic class names
- */
 const TRIGGER_STYLES = {
   base: "relative inline-flex min-w-0 items-center justify-center gap-2 py-3 text-sm font-medium transition-colors disabled:pointer-events-none disabled:opacity-50 [&:not(:first-child)]:pl-4 [&:not(:last-child)]:pr-4",
   border: "border-r border-[#E9E9F0] last:border-r-0 dark:border-[#171D30]",
   text: "text-slate-600 hover:text-slate-900 dark:text-slate-400 dark:hover:text-white",
   active:
-    "data-[state=active]:text-slate-900 dark:data-[state=active]:text-white",
+    "data-[state=active]:text-slate-900 aria-selected:text-slate-900 dark:data-[state=active]:text-white dark:aria-selected:text-white",
   underline:
-    "after:absolute after:bottom-0 after:left-0 after:right-4 after:h-0.5 after:scale-x-0 after:bg-emerald-400 after:transition-transform data-[state=active]:after:scale-x-100 [&:not(:first-child)]:after:left-4 [&:last-child]:after:right-0",
+    "after:absolute after:bottom-0 after:left-0 after:right-4 after:h-0.5 after:scale-x-0 after:bg-emerald-400 after:transition-transform data-[state=active]:after:scale-x-100 aria-selected:after:scale-x-100 [&:not(:first-child)]:after:left-4 [&:last-child]:after:right-0",
   focus:
     "focus-visible:ring-2 focus-visible:ring-emerald-400 focus-visible:ring-offset-2 focus-visible:ring-offset-white focus-visible:outline-none dark:focus-visible:ring-offset-slate-950",
   icon: "[&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 } as const;
 
-/**
- * Content component styles
- */
 const CONTENT_STYLES =
   "mt-2 focus-visible:rounded-md focus-visible:outline-1 focus-visible:ring-[3px] focus-visible:border-ring focus-visible:outline-ring focus-visible:ring-ring/50" as const;
 
-/**
- * Build trigger className by combining style parts
- */
 function buildTriggerClassName(): string {
   return [
     TRIGGER_STYLES.base,
@@ -47,13 +38,8 @@ function buildTriggerClassName(): string {
   ].join(" ");
 }
 
-/**
- * Build list className
- */
 function buildListClassName(): string {
-  // `flex` + `min-w-0` lets the triggers shrink proportionally when the
-  // container is narrow, so each trigger truncates with ellipsis instead
-  // of forcing a horizontal scrollbar.
+  // min-w-0 lets triggers shrink to ellipsis instead of forcing a scrollbar
   return "flex w-full min-w-0 items-center border-[#E9E9F0] dark:border-[#171D30]";
 }
 
@@ -85,11 +71,7 @@ function TabsList({
 
 interface TabsTriggerProps
   extends ComponentProps<typeof TabsPrimitive.Trigger> {
-  /**
-   * When set, the trigger is wrapped in a shadcn Tooltip rendered below
-   * the bar. Useful for showing the full name when the label is truncated
-   * to ellipsis on narrow containers.
-   */
+  /** Tooltip shown below the trigger — useful when the label is truncated. */
   tooltip?: ReactNode;
 }
 
@@ -105,9 +87,7 @@ function TabsTrigger({
       className={cn(buildTriggerClassName(), className)}
       {...props}
     >
-      {/* Wrapper provides the block-level box needed for `truncate` to
-       * actually render an ellipsis. Padding and gap on the trigger stay
-       * constant; only this span shrinks below its content width. */}
+      {/* block + min-w-0 needed for truncate to render ellipsis */}
       <span className="block min-w-0 truncate">{children}</span>
     </TabsPrimitive.Trigger>
   );
diff --git a/ui/components/shared/status-alert.test.tsx b/ui/components/shared/status-alert.test.tsx
new file mode 100644
index 0000000000..c99500e57e
--- /dev/null
+++ b/ui/components/shared/status-alert.test.tsx
@@ -0,0 +1,45 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { StatusAlert } from "./status-alert";
+
+describe("StatusAlert", () => {
+  it("renders the info variant with title and children", () => {
+    render(
+      <StatusAlert variant="info" title="Heads up">
+        <span>Something to know.</span>
+      </StatusAlert>,
+    );
+
+    expect(screen.getByText("Heads up")).toBeInTheDocument();
+    expect(screen.getByText("Something to know.")).toBeInTheDocument();
+  });
+
+  it("renders the error variant with title and children", () => {
+    render(
+      <StatusAlert variant="error" title="It broke">
+        <span>Try again.</span>
+      </StatusAlert>,
+    );
+
+    expect(screen.getByText("It broke")).toBeInTheDocument();
+    expect(screen.getByText("Try again.")).toBeInTheDocument();
+  });
+
+  it("applies descriptionClassName to the description element", () => {
+    render(
+      <StatusAlert
+        variant="info"
+        title="Styled"
+        descriptionClassName="w-full gap-3"
+      >
+        <span>Body</span>
+      </StatusAlert>,
+    );
+
+    const description = screen
+      .getByText("Body")
+      .closest("[data-slot='alert-description']");
+    expect(description).toHaveClass("w-full", "gap-3");
+  });
+});
diff --git a/ui/components/shared/status-alert.tsx b/ui/components/shared/status-alert.tsx
new file mode 100644
index 0000000000..286e7e6b9a
--- /dev/null
+++ b/ui/components/shared/status-alert.tsx
@@ -0,0 +1,41 @@
+import { CircleAlert, Info } from "lucide-react";
+import type { ReactNode } from "react";
+
+import { Alert, AlertDescription, AlertTitle } from "@/components/shadcn/alert";
+
+const STATUS_ALERT_ICONS = {
+  info: Info,
+  error: CircleAlert,
+} as const;
+
+type StatusAlertVariant = keyof typeof STATUS_ALERT_ICONS;
+
+interface StatusAlertProps {
+  variant: StatusAlertVariant;
+  title: string;
+  descriptionClassName?: string;
+  children: ReactNode;
+}
+
+/**
+ * Shared status banner: a shadcn `Alert` with a variant-driven icon, title, and
+ * description. Use for full-width info/error messages (waiting states, load
+ * failures, inline notices).
+ */
+export const StatusAlert = ({
+  variant,
+  title,
+  descriptionClassName,
+  children,
+}: StatusAlertProps) => {
+  const Icon = STATUS_ALERT_ICONS[variant];
+  return (
+    <Alert variant={variant}>
+      <Icon className="size-4" />
+      <AlertTitle>{title}</AlertTitle>
+      <AlertDescription className={descriptionClassName}>
+        {children}
+      </AlertDescription>
+    </Alert>
+  );
+};
diff --git a/ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx b/ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx
new file mode 100644
index 0000000000..6277782433
--- /dev/null
+++ b/ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx
@@ -0,0 +1,43 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { BreadcrumbNavigation } from "./breadcrumb-navigation";
+
+vi.mock("next/navigation", () => ({
+  usePathname: () => "/findings",
+  useSearchParams: () => new URLSearchParams(),
+}));
+
+vi.mock("@iconify/react", () => ({
+  Icon: ({ icon }: { icon: string }) => <span aria-label={icon} />,
+}));
+
+vi.mock("@heroui/breadcrumbs", () => ({
+  Breadcrumbs: ({ children }: { children: React.ReactNode }) => (
+    <nav aria-label="Breadcrumb">{children}</nav>
+  ),
+  BreadcrumbItem: ({ children }: { children: React.ReactNode }) => (
+    <span>{children}</span>
+  ),
+}));
+
+describe("BreadcrumbNavigation", () => {
+  it("renders the title action next to the current breadcrumb title", () => {
+    // Given / When
+    render(
+      <BreadcrumbNavigation
+        mode="auto"
+        title="Findings"
+        titleAction={<button type="button">Start product tour</button>}
+      />,
+    );
+
+    // Then
+    expect(
+      screen.getByRole("heading", { name: "Findings" }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole("button", { name: "Start product tour" }),
+    ).toBeInTheDocument();
+  });
+});
diff --git a/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx b/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx
index 974c1dffc4..6becf7d4db 100644
--- a/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx
+++ b/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx
@@ -22,6 +22,7 @@ interface BreadcrumbNavigationProps {
   mode?: "auto" | "custom" | "hybrid";
   title?: string;
   icon?: string | ReactNode;
+  titleAction?: ReactNode;
   customItems?: CustomBreadcrumbItem[];
   className?: string;
   paramToPreserve?: string;
@@ -32,6 +33,7 @@ export function BreadcrumbNavigation({
   mode = "auto",
   title,
   icon,
+  titleAction,
   customItems = [],
   className = "",
   paramToPreserve = "scanId",
@@ -74,7 +76,6 @@ export function BreadcrumbNavigation({
       const isLast = index === pathSegments.length - 1;
       let displayName = segment.charAt(0).toUpperCase() + segment.slice(1);
 
-      // Special cases:
       if (segment.includes("-")) {
         displayName = segment
           .split("-")
@@ -126,10 +127,10 @@ export function BreadcrumbNavigation({
       >
         {titleText}
       </h1>
+      {titleAction}
     </div>
   );
 
-  // Determine which breadcrumbs to use
   let breadcrumbItems: CustomBreadcrumbItem[] = [];
 
   switch (mode) {
diff --git a/ui/components/ui/content-layout/content-layout.tsx b/ui/components/ui/content-layout/content-layout.tsx
index d059968332..37f04b6899 100644
--- a/ui/components/ui/content-layout/content-layout.tsx
+++ b/ui/components/ui/content-layout/content-layout.tsx
@@ -1,18 +1,24 @@
 import { ReactNode } from "react";
 
-import { Navbar } from "../nav-bar/navbar";
+import { Navbar, type OnboardingActionConfig } from "../nav-bar/navbar";
 
 interface ContentLayoutProps {
   title: string;
   icon?: string | ReactNode;
+  onboardingAction?: OnboardingActionConfig;
   children: React.ReactNode;
 }
 
-export function ContentLayout({ title, icon, children }: ContentLayoutProps) {
+export function ContentLayout({
+  title,
+  icon,
+  onboardingAction,
+  children,
+}: ContentLayoutProps) {
   return (
     <>
-      <Navbar title={title} icon={icon} />
-      <div className="px-6 py-4 sm:px-8">{children}</div>
+      <Navbar title={title} icon={icon} onboardingAction={onboardingAction} />
+      <div className="py-4 pr-6">{children}</div>
     </>
   );
 }
diff --git a/ui/components/ui/entities/date-with-time.tsx b/ui/components/ui/entities/date-with-time.tsx
index 16cab1d7ff..8a4eedc49b 100644
--- a/ui/components/ui/entities/date-with-time.tsx
+++ b/ui/components/ui/entities/date-with-time.tsx
@@ -5,6 +5,7 @@ import {
   TooltipContent,
   TooltipTrigger,
 } from "@/components/shadcn/tooltip";
+import { formatLocalTimeWithZone } from "@/lib/date-utils";
 import { cn } from "@/lib/utils";
 
 interface DateWithTimeProps {
@@ -29,18 +30,12 @@ export const DateWithTime = ({
     }
 
     const formattedDate = format(date, "MMM dd, yyyy");
-    const formattedTime = format(date, "h:mma");
-    const timezone =
-      Intl.DateTimeFormat()
-        .resolvedOptions()
-        .timeZone.split("/")
-        .pop()
-        ?.substring(0, 3)
-        .toUpperCase() || "";
+    const timeWithZone = formatLocalTimeWithZone(dateTime);
 
-    const fullText = showTime
-      ? `${formattedDate} ${formattedTime} ${timezone}`
-      : formattedDate;
+    const fullText =
+      showTime && timeWithZone
+        ? `${formattedDate} ${timeWithZone}`
+        : formattedDate;
 
     const content = (
       <div
@@ -59,14 +54,14 @@ export const DateWithTime = ({
         >
           {formattedDate}
         </span>
-        {showTime && (
+        {showTime && timeWithZone && (
           <span
             className={cn(
               "text-text-neutral-tertiary text-xs font-medium whitespace-nowrap",
               inline && "truncate",
             )}
           >
-            {formattedTime} {timezone}
+            {timeWithZone}
           </span>
         )}
       </div>
diff --git a/ui/components/ui/nav-bar/navbar-client.test.tsx b/ui/components/ui/nav-bar/navbar-client.test.tsx
new file mode 100644
index 0000000000..43356c3cde
--- /dev/null
+++ b/ui/components/ui/nav-bar/navbar-client.test.tsx
@@ -0,0 +1,255 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { ReactNode } from "react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getFlowById } from "@/lib/onboarding";
+import { localStorageAdapter } from "@/lib/tours/store/local-storage-adapter";
+import { usePageReadyStore } from "@/store/page-ready";
+
+import { NavbarClient } from "./navbar-client";
+
+const navigationMocks = vi.hoisted(() => ({
+  pathname: "/findings",
+  push: vi.fn(),
+  searchParams: new URLSearchParams(),
+}));
+
+const requestReplayMock = vi.hoisted(() => vi.fn());
+
+vi.mock("next/navigation", () => ({
+  usePathname: () => navigationMocks.pathname,
+  useRouter: () => ({ push: navigationMocks.push }),
+  useSearchParams: () => navigationMocks.searchParams,
+}));
+
+vi.mock("@/store/onboarding-replay", () => {
+  const state = { requestReplay: requestReplayMock };
+  const hook = (selector: (s: typeof state) => unknown) => selector(state);
+  hook.getState = () => state;
+  return { useOnboardingReplayStore: hook };
+});
+
+vi.mock("@/hooks/use-sidebar", () => ({
+  useSidebar: () => ({ isOpen: true, toggleOpen: vi.fn() }),
+}));
+
+vi.mock("@/components/ThemeSwitch", () => ({
+  ThemeSwitch: () => <button type="button">Theme switch</button>,
+}));
+
+vi.mock("@/components/ui", () => ({
+  BreadcrumbNavigation: ({
+    title,
+    titleAction,
+  }: {
+    title: string;
+    titleAction?: ReactNode;
+  }) => (
+    <nav aria-label="Breadcrumb">
+      <h1>{title}</h1>
+      {titleAction}
+    </nav>
+  ),
+}));
+
+vi.mock("../sidebar/sheet-menu", () => ({
+  SheetMenu: () => <button type="button">Open menu</button>,
+}));
+
+vi.mock("../sidebar/sidebar-toggle", () => ({
+  SidebarToggle: () => <button type="button">Toggle sidebar</button>,
+}));
+
+vi.mock("../user-nav/user-nav", () => ({
+  UserNav: () => <button type="button">User menu</button>,
+}));
+
+describe("NavbarClient", () => {
+  beforeEach(() => {
+    navigationMocks.pathname = "/findings";
+    navigationMocks.push.mockClear();
+    requestReplayMock.mockClear();
+    navigationMocks.searchParams = new URLSearchParams();
+    window.localStorage.clear();
+    // Replay icon is Cloud-only.
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    // Default: the current route's content has loaded, so the icon is enabled.
+    usePageReadyStore.setState({ readyPath: "/findings" });
+  });
+
+  it("renders an accessible contextual onboarding button in the breadcrumb", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+
+    // When
+    await user.hover(
+      screen.getByRole("button", {
+        name: /start product tour: explore your findings/i,
+      }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("heading", { name: "Findings" }),
+    ).toBeInTheDocument();
+    expect(screen.getAllByText("See how it works")).not.toHaveLength(0);
+    expect(
+      screen.getByRole("button", {
+        name: /start product tour: explore your findings/i,
+      }),
+    ).toHaveClass("size-7");
+  });
+
+  it("pulses the onboarding icon while the tour has not been seen", () => {
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+
+    const icon = screen
+      .getByRole("button", {
+        name: /start product tour: explore your findings/i,
+      })
+      .querySelector("svg");
+    expect(icon).toHaveClass("animate-pulse");
+  });
+
+  it("keeps the onboarding button but stops pulsing once the tour is closed", () => {
+    const flow = getFlowById("explore-findings");
+    localStorageAdapter.set(flow!.tour, {
+      tourId: flow!.tour.id,
+      version: flow!.tour.version,
+      state: "dismissed",
+      completedAt: "2026-01-01T00:00:00.000Z",
+    });
+
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+
+    const button = screen.getByRole("button", {
+      name: /start product tour: explore your findings/i,
+    });
+    expect(button).toBeInTheDocument();
+    expect(button.querySelector("svg")).not.toHaveClass("animate-pulse");
+  });
+
+  it("starts the replay in-memory (no navigation) when already on the flow's route", async () => {
+    // Given the user is already on the flow's page
+    navigationMocks.pathname = "/compliance";
+    navigationMocks.searchParams = new URLSearchParams("scanId=scan-1&foo=bar");
+    usePageReadyStore.setState({ readyPath: "/compliance" });
+    const user = userEvent.setup();
+    render(
+      <NavbarClient
+        title="Compliance"
+        onboardingAction={{ flowId: "view-compliance" }}
+      />,
+    );
+
+    // When
+    await user.click(
+      screen.getByRole("button", {
+        name: /start product tour: check compliance/i,
+      }),
+    );
+
+    // Then the replay is requested via the in-memory store — no router.push, so no
+    // `?onboarding=` URL param and no Next.js RSC refetch of the page.
+    expect(requestReplayMock).toHaveBeenCalledWith("view-compliance");
+    expect(navigationMocks.push).not.toHaveBeenCalled();
+  });
+
+  it("navigates to the fallback flow without leaking current-route params", async () => {
+    // Given
+    navigationMocks.pathname = "/findings";
+    navigationMocks.searchParams = new URLSearchParams(
+      "filter%5Bseverity__in%5D=critical",
+    );
+    const user = userEvent.setup();
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{
+          flowId: "explore-findings",
+          fallbackFlowId: "view-first-scan",
+          useFallback: true,
+        }}
+      />,
+    );
+
+    // When
+    await user.click(
+      screen.getByRole("button", {
+        name: /start product tour: run your first scan/i,
+      }),
+    );
+
+    // Then: the flow's own route (incl. its `?tab=active`) is preserved and the
+    // onboarding param is appended with `&` — the current /findings filter is dropped.
+    expect(navigationMocks.push).toHaveBeenCalledWith(
+      "/scans?tab=active&onboarding=view-first-scan",
+    );
+  });
+
+  it("hides the replay icon until the route's content has loaded", () => {
+    // Given the page has not signalled ready for the current route
+    usePageReadyStore.setState({ readyPath: null });
+
+    // When
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+
+    // Then the icon is not rendered at all
+    expect(
+      screen.queryByRole("button", {
+        name: /start product tour: explore your findings/i,
+      }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("hides the replay icon entirely in self-hosted (OSS) deployments", () => {
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+    expect(
+      screen.queryByRole("button", { name: /start product tour/i }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("does not render a contextual onboarding button for unknown flows", () => {
+    // Given / When
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "unknown-flow" }}
+      />,
+    );
+
+    // Then
+    expect(
+      screen.queryByRole("button", { name: /start product tour/i }),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/ui/components/ui/nav-bar/navbar-client.tsx b/ui/components/ui/nav-bar/navbar-client.tsx
index fa48c9c103..bdeb879034 100644
--- a/ui/components/ui/nav-bar/navbar-client.tsx
+++ b/ui/components/ui/nav-bar/navbar-client.tsx
@@ -1,40 +1,130 @@
 "use client";
 
-import { BellRing } from "lucide-react";
-import { ReactNode } from "react";
+import { BellRing, Info } from "lucide-react";
+import { usePathname, useRouter } from "next/navigation";
+import { ReactNode, Suspense } from "react";
 
-import { Button } from "@/components/shadcn";
+import {
+  Button,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/shadcn";
 import { ThemeSwitch } from "@/components/ThemeSwitch";
 import { BreadcrumbNavigation } from "@/components/ui";
 import { useSidebar } from "@/hooks/use-sidebar";
+import { getFlowById } from "@/lib/onboarding";
+import { isCloud } from "@/lib/shared/env";
+import { useTourCompletion } from "@/lib/tours/use-tour-completion";
+import { cn } from "@/lib/utils";
+import { useOnboardingReplayStore } from "@/store/onboarding-replay";
+import { usePageReadyStore } from "@/store/page-ready";
 
 import { SheetMenu } from "../sidebar/sheet-menu";
 import { SidebarToggle } from "../sidebar/sidebar-toggle";
 import { UserNav } from "../user-nav/user-nav";
 
+export interface OnboardingActionConfig {
+  flowId: string;
+  fallbackFlowId?: string;
+  useFallback?: boolean;
+}
+
 interface NavbarClientProps {
   title: string;
   icon?: string | ReactNode;
+  onboardingAction?: OnboardingActionConfig;
   feedsSlot?: ReactNode;
 }
 
-export function NavbarClient({ title, icon, feedsSlot }: NavbarClientProps) {
+export function NavbarClient({
+  title,
+  icon,
+  onboardingAction,
+  feedsSlot,
+}: NavbarClientProps) {
   const { isOpen, toggleOpen } = useSidebar();
+  const pathname = usePathname();
+  const router = useRouter();
+  const requestReplay = useOnboardingReplayStore(
+    (state) => state.requestReplay,
+  );
+  const targetFlowId =
+    onboardingAction?.useFallback && onboardingAction.fallbackFlowId
+      ? onboardingAction.fallbackFlowId
+      : onboardingAction?.flowId;
+  // Cloud-only: no flow → no replay icon in OSS.
+  const flow =
+    isCloud() && targetFlowId ? getFlowById(targetFlowId) : undefined;
+  // Pulse only until the tour is seen; any close (completed/skipped/dismissed)
+  // calms it. The replay button itself stays.
+  const seen = useTourCompletion(flow?.tour ?? null) !== null;
+
+  // Keep the replay icon disabled until this route's content has finished loading,
+  // so a tour never starts before its anchors are in the DOM.
+  const readyPath = usePageReadyStore((state) => state.readyPath);
+  const pageReady = readyPath === pathname;
+
+  const replayFlow = () => {
+    if (!flow) return;
+
+    // Already on the flow's page: start the replay via an in-memory signal so the
+    // URL never changes and Next.js never refetches the (often heavy) page.
+    if (flow.route === pathname) {
+      requestReplay(flow.id);
+      return;
+    }
+    // Different page: a real navigation is needed; the `onboarding=` param survives
+    // it and starts the tour on the destination route. Routes may already carry a
+    // query string (e.g. `/scans?tab=active`), so pick the right separator.
+    const separator = flow.route.includes("?") ? "&" : "?";
+    router.push(`${flow.route}${separator}onboarding=${flow.id}`);
+  };
 
   return (
     <header className="sticky top-0 z-10 w-full pt-4 backdrop-blur-sm">
-      <div className="mx-4 flex h-14 items-center sm:mx-8">
+      <div className="flex h-14 items-center pr-6">
         <div className="flex items-center gap-2">
           <SheetMenu />
           <div className="hidden lg:block">
             <SidebarToggle isOpen={isOpen} setIsOpen={toggleOpen} />
           </div>
-          <BreadcrumbNavigation
-            mode="auto"
-            title={title}
-            icon={icon}
-            paramToPreserve="scanId"
-          />
+          {/* Suspense contains the useSearchParams() CSR bailout in BreadcrumbNavigation
+              so statically prerendered pages don't fail the build. */}
+          <Suspense fallback={null}>
+            <BreadcrumbNavigation
+              mode="auto"
+              title={title}
+              icon={icon}
+              titleAction={
+                // Hidden until the route's content has loaded, so the tour never starts
+                // before its anchors exist (and we avoid a disabled-then-enabled flash).
+                flow && pageReady ? (
+                  <Tooltip>
+                    <TooltipTrigger asChild>
+                      <Button
+                        type="button"
+                        variant="ghost"
+                        size="icon-xs"
+                        aria-label={`Start product tour: ${flow.title}`}
+                        onClick={replayFlow}
+                      >
+                        <Info
+                          className={cn(
+                            "text-bg-data-info size-4",
+                            !seen && "animate-pulse",
+                          )}
+                          aria-hidden="true"
+                        />
+                      </Button>
+                    </TooltipTrigger>
+                    <TooltipContent>See how it works</TooltipContent>
+                  </Tooltip>
+                ) : null
+              }
+              paramToPreserve="scanId"
+            />
+          </Suspense>
         </div>
         <div className="flex flex-1 items-center justify-end gap-3">
           <ThemeSwitch />
diff --git a/ui/components/ui/nav-bar/navbar.tsx b/ui/components/ui/nav-bar/navbar.tsx
index f0024fdc76..5d397cb3e2 100644
--- a/ui/components/ui/nav-bar/navbar.tsx
+++ b/ui/components/ui/nav-bar/navbar.tsx
@@ -2,18 +2,26 @@ import { ReactNode, Suspense } from "react";
 
 import { FeedsServer } from "@/components/feeds";
 
-import { FeedsLoadingFallback, NavbarClient } from "./navbar-client";
+import {
+  FeedsLoadingFallback,
+  NavbarClient,
+  type OnboardingActionConfig,
+} from "./navbar-client";
+
+export type { OnboardingActionConfig };
 
 interface NavbarProps {
   title: string;
   icon?: string | ReactNode;
+  onboardingAction?: OnboardingActionConfig;
 }
 
-export function Navbar({ title, icon }: NavbarProps) {
+export function Navbar({ title, icon, onboardingAction }: NavbarProps) {
   return (
     <NavbarClient
       title={title}
       icon={icon}
+      onboardingAction={onboardingAction}
       feedsSlot={
         <Suspense key="feeds" fallback={<FeedsLoadingFallback />}>
           <FeedsServer limit={15} />
diff --git a/ui/components/ui/sidebar/menu.tsx b/ui/components/ui/sidebar/menu.tsx
index a36da25934..c2ba5d6c28 100644
--- a/ui/components/ui/sidebar/menu.tsx
+++ b/ui/components/ui/sidebar/menu.tsx
@@ -15,6 +15,7 @@ import { ScrollArea } from "@/components/ui/scroll-area/scroll-area";
 import { CollapsibleMenu } from "@/components/ui/sidebar/collapsible-menu";
 import { MenuItem } from "@/components/ui/sidebar/menu-item";
 import { useAuth } from "@/hooks";
+import { useRuntimeConfig } from "@/hooks/use-runtime-config";
 import { getMenuList } from "@/lib/menu-list";
 import { LAUNCH_SCAN_HREF } from "@/lib/scans-navigation";
 import { cn } from "@/lib/utils";
@@ -61,9 +62,11 @@ export const Menu = ({ isOpen }: { isOpen: boolean }) => {
     (state) => state.openLaunchScanModal,
   );
   const isScansPage = pathname.startsWith("/scans");
+  const { apiDocsUrl } = useRuntimeConfig();
 
   const menuList = getMenuList({
     pathname,
+    apiDocsUrl,
   });
 
   const labelsToHide = MENU_HIDE_RULES.filter((rule) =>
diff --git a/ui/components/ui/sidebar/sidebar-toggle.tsx b/ui/components/ui/sidebar/sidebar-toggle.tsx
index c479aab84a..27e1fdab27 100644
--- a/ui/components/ui/sidebar/sidebar-toggle.tsx
+++ b/ui/components/ui/sidebar/sidebar-toggle.tsx
@@ -1,39 +1,37 @@
-import {
-  SidebarCollapseIcon,
-  SidebarExpandIcon,
-} from "@/components/icons/Icons";
+import { ChevronLeft, ChevronRight } from "lucide-react";
+
+import { Button } from "@/components/shadcn/button/button";
 import {
   Tooltip,
   TooltipContent,
   TooltipTrigger,
 } from "@/components/shadcn/tooltip";
 
-import { Button } from "../button/button";
-
 interface SidebarToggleProps {
   isOpen: boolean | undefined;
   setIsOpen?: () => void;
 }
 
 export function SidebarToggle({ isOpen, setIsOpen }: SidebarToggleProps) {
+  // Closed → chevron right (will open); open/undefined → chevron left (will collapse).
+  const isClosed = isOpen === false;
+  const Chevron = isClosed ? ChevronRight : ChevronLeft;
+
   return (
     <Tooltip>
       <TooltipTrigger asChild>
         <Button
+          type="button"
+          variant="bare"
+          size="icon-sm"
           onClick={() => setIsOpen?.()}
-          className="h-8 w-8 rounded-md"
-          variant="outline"
-          size="icon"
+          aria-label={isClosed ? "Expand sidebar" : "Collapse sidebar"}
         >
-          {isOpen === false ? (
-            <SidebarCollapseIcon className="h-5 w-5" />
-          ) : (
-            <SidebarExpandIcon className="h-5 w-5" />
-          )}
+          <Chevron className="size-5" />
         </Button>
       </TooltipTrigger>
-      <TooltipContent>
-        {isOpen ? "Collapse Sidebar" : "Expand Sidebar"}
+      <TooltipContent side="bottom">
+        {isClosed ? "Expand Sidebar" : "Collapse Sidebar"}
       </TooltipContent>
     </Tooltip>
   );
diff --git a/ui/components/ui/sidebar/submenu-item.tsx b/ui/components/ui/sidebar/submenu-item.tsx
index 1b0b0aeaf3..2767381ff0 100644
--- a/ui/components/ui/sidebar/submenu-item.tsx
+++ b/ui/components/ui/sidebar/submenu-item.tsx
@@ -45,13 +45,13 @@ export const SubmenuItem = ({
       <Tooltip>
         <TooltipTrigger asChild>
           <Button
-            className="pointer-events-none mt-1 w-[calc(100%-12px)] cursor-not-allowed justify-start py-1"
+            className="pointer-events-none mt-1 w-[calc(100%-12px)] cursor-not-allowed justify-start px-2 py-1"
             disabled
           >
             <span className="mr-2">
               <Icon size={16} />
             </span>
-            <p className="max-w-[170px] truncate">{label}</p>
+            <p className="min-w-0 truncate">{label}</p>
           </Button>
         </TooltipTrigger>
         <TooltipContent side="right">
@@ -75,7 +75,7 @@ export const SubmenuItem = ({
           >
             <Button
               variant="menu-inactive"
-              className="text-text-neutral-tertiary w-full cursor-not-allowed justify-start py-1"
+              className="text-text-neutral-tertiary w-full cursor-not-allowed justify-start px-2 py-1"
               aria-disabled="true"
               tabIndex={-1}
               type="button"
@@ -83,8 +83,8 @@ export const SubmenuItem = ({
               <span className="mr-2">
                 <Icon size={16} />
               </span>
-              <p className="flex max-w-[170px] items-center gap-2 truncate">
-                <span>{label}</span>
+              <p className="flex min-w-0 items-center gap-2">
+                <span className="truncate">{label}</span>
                 {highlight && (
                   <MenuFeatureBadge label="New" variant="new" size="sm" />
                 )}
@@ -100,7 +100,7 @@ export const SubmenuItem = ({
   return (
     <Button
       variant={isActive ? "menu-active" : "menu-inactive"}
-      className="mt-1 w-[calc(100%-12px)] justify-start py-1"
+      className="mt-1 w-[calc(100%-12px)] justify-start px-2 py-1"
       asChild={!disabled}
       disabled={disabled}
     >
@@ -113,8 +113,8 @@ export const SubmenuItem = ({
         <span className="mr-2">
           <Icon size={16} />
         </span>
-        <p className="flex max-w-[170px] items-center truncate">
-          <span>{label}</span>
+        <p className="flex min-w-0 items-center">
+          <span className="truncate">{label}</span>
           {highlight && (
             <MenuFeatureBadge
               label="New"
diff --git a/ui/components/ui/table/data-table-expand-toggle.tsx b/ui/components/ui/table/data-table-expand-toggle.tsx
index 5bd7f13c09..7e18b4e510 100644
--- a/ui/components/ui/table/data-table-expand-toggle.tsx
+++ b/ui/components/ui/table/data-table-expand-toggle.tsx
@@ -44,14 +44,14 @@ export function DataTableExpandToggle<TData>({
   const isExpanded = isExpandedProp ?? row.getIsExpanded();
 
   if (!row.getCanExpand()) {
-    return <div className="w-4" />;
+    return <div className="w-4 shrink-0" />;
   }
 
   return (
     <button
       onClick={row.getToggleExpandedHandler()}
       className={cn(
-        "rounded transition-colors",
+        "shrink-0 rounded transition-colors",
         "hover:bg-prowler-white/10",
         "focus-visible:ring-border-input-primary-press focus-visible:ring-2 focus-visible:outline-none",
       )}
diff --git a/ui/components/ui/table/data-table-expandable-cell.tsx b/ui/components/ui/table/data-table-expandable-cell.tsx
index 8121e81b30..4ecf0b6b95 100644
--- a/ui/components/ui/table/data-table-expandable-cell.tsx
+++ b/ui/components/ui/table/data-table-expandable-cell.tsx
@@ -73,12 +73,13 @@ export function DataTableExpandableCell<TData>({
           {canExpand ? (
             <DataTableExpandToggle row={row} isExpanded={isExpanded} />
           ) : !isChildRow ? (
-            <div className="w-4" />
+            // shrink-0: keep this fixed-width spacer from collapsing under wide content, which would drag the checkbox left
+            <div className="w-4 shrink-0" />
           ) : null}
         </>
       )}
       {checkboxSlot && (
-        <div className="mr-2 flex items-center">{checkboxSlot}</div>
+        <div className="mr-2 flex shrink-0 items-center">{checkboxSlot}</div>
       )}
       {children}
     </div>
diff --git a/ui/components/ui/table/data-table.test.tsx b/ui/components/ui/table/data-table.test.tsx
index e86a39159c..7de2a81be8 100644
--- a/ui/components/ui/table/data-table.test.tsx
+++ b/ui/components/ui/table/data-table.test.tsx
@@ -40,6 +40,19 @@ const columns: ColumnDef<TestRow>[] = [
   },
 ];
 
+const columnsWithActions: ColumnDef<TestRow>[] = [
+  {
+    accessorKey: "name",
+    header: "Name",
+  },
+  {
+    id: "actions",
+    header: "",
+    cell: () => <button type="button">Actions</button>,
+    enableSorting: false,
+  },
+];
+
 const metadata: MetaDataProps = {
   pagination: {
     page: 1,
@@ -99,4 +112,60 @@ describe("DataTable", () => {
       expect(rightContent).toHaveClass("md:w-auto");
     });
   });
+
+  describe("when an actions column is present", () => {
+    it("should keep the actions header and cells sticky on the right edge", () => {
+      // Given
+      render(
+        <DataTable
+          columns={columnsWithActions}
+          data={[{ name: "Finding A" }]}
+        />,
+      );
+
+      // When
+      const columnHeaders = screen.getAllByRole("columnheader");
+      const nameHeader = columnHeaders[0];
+      const actionsHeader = columnHeaders.at(-1);
+      expect(actionsHeader).toBeDefined();
+      const actionsHeaderElement = actionsHeader as HTMLElement;
+      const nameCell = screen.getByText("Finding A").closest("td");
+      const actionsCell = screen
+        .getByRole("button", {
+          name: "Actions",
+        })
+        .closest("td");
+
+      // Then
+      expect(nameHeader).not.toHaveClass("sticky");
+      expect(nameCell).not.toHaveClass("sticky");
+      expect(actionsHeaderElement).not.toHaveClass("sticky");
+      expect(actionsHeaderElement).not.toHaveClass("right-0");
+      expect(actionsHeaderElement).not.toHaveClass("z-20");
+      expect(actionsHeaderElement).toHaveClass("bg-bg-neutral-tertiary");
+      expect(actionsHeaderElement).toHaveClass("border-y");
+      expect(actionsHeaderElement).toHaveClass("last:border-r");
+      expect(actionsHeaderElement).toHaveClass("last:rounded-r-full");
+      expect(actionsHeaderElement).not.toHaveClass("bg-transparent");
+      expect(actionsHeaderElement).not.toHaveClass("border-y-0");
+      expect(actionsHeaderElement).not.toHaveClass("border-l-0");
+      expect(actionsHeaderElement).not.toHaveClass("border-r-0");
+      expect(actionsHeaderElement).not.toHaveClass("last:border-r-0");
+      expect(actionsHeaderElement).not.toHaveClass("backdrop-blur-none");
+      expect(actionsHeaderElement).not.toHaveClass("last:rounded-r-none");
+      expect(actionsHeaderElement).not.toHaveClass("before:bg-gradient-to-r");
+      expect(actionsHeaderElement).not.toHaveClass("before:content-['']");
+      expect(actionsHeaderElement).not.toHaveClass("after:content-['']");
+      expect(actionsHeaderElement).not.toHaveClass("after:rounded-r-full");
+      expect(actionsHeaderElement.querySelector("div")).not.toBeInTheDocument();
+      expect(actionsCell).toHaveClass("sticky");
+      expect(actionsCell).toHaveClass("right-0");
+      expect(actionsCell).toHaveClass("z-20");
+      expect(actionsCell).toHaveClass("bg-bg-neutral-secondary");
+      expect(actionsCell).not.toHaveClass("border-l");
+      expect(actionsCell).toHaveClass("before:bg-gradient-to-r");
+      expect(actionsCell).toHaveClass("before:from-transparent");
+      expect(actionsCell).toHaveClass("before:to-bg-neutral-secondary");
+    });
+  });
 });
diff --git a/ui/components/ui/table/data-table.tsx b/ui/components/ui/table/data-table.tsx
index e3d6e90b22..b31092e3e2 100644
--- a/ui/components/ui/table/data-table.tsx
+++ b/ui/components/ui/table/data-table.tsx
@@ -34,12 +34,28 @@ import { useFilterTransitionOptional } from "@/contexts";
 import { cn } from "@/lib";
 import { FilterOption, MetaDataProps } from "@/types";
 
+type DataTableRowAttributes = {
+  [key: `data-${string}`]: string | undefined;
+};
+
 /**
  * Default column size used by TanStack Table when no explicit size is set.
  * We skip applying inline width styles for columns with this default value
  * to allow them to flex naturally within the table layout.
  */
 const DEFAULT_COLUMN_SIZE = 150;
+const ACTIONS_COLUMN_ID = "actions";
+const STICKY_ACTION_COLUMN_CLASS = "sticky right-0 z-20 min-w-12";
+const STICKY_ACTION_CELL_CLASS = `${STICKY_ACTION_COLUMN_CLASS} overflow-visible bg-bg-neutral-secondary before:pointer-events-none before:absolute before:inset-y-0 before:-left-8 before:w-8 before:bg-gradient-to-r before:from-transparent before:to-bg-neutral-secondary before:content-[''] group-hover:bg-bg-neutral-tertiary group-hover:before:to-bg-neutral-tertiary group-data-[state=selected]:bg-bg-neutral-tertiary group-data-[state=selected]:before:to-bg-neutral-tertiary`;
+
+const getStickyActionColumnClassName = (
+  columnId: string,
+  variant: "header" | "cell",
+) => {
+  if (columnId !== ACTIONS_COLUMN_ID) return undefined;
+
+  return variant === "header" ? undefined : STICKY_ACTION_CELL_CLASS;
+};
 
 interface DataTableProviderProps<TData, TValue> {
   columns: ColumnDef<TData, TValue>[];
@@ -110,6 +126,8 @@ interface DataTableProviderProps<TData, TValue> {
   searchBadge?: { label: string; onDismiss: () => void };
   /** Optional click handler for top-level rows. */
   onRowClick?: (row: Row<TData>) => void;
+  /** Optional data attributes applied to each top-level row. */
+  getRowAttributes?: (row: Row<TData>) => DataTableRowAttributes;
   /** Optional header rendered inside the table container, above the toolbar. */
   header?: ReactNode;
   /** Optional content rendered in the toolbar before the total entries count. */
@@ -144,6 +162,7 @@ export function DataTable<TData, TValue>({
   renderAfterRow,
   searchBadge,
   onRowClick,
+  getRowAttributes,
   header,
   toolbarRightContent,
 }: DataTableProviderProps<TData, TValue>) {
@@ -279,16 +298,21 @@ export function DataTable<TData, TValue>({
             <TableRow key={`${headerGroup.id}-${selectionKey}-${expansionKey}`}>
               {headerGroup.headers.map((header) => {
                 const size = header.getSize();
+                const isActionsHeader = header.column.id === ACTIONS_COLUMN_ID;
                 return (
                   <TableHead
                     key={header.id}
+                    className={getStickyActionColumnClassName(
+                      header.column.id,
+                      "header",
+                    )}
                     style={
                       getSubRows && size !== DEFAULT_COLUMN_SIZE
                         ? { width: `${size}px` }
                         : undefined
                     }
                   >
-                    {header.isPlaceholder
+                    {header.isPlaceholder || isActionsHeader
                       ? null
                       : flexRender(
                           header.column.columnDef.header,
@@ -314,14 +338,21 @@ export function DataTable<TData, TValue>({
                 ) : (
                   <Fragment key={row.id}>
                     <TableRow
+                      {...getRowAttributes?.(row)}
                       data-state={row.getIsSelected() && "selected"}
-                      className={cn(onRowClick && "cursor-pointer")}
+                      className={cn("group", onRowClick && "cursor-pointer")}
                       onClick={(event) =>
                         handleRowClick(row, event.target as HTMLElement)
                       }
                     >
                       {row.getVisibleCells().map((cell) => (
-                        <TableCell key={cell.id}>
+                        <TableCell
+                          key={cell.id}
+                          className={getStickyActionColumnClassName(
+                            cell.column.id,
+                            "cell",
+                          )}
+                        >
                           {flexRender(
                             cell.column.columnDef.cell,
                             cell.getContext(),
diff --git a/ui/components/users/table/data-table-row-actions.test.tsx b/ui/components/users/table/data-table-row-actions.test.tsx
new file mode 100644
index 0000000000..39a6c95f8b
--- /dev/null
+++ b/ui/components/users/table/data-table-row-actions.test.tsx
@@ -0,0 +1,159 @@
+import { Row } from "@tanstack/react-table";
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+// The forms pull in server actions (`@/actions/users/users`) that can't run in
+// jsdom, so stub them with identifiable markers to assert which modal opens.
+vi.mock("../forms", () => ({
+  DeleteForm: ({ userId }: { userId: string }) => (
+    <div data-testid="delete-form">delete-form:{userId}</div>
+  ),
+  EditForm: ({ userId }: { userId: string }) => (
+    <div data-testid="edit-form">edit-form:{userId}</div>
+  ),
+  ExpelUserForm: ({ userId }: { userId: string }) => (
+    <div data-testid="expel-form">expel-form:{userId}</div>
+  ),
+}));
+
+import { DataTableRowActions } from "./data-table-row-actions";
+
+interface RowOptions {
+  id?: string;
+  isCurrentUser?: boolean;
+  canBeExpelled?: boolean;
+  currentTenantId?: string;
+}
+
+const createRow = ({
+  id = "user-1",
+  isCurrentUser,
+  canBeExpelled,
+  currentTenantId,
+}: RowOptions = {}) =>
+  ({
+    original: {
+      id,
+      attributes: {
+        name: "Jane Doe",
+        email: "jane@example.com",
+        company_name: "Acme",
+        role: { name: "admin" },
+      },
+      isCurrentUser,
+      canBeExpelled,
+      currentTenantId,
+    },
+  }) as unknown as Row<{ id: string }>;
+
+const openMenu = async (user: ReturnType<typeof userEvent.setup>) => {
+  await user.click(screen.getByRole("button", { name: "Open actions menu" }));
+};
+
+describe("DataTableRowActions (users)", () => {
+  it("always renders the Edit User action", async () => {
+    const user = userEvent.setup();
+    render(<DataTableRowActions row={createRow()} />);
+
+    await openMenu(user);
+
+    expect(screen.getByText("Edit User")).toBeInTheDocument();
+  });
+
+  it("shows Delete User only for the current user's row", async () => {
+    const user = userEvent.setup();
+    render(<DataTableRowActions row={createRow({ isCurrentUser: true })} />);
+
+    await openMenu(user);
+
+    expect(screen.getByText("Delete User")).toBeInTheDocument();
+    expect(screen.getByText("Danger zone")).toBeInTheDocument();
+  });
+
+  it("does NOT show Delete User for another user's row", async () => {
+    const user = userEvent.setup();
+    render(<DataTableRowActions row={createRow({ isCurrentUser: false })} />);
+
+    await openMenu(user);
+
+    expect(screen.queryByText("Delete User")).not.toBeInTheDocument();
+  });
+
+  it("does NOT show Delete User when isCurrentUser is undefined", async () => {
+    const user = userEvent.setup();
+    render(<DataTableRowActions row={createRow({})} />);
+
+    await openMenu(user);
+
+    expect(screen.queryByText("Delete User")).not.toBeInTheDocument();
+  });
+
+  it("hides the Danger zone entirely when the user can neither be deleted nor expelled", async () => {
+    const user = userEvent.setup();
+    render(
+      <DataTableRowActions
+        row={createRow({ isCurrentUser: false, canBeExpelled: false })}
+      />,
+    );
+
+    await openMenu(user);
+
+    // Only the non-destructive Edit action remains.
+    expect(screen.getByText("Edit User")).toBeInTheDocument();
+    expect(screen.queryByText("Danger zone")).not.toBeInTheDocument();
+    expect(screen.queryByText("Delete User")).not.toBeInTheDocument();
+    expect(
+      screen.queryByText("Expel from organization"),
+    ).not.toBeInTheDocument();
+  });
+
+  it("shows Expel but not Delete User for an expellable, non-current user", async () => {
+    const user = userEvent.setup();
+    render(
+      <DataTableRowActions
+        row={createRow({
+          isCurrentUser: false,
+          canBeExpelled: true,
+          currentTenantId: "tenant-1",
+        })}
+      />,
+    );
+
+    await openMenu(user);
+
+    expect(screen.getByText("Danger zone")).toBeInTheDocument();
+    expect(screen.getByText("Expel from organization")).toBeInTheDocument();
+    expect(screen.queryByText("Delete User")).not.toBeInTheDocument();
+  });
+
+  it("renders Delete User with destructive styling", async () => {
+    const user = userEvent.setup();
+    render(<DataTableRowActions row={createRow({ isCurrentUser: true })} />);
+
+    await openMenu(user);
+
+    const menuItem = screen
+      .getByText("Delete User")
+      .closest("[role='menuitem']");
+    expect(menuItem).toBeInTheDocument();
+    expect(menuItem).toHaveClass("text-text-error-primary");
+  });
+
+  it("opens the delete confirmation modal when Delete User is selected", async () => {
+    const user = userEvent.setup();
+    render(
+      <DataTableRowActions
+        row={createRow({ id: "user-42", isCurrentUser: true })}
+      />,
+    );
+
+    await openMenu(user);
+    await user.click(screen.getByText("Delete User"));
+
+    expect(screen.getByText("Are you absolutely sure?")).toBeInTheDocument();
+    expect(screen.getByTestId("delete-form")).toHaveTextContent(
+      "delete-form:user-42",
+    );
+  });
+});
diff --git a/ui/components/users/table/data-table-row-actions.tsx b/ui/components/users/table/data-table-row-actions.tsx
index 3bc8e6a0c8..29c59566da 100644
--- a/ui/components/users/table/data-table-row-actions.tsx
+++ b/ui/components/users/table/data-table-row-actions.tsx
@@ -29,6 +29,7 @@ interface UserRowData {
   attributes?: UserRowAttributes;
   canBeExpelled?: boolean;
   currentTenantId?: string;
+  isCurrentUser?: boolean;
 }
 
 interface DataTableRowActionsProps<UserProps extends UserRowData> {
@@ -57,6 +58,10 @@ export function DataTableRowActions<UserProps extends UserRowData>({
     row.original.canBeExpelled === true && !!row.original.currentTenantId;
   const currentTenantId = row.original.currentTenantId;
 
+  // A user can only delete their own account (enforced by the backend), so the
+  // delete action is shown exclusively for the current user's row.
+  const canDeleteUser = row.original.isCurrentUser === true;
+
   return (
     <>
       <Modal
@@ -74,14 +79,16 @@ export function DataTableRowActions<UserProps extends UserRowData>({
           setIsOpen={setIsEditOpen}
         />
       </Modal>
-      <Modal
-        open={isDeleteOpen}
-        onOpenChange={setIsDeleteOpen}
-        title="Are you absolutely sure?"
-        description="This action cannot be undone. This will permanently delete your user account and remove your data from the server."
-      >
-        <DeleteForm userId={userId} setIsOpen={setIsDeleteOpen} />
-      </Modal>
+      {canDeleteUser && (
+        <Modal
+          open={isDeleteOpen}
+          onOpenChange={setIsDeleteOpen}
+          title="Are you absolutely sure?"
+          description="This action cannot be undone. This will permanently delete your user account and remove your data from the server."
+        >
+          <DeleteForm userId={userId} setIsOpen={setIsDeleteOpen} />
+        </Modal>
+      )}
       {canExpelUser && currentTenantId && (
         <Modal
           open={isExpelOpen}
@@ -104,22 +111,26 @@ export function DataTableRowActions<UserProps extends UserRowData>({
             label="Edit User"
             onSelect={() => setIsEditOpen(true)}
           />
-          <ActionDropdownDangerZone>
-            {canExpelUser && (
-              <ActionDropdownItem
-                icon={<UserMinus aria-hidden="true" />}
-                label="Expel from organization"
-                destructive
-                onSelect={() => setIsExpelOpen(true)}
-              />
-            )}
-            <ActionDropdownItem
-              icon={<Trash2 aria-hidden="true" />}
-              label="Delete User"
-              destructive
-              onSelect={() => setIsDeleteOpen(true)}
-            />
-          </ActionDropdownDangerZone>
+          {(canExpelUser || canDeleteUser) && (
+            <ActionDropdownDangerZone>
+              {canExpelUser && (
+                <ActionDropdownItem
+                  icon={<UserMinus aria-hidden="true" />}
+                  label="Expel from organization"
+                  destructive
+                  onSelect={() => setIsExpelOpen(true)}
+                />
+              )}
+              {canDeleteUser && (
+                <ActionDropdownItem
+                  icon={<Trash2 aria-hidden="true" />}
+                  label="Delete User"
+                  destructive
+                  onSelect={() => setIsDeleteOpen(true)}
+                />
+              )}
+            </ActionDropdownDangerZone>
+          )}
         </ActionDropdown>
       </div>
     </>
diff --git a/ui/dependency-log.json b/ui/dependency-log.json
index 60484435ab..36d1c2edde 100644
--- a/ui/dependency-log.json
+++ b/ui/dependency-log.json
@@ -2,10 +2,10 @@
   {
     "section": "dependencies",
     "name": "@ai-sdk/react",
-    "from": "2.0.106",
-    "to": "2.0.111",
+    "from": "3.0.207",
+    "to": "3.0.205",
     "strategy": "installed",
-    "generatedAt": "2025-12-15T08:24:46.195Z"
+    "generatedAt": "2026-06-17T11:28:12.866Z"
   },
   {
     "section": "dependencies",
@@ -114,10 +114,10 @@
   {
     "section": "dependencies",
     "name": "@next/third-parties",
-    "from": "16.2.3",
-    "to": "16.2.6",
+    "from": "16.2.6",
+    "to": "16.2.9",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:09:04.901Z"
+    "generatedAt": "2026-06-15T07:49:41.143Z"
   },
   {
     "section": "dependencies",
@@ -362,10 +362,10 @@
   {
     "section": "dependencies",
     "name": "ai",
-    "from": "5.0.59",
-    "to": "5.0.109",
+    "from": "6.0.205",
+    "to": "6.0.203",
     "strategy": "installed",
-    "generatedAt": "2025-12-15T08:24:46.195Z"
+    "generatedAt": "2026-06-17T11:28:12.866Z"
   },
   {
     "section": "dependencies",
@@ -407,6 +407,14 @@
     "strategy": "installed",
     "generatedAt": "2025-10-22T12:36:37.962Z"
   },
+  {
+    "section": "dependencies",
+    "name": "driver.js",
+    "from": "1.4.0",
+    "to": "1.4.0",
+    "strategy": "installed",
+    "generatedAt": "2026-05-26T13:05:09.776Z"
+  },
   {
     "section": "dependencies",
     "name": "framer-motion",
@@ -482,10 +490,10 @@
   {
     "section": "dependencies",
     "name": "next",
-    "from": "16.2.3",
-    "to": "16.2.6",
+    "from": "16.2.6",
+    "to": "16.2.9",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:09:04.901Z"
+    "generatedAt": "2026-06-15T07:49:41.143Z"
   },
   {
     "section": "dependencies",
@@ -506,10 +514,10 @@
   {
     "section": "dependencies",
     "name": "react",
-    "from": "19.2.5",
-    "to": "19.2.6",
+    "from": "19.2.6",
+    "to": "19.2.7",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:34:34.526Z"
+    "generatedAt": "2026-06-15T07:53:01.462Z"
   },
   {
     "section": "dependencies",
@@ -522,10 +530,10 @@
   {
     "section": "dependencies",
     "name": "react-dom",
-    "from": "19.2.5",
-    "to": "19.2.6",
+    "from": "19.2.6",
+    "to": "19.2.7",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:34:34.526Z"
+    "generatedAt": "2026-06-15T07:53:01.462Z"
   },
   {
     "section": "dependencies",
@@ -658,10 +666,10 @@
   {
     "section": "devDependencies",
     "name": "@next/eslint-plugin-next",
-    "from": "16.2.3",
-    "to": "16.2.6",
+    "from": "16.2.6",
+    "to": "16.2.9",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:09:04.901Z"
+    "generatedAt": "2026-06-15T07:49:41.143Z"
   },
   {
     "section": "devDependencies",
@@ -722,10 +730,10 @@
   {
     "section": "devDependencies",
     "name": "@types/react",
-    "from": "19.1.13",
-    "to": "19.2.8",
+    "from": "19.2.8",
+    "to": "19.2.17",
     "strategy": "installed",
-    "generatedAt": "2026-01-19T13:54:24.770Z"
+    "generatedAt": "2026-06-15T07:53:01.462Z"
   },
   {
     "section": "devDependencies",
@@ -762,26 +770,26 @@
   {
     "section": "devDependencies",
     "name": "@vitest/browser",
-    "from": "4.1.6",
-    "to": "4.0.18",
+    "from": "4.0.18",
+    "to": "4.1.8",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:22:47.378Z"
+    "generatedAt": "2026-06-02T11:34:46.264Z"
   },
   {
     "section": "devDependencies",
     "name": "@vitest/browser-playwright",
-    "from": "4.1.6",
-    "to": "4.0.18",
+    "from": "4.0.18",
+    "to": "4.1.8",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:22:47.378Z"
+    "generatedAt": "2026-06-02T11:34:46.264Z"
   },
   {
     "section": "devDependencies",
     "name": "@vitest/coverage-v8",
-    "from": "4.1.6",
-    "to": "4.0.18",
+    "from": "4.0.18",
+    "to": "4.1.8",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:22:47.378Z"
+    "generatedAt": "2026-06-02T11:34:46.264Z"
   },
   {
     "section": "devDependencies",
@@ -970,10 +978,10 @@
   {
     "section": "devDependencies",
     "name": "vitest",
-    "from": "4.1.6",
-    "to": "4.0.18",
+    "from": "4.0.18",
+    "to": "4.1.8",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:22:47.378Z"
+    "generatedAt": "2026-06-02T11:34:46.264Z"
   },
   {
     "section": "devDependencies",
diff --git a/ui/hooks/use-runtime-config.test.ts b/ui/hooks/use-runtime-config.test.ts
new file mode 100644
index 0000000000..60cac41295
--- /dev/null
+++ b/ui/hooks/use-runtime-config.test.ts
@@ -0,0 +1,52 @@
+import { renderHook } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { RUNTIME_CONFIG_SCRIPT_ID } from "@/lib/runtime-config.shared";
+
+const writeIsland = (content: string) => {
+  const el = document.createElement("script");
+  el.id = RUNTIME_CONFIG_SCRIPT_ID;
+  el.type = "application/json";
+  el.textContent = content;
+  document.head.appendChild(el);
+};
+
+describe("useRuntimeConfig", () => {
+  beforeEach(() => {
+    // Reset modules so the underlying reader's memoization cache starts empty.
+    vi.resetModules();
+    document.head.innerHTML = "";
+  });
+
+  afterEach(() => {
+    document.head.innerHTML = "";
+  });
+
+  it("should expose the runtime config island to client components", async () => {
+    // Given
+    writeIsland(
+      JSON.stringify({ apiDocsUrl: "https://self-hosted.example/api/v1/docs" }),
+    );
+    const { useRuntimeConfig } = await import("./use-runtime-config");
+
+    // When
+    const { result } = renderHook(() => useRuntimeConfig());
+
+    // Then
+    expect(result.current.apiDocsUrl).toBe(
+      "https://self-hosted.example/api/v1/docs",
+    );
+  });
+
+  it("should return an all-null config when the island is absent", async () => {
+    // Given no island in the document
+    const { useRuntimeConfig } = await import("./use-runtime-config");
+
+    // When
+    const { result } = renderHook(() => useRuntimeConfig());
+
+    // Then
+    expect(result.current.apiDocsUrl).toBeNull();
+    expect(result.current.apiBaseUrl).toBeNull();
+  });
+});
diff --git a/ui/hooks/use-runtime-config.ts b/ui/hooks/use-runtime-config.ts
new file mode 100644
index 0000000000..86118a0a91
--- /dev/null
+++ b/ui/hooks/use-runtime-config.ts
@@ -0,0 +1,25 @@
+"use client";
+
+import { useSyncExternalStore } from "react";
+
+import { getRuntimeConfigClient } from "@/lib/get-runtime-config.client";
+import {
+  EMPTY_RUNTIME_PUBLIC_CONFIG,
+  type RuntimePublicConfig,
+} from "@/lib/runtime-config.shared";
+
+// The island is browser-only, so SSR and the first hydration render must see
+// the empty config to avoid a mismatch; useSyncExternalStore swaps to the
+// island value afterwards. Both snapshots must be referentially stable.
+const subscribe = () => () => {}; // config is immutable after load — never notifies
+
+const getServerSnapshot = (): RuntimePublicConfig =>
+  EMPTY_RUNTIME_PUBLIC_CONFIG;
+
+export function useRuntimeConfig(): RuntimePublicConfig {
+  return useSyncExternalStore(
+    subscribe,
+    getRuntimeConfigClient,
+    getServerSnapshot,
+  );
+}
diff --git a/ui/instrumentation-client.test.ts b/ui/instrumentation-client.test.ts
new file mode 100644
index 0000000000..69728d5426
--- /dev/null
+++ b/ui/instrumentation-client.test.ts
@@ -0,0 +1,97 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { EMPTY_RUNTIME_PUBLIC_CONFIG } from "@/lib/runtime-config.shared";
+
+// Stable mock fns shared across module re-evaluations (resetModules clears the
+// module registry but these hoisted fns survive, so assertions stay reliable).
+const { initMock, setUserMock, captureMock, getConfigMock } = vi.hoisted(
+  () => ({
+    initMock: vi.fn(),
+    setUserMock: vi.fn(),
+    captureMock: vi.fn(),
+    getConfigMock: vi.fn(),
+  }),
+);
+
+vi.mock("@sentry/nextjs", () => ({
+  init: initMock,
+  setUser: setUserMock,
+  captureRouterTransitionStart: captureMock,
+  browserTracingIntegration: vi.fn(() => ({})),
+}));
+
+vi.mock("@/lib/get-runtime-config.client", () => ({
+  getRuntimeConfigClient: getConfigMock,
+}));
+
+vi.mock("@/components/ui/navigation-progress/use-navigation-progress", () => ({
+  startProgress: vi.fn(),
+  cancelProgress: vi.fn(),
+}));
+
+describe("instrumentation-client Sentry init", () => {
+  beforeEach(() => {
+    // Re-evaluate the module per case so its top-level init guard re-runs.
+    vi.resetModules();
+    initMock.mockClear();
+    setUserMock.mockClear();
+    captureMock.mockClear();
+    getConfigMock.mockReset();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("initializes Sentry with the runtime DSN and the build-time release when a DSN is present", async () => {
+    // Given
+    getConfigMock.mockReturnValue({
+      ...EMPTY_RUNTIME_PUBLIC_CONFIG,
+      sentryDsn: "https://key@o0.ingest.sentry.io/1",
+      sentryEnvironment: "pro",
+    });
+    // The browser release comes from the build-time public version (D10);
+    // SENTRY_RELEASE is non-public and never reaches the client.
+    vi.stubEnv("NEXT_PUBLIC_PROWLER_RELEASE_VERSION", "1.30.0");
+
+    // When
+    await import("@/instrumentation-client");
+
+    // Then
+    expect(initMock).toHaveBeenCalledTimes(1);
+    expect(initMock.mock.calls[0][0]).toMatchObject({
+      dsn: "https://key@o0.ingest.sentry.io/1",
+      environment: "pro",
+      release: "1.30.0",
+    });
+  });
+
+  it("does not initialize Sentry when the DSN is absent", async () => {
+    // Given
+    getConfigMock.mockReturnValue({ ...EMPTY_RUNTIME_PUBLIC_CONFIG });
+
+    // When
+    await import("@/instrumentation-client");
+
+    // Then
+    expect(initMock).not.toHaveBeenCalled();
+  });
+
+  it("defaults to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT does not enable dev mode", async () => {
+    // Given - DSN set but environment unset
+    getConfigMock.mockReturnValue({
+      ...EMPTY_RUNTIME_PUBLIC_CONFIG,
+      sentryDsn: "https://key@o0.ingest.sentry.io/1",
+    });
+
+    // When
+    await import("@/instrumentation-client");
+
+    // Then
+    const options = initMock.mock.calls[0][0];
+    expect(options.environment).toBe("production");
+    expect(options.debug).toBe(false);
+    expect(options.tracesSampleRate).toBe(0.5);
+    expect(setUserMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/instrumentation-client.ts b/ui/instrumentation-client.ts
index 379acea50d..abced8232e 100644
--- a/ui/instrumentation-client.ts
+++ b/ui/instrumentation-client.ts
@@ -1,16 +1,26 @@
 /**
  * Next.js Client Instrumentation
  *
- * This file runs on the client before React hydration.
- * Used to set up navigation progress tracking.
+ * This file runs on the client BEFORE React hydration. It is responsible for:
+ * - Initializing browser Sentry from the runtime data island, so a single
+ *   prebuilt image enables/disables Sentry per deployment via `UI_SENTRY_DSN`
+ *   (unset DSN ⇒ `Sentry.init` is never called ⇒ zero egress).
+ * - Driving the navigation progress bar on router transitions.
+ *
+ * Running here (rather than in a React effect) means Sentry is configured
+ * before hydration, so browserTracing's performance observers attach early and
+ * the error boundary in `global-error.tsx` is covered.
  *
  * @see https://nextjs.org/docs/app/api-reference/file-conventions/instrumentation-client
  */
 
+import * as Sentry from "@sentry/nextjs";
+
 import {
   cancelProgress,
   startProgress,
 } from "@/components/ui/navigation-progress/use-navigation-progress";
+import { getRuntimeConfigClient } from "@/lib/get-runtime-config.client";
 
 export const NAVIGATION_TYPE = {
   PUSH: "push",
@@ -20,17 +30,133 @@ export const NAVIGATION_TYPE = {
 
 type NavigationType = (typeof NAVIGATION_TYPE)[keyof typeof NAVIGATION_TYPE];
 
+const { sentryDsn, sentryEnvironment } = getRuntimeConfigClient();
+
+// Only initialize Sentry in the browser when a runtime DSN is configured.
+if (typeof window !== "undefined" && sentryDsn) {
+  // Default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT never
+  // runs the browser SDK in dev mode (debug logging, 100% sampling, synthetic
+  // dev user); only an explicit "local" enables it.
+  const environment = sentryEnvironment ?? "production";
+  const isDevelopment = environment === "local";
+
+  /**
+   * Initialize Sentry error tracking and performance monitoring.
+   *
+   * This setup includes:
+   * - Performance monitoring with Web Vitals tracking (LCP, FID, CLS, INP)
+   * - Long task detection for UI-blocking operations
+   * - beforeSend hook to filter noise
+   */
+  Sentry.init({
+    // 📍 DSN - resolved at runtime from the data island
+    dsn: sentryDsn,
+
+    // 🌍 Environment - separate dev errors from production
+    environment,
+
+    // 📦 Release - the browser can only read the build-time public release
+    // version; SENTRY_RELEASE is non-public and never reaches the client. The
+    // server/edge SDKs read SENTRY_RELEASE for parity (D10). No new release var.
+    release: process.env.NEXT_PUBLIC_PROWLER_RELEASE_VERSION,
+
+    // 🐛 Debug - detailed logs in development console
+    debug: isDevelopment,
+
+    // 📊 Sample Rates - Performance monitoring
+    // 100% in dev (test everything), 50% in production (balance visibility with costs)
+    tracesSampleRate: isDevelopment ? 1.0 : 0.5,
+    profilesSampleRate: isDevelopment ? 1.0 : 0.5,
+
+    // 🔌 Integrations - browserTracingIntegration is client-only
+    integrations: [
+      // 📊 Performance Monitoring: Core Web Vitals + RUM
+      // Tracks LCP, FID, CLS, INP
+      Sentry.browserTracingIntegration({
+        enableLongTask: true, // Detect tasks that block UI (>50ms)
+        enableInp: true, // Interaction to Next Paint (Core Web Vital)
+      }),
+    ],
+
+    // 🎣 Filter expected errors / noise before sending to Sentry
+    ignoreErrors: [
+      // Browser extensions
+      "top.GLOBALS",
+      // Random network errors
+      "Network request failed",
+      "NetworkError",
+      "Failed to fetch",
+      // User canceled actions
+      "AbortError",
+      "Non-Error promise rejection captured",
+      // NextAuth expected errors
+      "NEXT_REDIRECT",
+      // ResizeObserver errors (common browser quirk, not real bugs)
+      "ResizeObserver",
+    ],
+
+    beforeSend(event, hint) {
+      // Filter out noise: ResizeObserver errors (common browser quirk, not real bugs)
+      if (event.message?.includes("ResizeObserver")) {
+        return null; // Don't send to Sentry
+      }
+
+      // Filter out non-actionable errors
+      if (event.exception) {
+        const error = hint.originalException;
+
+        // Don't send cancelled requests
+        if (
+          error &&
+          typeof error === "object" &&
+          "name" in error &&
+          error.name === "AbortError"
+        ) {
+          return null;
+        }
+
+        // Add additional context for API errors
+        if (
+          error &&
+          typeof error === "object" &&
+          "message" in error &&
+          typeof error.message === "string" &&
+          error.message.includes("Request failed")
+        ) {
+          event.tags = {
+            ...event.tags,
+            error_type: "api_error",
+          };
+        }
+      }
+
+      return event; // Send to Sentry
+    },
+  });
+
+  // 👤 Set user context (identifies who experienced the error)
+  // In production, this will be updated after authentication
+  if (isDevelopment) {
+    Sentry.setUser({
+      id: "dev-user",
+    });
+  }
+}
+
 function getCurrentUrl(): string {
   return window.location.pathname + window.location.search;
 }
 
 /**
  * Called by Next.js when router navigation begins.
- * Triggers the navigation progress bar.
+ *
+ * Triggers the navigation progress bar AND forwards the transition to Sentry
+ * (`captureRouterTransitionStart` is a safe no-op when Sentry is
+ * uninitialized).
  */
 export function onRouterTransitionStart(
   url: string,
-  _navigationType: NavigationType,
+  navigationType: NavigationType,
 ) {
   const currentUrl = getCurrentUrl();
 
@@ -41,4 +167,6 @@ export function onRouterTransitionStart(
     // Different URL - start progress
     startProgress();
   }
+
+  Sentry.captureRouterTransitionStart(url, navigationType);
 }
diff --git a/ui/instrumentation.ts b/ui/instrumentation.ts
index 0092bd29b5..6716ffeb4e 100644
--- a/ui/instrumentation.ts
+++ b/ui/instrumentation.ts
@@ -9,18 +9,23 @@
  *    - sentry/sentry.server.config.ts (Node.js runtime)
  *    - sentry/sentry.edge.config.ts (Edge runtime)
  * 3. Client-side init:
- *    - app/instrumentation.client.ts (Browser/Client)
+ *    - instrumentation-client.ts (Browser/Client; reads the runtime data island)
  *
  * @see https://nextjs.org/docs/app/building-your-application/optimizing/instrumentation
  */
 
+// Fail fast at server boot if required runtime env is missing.
+import "@/lib/env";
+
 import * as Sentry from "@sentry/nextjs";
 
-const SENTRY_DSN = process.env.SENTRY_DSN;
+import { readEnv } from "@/lib/runtime-env";
+
+const sentryDsn = readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN");
 
 export async function register() {
   // Skip Sentry initialization if DSN is not configured
-  if (!SENTRY_DSN) {
+  if (!sentryDsn) {
     return;
   }
 
@@ -35,6 +40,6 @@ export async function register() {
 }
 
 // Only capture request errors if Sentry is configured
-export const onRequestError = SENTRY_DSN
+export const onRequestError = sentryDsn
   ? Sentry.captureRequestError
   : undefined;
diff --git a/ui/lib/action-errors.test.ts b/ui/lib/action-errors.test.ts
new file mode 100644
index 0000000000..5731d90a4c
--- /dev/null
+++ b/ui/lib/action-errors.test.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  ACTION_ERROR_MESSAGES,
+  ACTION_ERROR_STATUS,
+  getActionErrorMessage,
+} from "./action-errors";
+
+describe("getActionErrorMessage", () => {
+  it("should use the default permission error for forbidden responses", () => {
+    // Given
+    const result = {
+      error: "You do not have permission to perform this action.",
+      status: ACTION_ERROR_STATUS.FORBIDDEN,
+    };
+
+    // When
+    const message = getActionErrorMessage(result);
+
+    // Then
+    expect(message).toBe(ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.FORBIDDEN]);
+  });
+
+  it("should use the default subscription error for payment-required responses", () => {
+    // Given
+    const result = {
+      error: "Payment required.",
+      status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED,
+    };
+
+    // When
+    const message = getActionErrorMessage(result);
+
+    // Then
+    expect(message).toBe(
+      ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+    );
+  });
+
+  it("should use a feature override for handled statuses", () => {
+    // Given
+    const result = {
+      error: "You do not have permission to perform this action.",
+      status: ACTION_ERROR_STATUS.FORBIDDEN,
+    };
+    const override = "You don't have permission to manage alerts.";
+
+    // When
+    const message = getActionErrorMessage(result, {
+      messages: {
+        [ACTION_ERROR_STATUS.FORBIDDEN]: override,
+      },
+    });
+
+    // Then
+    expect(message).toBe(override);
+  });
+
+  it("should keep the API error for unhandled statuses", () => {
+    // Given
+    const result = {
+      error: "Apply at least one alert-compatible Findings filter.",
+      status: 400,
+    };
+
+    // When
+    const message = getActionErrorMessage(result);
+
+    // Then
+    expect(message).toBe(result.error);
+  });
+});
diff --git a/ui/lib/action-errors.ts b/ui/lib/action-errors.ts
new file mode 100644
index 0000000000..74ae4803fa
--- /dev/null
+++ b/ui/lib/action-errors.ts
@@ -0,0 +1,43 @@
+export const ACTION_ERROR_STATUS = {
+  PAYMENT_REQUIRED: 402,
+  FORBIDDEN: 403,
+} as const;
+
+export type ActionErrorStatus =
+  (typeof ACTION_ERROR_STATUS)[keyof typeof ACTION_ERROR_STATUS];
+
+export const ACTION_ERROR_MESSAGES = {
+  [ACTION_ERROR_STATUS.PAYMENT_REQUIRED]:
+    "Your subscription doesn't allow this action. Upgrade your plan or contact an administrator.",
+  [ACTION_ERROR_STATUS.FORBIDDEN]:
+    "You don't have permission to perform this action. Ask an administrator to update your role.",
+} as const satisfies Record<ActionErrorStatus, string>;
+
+interface ActionErrorResult {
+  error?: string;
+  status?: number;
+}
+
+interface GetActionErrorMessageOptions {
+  messages?: Partial<Record<ActionErrorStatus, string>>;
+  fallback?: string;
+}
+
+const isActionErrorStatus = (
+  status: number | undefined,
+): status is ActionErrorStatus =>
+  status === ACTION_ERROR_STATUS.PAYMENT_REQUIRED ||
+  status === ACTION_ERROR_STATUS.FORBIDDEN;
+
+export const getActionErrorMessage = (
+  result: ActionErrorResult,
+  options: GetActionErrorMessageOptions = {},
+): string => {
+  if (isActionErrorStatus(result.status)) {
+    return (
+      options.messages?.[result.status] ?? ACTION_ERROR_MESSAGES[result.status]
+    );
+  }
+
+  return result.error ?? options.fallback ?? "Oops! Something went wrong.";
+};
diff --git a/ui/lib/compliance/ccc.tsx b/ui/lib/compliance/ccc.tsx
index fc6f7e898a..59df6a7c09 100644
--- a/ui/lib/compliance/ccc.tsx
+++ b/ui/lib/compliance/ccc.tsx
@@ -1,6 +1,7 @@
 import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
 import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
 import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import { ComplianceBadgeVariant } from "@/components/compliance/compliance-custom-details/shared-components";
 import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
 import { FindingStatus } from "@/components/ui/table/status-finding-badge";
 import {
@@ -39,7 +40,7 @@ export interface CCCTextSection {
 export interface CCCMappingSection {
   title: string;
   key: keyof Requirement;
-  colorClasses: string;
+  variant: ComplianceBadgeVariant;
 }
 
 export const CCC_TEXT_SECTIONS: CCCTextSection[] = [
@@ -71,14 +72,12 @@ export const CCC_MAPPING_SECTIONS: CCCMappingSection[] = [
   {
     title: "Threat Mappings",
     key: "section_threat_mappings",
-    colorClasses:
-      "bg-red-50 text-red-700 ring-red-600/10 dark:bg-red-400/10 dark:text-red-400 dark:ring-red-400/20",
+    variant: "error",
   },
   {
     title: "Guideline Mappings",
     key: "section_guideline_mappings",
-    colorClasses:
-      "bg-blue-50 text-blue-700 ring-blue-600/10 dark:bg-blue-400/10 dark:text-blue-400 dark:ring-blue-400/20",
+    variant: "info",
   },
 ];
 
diff --git a/ui/lib/compliance/compliance-detail-url.test.ts b/ui/lib/compliance/compliance-detail-url.test.ts
new file mode 100644
index 0000000000..423f0138f9
--- /dev/null
+++ b/ui/lib/compliance/compliance-detail-url.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+
+import { buildComplianceDetailPath } from "./compliance-detail-url";
+
+describe("buildComplianceDetailPath", () => {
+  it("builds the detail path with the encoded title and required params", () => {
+    const path = buildComplianceDetailPath({
+      title: "CIS 2.0 (AWS)",
+      complianceId: "cis_2.0_aws",
+      version: "2.0",
+      scanId: "scan-123",
+    });
+
+    expect(path).toBe(
+      "/compliance/CIS%202.0%20(AWS)?complianceId=cis_2.0_aws&version=2.0&scanId=scan-123",
+    );
+  });
+
+  it("propagates the region filter only when present", () => {
+    const withRegion = buildComplianceDetailPath({
+      title: "ens",
+      complianceId: "ens_rd2022_aws",
+      version: "RD2022",
+      scanId: "scan-1",
+      regionFilter: "eu-west-1",
+    });
+    const withoutRegion = buildComplianceDetailPath({
+      title: "ens",
+      complianceId: "ens_rd2022_aws",
+      version: "RD2022",
+      scanId: "scan-1",
+      regionFilter: null,
+    });
+
+    expect(withRegion).toContain("filter%5Bregion__in%5D=eu-west-1");
+    expect(withoutRegion).not.toContain("region__in");
+  });
+});
diff --git a/ui/lib/compliance/compliance-detail-url.ts b/ui/lib/compliance/compliance-detail-url.ts
new file mode 100644
index 0000000000..945426cb11
--- /dev/null
+++ b/ui/lib/compliance/compliance-detail-url.ts
@@ -0,0 +1,26 @@
+interface ComplianceDetailPathParams {
+  /** Framework title as shown on the card (URL-encoded into the path). */
+  title: string;
+  complianceId: string;
+  version: string;
+  scanId: string;
+  regionFilter?: string | null;
+}
+
+/** Builds the `/compliance/[compliancetitle]` detail URL used by the overview cards. */
+export function buildComplianceDetailPath({
+  title,
+  complianceId,
+  version,
+  scanId,
+  regionFilter,
+}: ComplianceDetailPathParams): string {
+  const params = new URLSearchParams();
+  params.set("complianceId", complianceId);
+  params.set("version", version);
+  params.set("scanId", scanId);
+  if (regionFilter) {
+    params.set("filter[region__in]", regionFilter);
+  }
+  return `/compliance/${encodeURIComponent(title)}?${params.toString()}`;
+}
diff --git a/ui/lib/compliance/compliance-mapper.test.ts b/ui/lib/compliance/compliance-mapper.test.ts
index 9526b50b07..25933b8dff 100644
--- a/ui/lib/compliance/compliance-mapper.test.ts
+++ b/ui/lib/compliance/compliance-mapper.test.ts
@@ -62,6 +62,10 @@ vi.mock(
   "@/components/compliance/compliance-custom-details/mitre-details",
   () => ({ MITRECustomDetails: stubFactory("MITREStub") }),
 );
+vi.mock(
+  "@/components/compliance/compliance-custom-details/okta-idaas-stig-details",
+  () => ({ OktaIDaaSStigCustomDetails: stubFactory("OktaIDaaSStigStub") }),
+);
 vi.mock(
   "@/components/compliance/compliance-custom-details/threat-details",
   () => ({ ThreatCustomDetails: stubFactory("ThreatStub") }),
@@ -144,6 +148,7 @@ describe("getComplianceMapper", () => {
       { framework: "ProwlerThreatScore", expected: "ThreatStub" },
       { framework: "CCC", expected: "CCCStub" },
       { framework: "CSA-CCM", expected: "CSAStub" },
+      { framework: "Okta-IDaaS-STIG", expected: "OktaIDaaSStigStub" },
     ];
 
     for (const { framework, expected } of wiring) {
@@ -188,6 +193,7 @@ describe("getComplianceMapper", () => {
       "ProwlerThreatScore",
       "CCC",
       "CSA-CCM",
+      "Okta-IDaaS-STIG",
     ]) {
       const mapper = getComplianceMapper(framework);
       expect(Object.keys(mapper).sort(), framework).toEqual(expectedKeys);
diff --git a/ui/lib/compliance/compliance-mapper.ts b/ui/lib/compliance/compliance-mapper.ts
index c42c548695..bc0995ad87 100644
--- a/ui/lib/compliance/compliance-mapper.ts
+++ b/ui/lib/compliance/compliance-mapper.ts
@@ -6,11 +6,13 @@ import { C5CustomDetails } from "@/components/compliance/compliance-custom-detai
 import { CCCCustomDetails } from "@/components/compliance/compliance-custom-details/ccc-details";
 import { CISCustomDetails } from "@/components/compliance/compliance-custom-details/cis-details";
 import { CSACustomDetails } from "@/components/compliance/compliance-custom-details/csa-details";
+import { DORACustomDetails } from "@/components/compliance/compliance-custom-details/dora-details";
 import { ENSCustomDetails } from "@/components/compliance/compliance-custom-details/ens-details";
 import { GenericCustomDetails } from "@/components/compliance/compliance-custom-details/generic-details";
 import { ISOCustomDetails } from "@/components/compliance/compliance-custom-details/iso-details";
 import { KISACustomDetails } from "@/components/compliance/compliance-custom-details/kisa-details";
 import { MITRECustomDetails } from "@/components/compliance/compliance-custom-details/mitre-details";
+import { OktaIDaaSStigCustomDetails } from "@/components/compliance/compliance-custom-details/okta-idaas-stig-details";
 import { ThreatCustomDetails } from "@/components/compliance/compliance-custom-details/threat-details";
 import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
 import {
@@ -47,6 +49,10 @@ import {
   mapComplianceData as mapCSAComplianceData,
   toAccordionItems as toCSAAccordionItems,
 } from "./csa";
+import {
+  mapComplianceData as mapDORAComplianceData,
+  toAccordionItems as toDORAAccordionItems,
+} from "./dora";
 import {
   mapComplianceData as mapENSComplianceData,
   toAccordionItems as toENSAccordionItems,
@@ -69,6 +75,10 @@ import {
   mapComplianceData as mapMITREComplianceData,
   toAccordionItems as toMITREAccordionItems,
 } from "./mitre";
+import {
+  mapComplianceData as mapOktaIDaaSStigComplianceData,
+  toAccordionItems as toOktaIDaaSStigAccordionItems,
+} from "./okta-idaas-stig";
 import {
   getTopFailedSections as getThreatScoreTopFailedSections,
   mapComplianceData as mapThetaComplianceData,
@@ -208,6 +218,28 @@ const getComplianceMappers = (): Record<string, ComplianceMapper> => ({
     getDetailsComponent: (requirement: Requirement) =>
       createElement(CSACustomDetails, { requirement }),
   },
+  "Okta-IDaaS-STIG": {
+    mapComplianceData: mapOktaIDaaSStigComplianceData,
+    toAccordionItems: toOktaIDaaSStigAccordionItems,
+    getTopFailedSections,
+    calculateCategoryHeatmapData: (data: Framework[]) =>
+      calculateCategoryHeatmapData(data),
+    getDetailsComponent: (requirement: Requirement) =>
+      createElement(OktaIDaaSStigCustomDetails, { requirement }),
+  },
+  // DORA (Regulation (EU) 2022/2554) — universal framework keyed by the
+  // `framework` field of `prowler/compliance/dora_2022_2554.json` ("DORA"). Groups by
+  // Pillar (5 enum values) and surfaces Pillar / Article / ArticleTitle in
+  // the requirement detail drawer.
+  DORA: {
+    mapComplianceData: mapDORAComplianceData,
+    toAccordionItems: toDORAAccordionItems,
+    getTopFailedSections,
+    calculateCategoryHeatmapData: (data: Framework[]) =>
+      calculateCategoryHeatmapData(data),
+    getDetailsComponent: (requirement: Requirement) =>
+      createElement(DORACustomDetails, { requirement }),
+  },
 });
 
 /**
diff --git a/ui/lib/compliance/compliance-report-types.test.ts b/ui/lib/compliance/compliance-report-types.test.ts
index 2110df41d2..d8d41f08ec 100644
--- a/ui/lib/compliance/compliance-report-types.test.ts
+++ b/ui/lib/compliance/compliance-report-types.test.ts
@@ -4,6 +4,7 @@ import {
   COMPLIANCE_REPORT_TYPES,
   getReportTypeForCompliance,
   getReportTypeForFramework,
+  isOcsfSupported,
   pickLatestCisPerProvider,
 } from "./compliance-report-types";
 
@@ -34,6 +35,24 @@ describe("getReportTypeForFramework", () => {
   });
 });
 
+describe("isOcsfSupported", () => {
+  it("returns true for universal frameworks shipping an OCSF artifact", () => {
+    expect(isOcsfSupported("dora_2022_2554")).toBe(true);
+    expect(isOcsfSupported("csa_ccm_4.0")).toBe(true);
+  });
+
+  it("returns false for legacy/per-provider frameworks without OCSF output", () => {
+    expect(isOcsfSupported("cis_5.0_aws")).toBe(false);
+    expect(isOcsfSupported("ens_rd2022_aws")).toBe(false);
+    expect(isOcsfSupported("nis2_aws")).toBe(false);
+  });
+
+  it("returns false for missing or empty inputs", () => {
+    expect(isOcsfSupported(undefined)).toBe(false);
+    expect(isOcsfSupported("")).toBe(false);
+  });
+});
+
 describe("pickLatestCisPerProvider", () => {
   it("returns an empty set for an empty input", () => {
     const latest = pickLatestCisPerProvider([]);
@@ -95,7 +114,7 @@ describe("pickLatestCisPerProvider", () => {
     const latest = pickLatestCisPerProvider([
       "ens_rd2022_aws",
       "nis2_aws",
-      "csa_ccm_4.0_aws",
+      "csa_ccm_4.0",
       "prowler_threatscore_aws",
       "cis_5.0_aws",
     ]);
diff --git a/ui/lib/compliance/compliance-report-types.ts b/ui/lib/compliance/compliance-report-types.ts
index 947dbfd8bc..f8f23a67e1 100644
--- a/ui/lib/compliance/compliance-report-types.ts
+++ b/ui/lib/compliance/compliance-report-types.ts
@@ -161,6 +161,30 @@ export const pickLatestCisPerProvider = (
   return latest;
 };
 
+/**
+ * Compliance IDs that ship a per-framework OCSF JSON export.
+ *
+ * Only universal compliance frameworks that declare an ``outputs`` block in
+ * their schema (see ``prowler/compliance/<name>.json``) produce a dedicated
+ * OCSF artifact during scan output generation. Today that is DORA and
+ * CSA CCM 4.0. Any other framework only offers CSV (and, for the curated
+ * list above, PDF).
+ *
+ * Keep this Set in lock-step with the backend: ``get_prowler_provider_compliance``
+ * + ``ComplianceFramework.outputs`` is the source of truth. The API will
+ * 404 on ``GET /scans/{id}/compliance/{name}/ocsf`` for any framework not
+ * in this set, so showing the OCSF button for an unsupported framework
+ * would surface a broken download — gate every call site through
+ * ``isOcsfSupported``.
+ */
+const OCSF_SUPPORTED_COMPLIANCE_IDS: ReadonlySet<string> = new Set([
+  "dora_2022_2554",
+  "csa_ccm_4.0",
+]);
+
+export const isOcsfSupported = (complianceId: string | undefined): boolean =>
+  !!complianceId && OCSF_SUPPORTED_COMPLIANCE_IDS.has(complianceId);
+
 /**
  * Resolve the report type for a compliance card.
  *
diff --git a/ui/lib/compliance/csa.tsx b/ui/lib/compliance/csa.tsx
index 93974d6b47..c4624baa43 100644
--- a/ui/lib/compliance/csa.tsx
+++ b/ui/lib/compliance/csa.tsx
@@ -1,6 +1,7 @@
 import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
 import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
 import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import { ComplianceBadgeVariant } from "@/components/compliance/compliance-custom-details/shared-components";
 import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
 import { FindingStatus } from "@/components/ui/table/status-finding-badge";
 import {
@@ -24,15 +25,14 @@ import {
 export interface CSAMappingSection {
   title: string;
   key: keyof Requirement;
-  colorClasses: string;
+  variant: ComplianceBadgeVariant;
 }
 
 export const CSA_MAPPING_SECTIONS: CSAMappingSection[] = [
   {
     title: "Scope Applicability",
     key: "scope_applicability",
-    colorClasses:
-      "bg-blue-50 text-blue-700 ring-blue-600/10 dark:bg-blue-400/10 dark:text-blue-400 dark:ring-blue-400/20",
+    variant: "info",
   },
 ];
 
diff --git a/ui/lib/compliance/dora.tsx b/ui/lib/compliance/dora.tsx
new file mode 100644
index 0000000000..052bb9deb3
--- /dev/null
+++ b/ui/lib/compliance/dora.tsx
@@ -0,0 +1,154 @@
+import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
+import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
+import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
+import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import {
+  AttributesData,
+  DORAAttributesMetadata,
+  Framework,
+  Requirement,
+  REQUIREMENT_STATUS,
+  RequirementsData,
+  RequirementStatus,
+} from "@/types/compliance";
+
+import {
+  calculateFrameworkCounters,
+  createRequirementsMap,
+  findOrCreateCategory,
+  findOrCreateControl,
+  findOrCreateFramework,
+} from "./commons";
+
+// Display order for DORA pillars in the accordion and any grouped chart. The
+// regulation arranges them in this exact order (Articles 5-14, 17-19, 24-25,
+// 28+30, 45) — preserving it here means the UI always renders pillars in the
+// "logical" reading order regardless of how the API returns them.
+export const DORA_PILLAR_ORDER: readonly string[] = [
+  "ICT Risk Management",
+  "ICT-Related Incident Reporting",
+  "Digital Operational Resilience Testing",
+  "ICT Third-Party Risk Management",
+  "Information Sharing",
+];
+
+const getStatusCounters = (status: RequirementStatus) => ({
+  pass: status === REQUIREMENT_STATUS.PASS ? 1 : 0,
+  fail: status === REQUIREMENT_STATUS.FAIL ? 1 : 0,
+  manual: status === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
+});
+
+export const mapComplianceData = (
+  attributesData: AttributesData,
+  requirementsData: RequirementsData,
+): Framework[] => {
+  const attributes = attributesData?.data || [];
+  const requirementsMap = createRequirementsMap(requirementsData);
+  const frameworks: Framework[] = [];
+
+  for (const attributeItem of attributes) {
+    const id = attributeItem.id;
+    const metadataArray = attributeItem.attributes?.attributes
+      ?.metadata as unknown as DORAAttributesMetadata[];
+    const attrs = metadataArray?.[0];
+    if (!attrs) continue;
+
+    const requirementData = requirementsMap.get(id);
+    if (!requirementData) continue;
+
+    const frameworkName = attributeItem.attributes.framework;
+    // Group by Pillar (top-level accordion section). Article + ArticleTitle
+    // live inside the requirement so they show up on the detail drawer.
+    const categoryName = attrs.Pillar;
+    const requirementName = attributeItem.attributes.name || "";
+    const description = attributeItem.attributes.description;
+    const status = requirementData.attributes.status || "";
+    const checks = attributeItem.attributes.attributes.check_ids || [];
+
+    const framework = findOrCreateFramework(frameworks, frameworkName);
+    const category = findOrCreateCategory(framework.categories, categoryName);
+    // Flat 2-level structure: pillar → requirements (no intermediate control).
+    const control = findOrCreateControl(category.controls, categoryName);
+
+    const finalStatus: RequirementStatus = status as RequirementStatus;
+    const requirement: Requirement = {
+      name: requirementName ? `${id} - ${requirementName}` : id,
+      description,
+      status: finalStatus,
+      check_ids: checks,
+      ...getStatusCounters(finalStatus),
+      pillar: attrs.Pillar,
+      article: attrs.Article,
+      article_title: attrs.ArticleTitle,
+    };
+
+    control.requirements.push(requirement);
+  }
+
+  // Sort categories by canonical pillar order so DORA always reads from "ICT
+  // Risk Management" down to "Information Sharing", regardless of map insertion
+  // order driven by the API response.
+  for (const framework of frameworks) {
+    framework.categories.sort((a, b) => {
+      const ia = DORA_PILLAR_ORDER.indexOf(a.name);
+      const ib = DORA_PILLAR_ORDER.indexOf(b.name);
+      // Unknown pillars (defensive — shouldn't happen) sink to the bottom.
+      const orderA = ia === -1 ? DORA_PILLAR_ORDER.length : ia;
+      const orderB = ib === -1 ? DORA_PILLAR_ORDER.length : ib;
+      return orderA - orderB;
+    });
+  }
+
+  calculateFrameworkCounters(frameworks);
+
+  return frameworks;
+};
+
+export const toAccordionItems = (
+  data: Framework[],
+  scanId: string | undefined,
+): AccordionItemProps[] => {
+  const safeId = scanId || "";
+
+  return data.flatMap((framework) =>
+    framework.categories.map((category) => ({
+      key: `${framework.name}-${category.name}`,
+      title: (
+        <ComplianceAccordionTitle
+          label={category.name}
+          pass={category.pass}
+          fail={category.fail}
+          manual={category.manual}
+          isParentLevel={true}
+        />
+      ),
+      content: "",
+      // Pillar → requirements (flat, no intermediate "control" level).
+      items: category.controls.flatMap((control) =>
+        control.requirements.map((requirement, reqIndex) => ({
+          key: `${framework.name}-${category.name}-req-${reqIndex}`,
+          title: (
+            <ComplianceAccordionRequirementTitle
+              type=""
+              name={requirement.name}
+              status={requirement.status as FindingStatus}
+            />
+          ),
+          content: (
+            <ClientAccordionContent
+              key={`content-${framework.name}-${category.name}-req-${reqIndex}`}
+              requirement={requirement}
+              scanId={safeId}
+              framework={framework.name}
+              disableFindings={
+                requirement.check_ids.length === 0 && requirement.manual === 0
+              }
+            />
+          ),
+          items: [],
+        })),
+      ),
+    })),
+  );
+};
diff --git a/ui/lib/compliance/okta-idaas-stig.tsx b/ui/lib/compliance/okta-idaas-stig.tsx
new file mode 100644
index 0000000000..5a00886406
--- /dev/null
+++ b/ui/lib/compliance/okta-idaas-stig.tsx
@@ -0,0 +1,163 @@
+import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
+import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
+import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
+import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import {
+  AttributesData,
+  Control,
+  Framework,
+  isOktaIDaaSStigAttributesMetadata,
+  OktaIDaaSStigRequirement,
+  Requirement,
+  REQUIREMENT_STATUS,
+  RequirementsData,
+  RequirementStatus,
+} from "@/types/compliance";
+
+import {
+  calculateFrameworkCounters,
+  createRequirementsMap,
+  findOrCreateCategory,
+  findOrCreateControl,
+  findOrCreateFramework,
+} from "./commons";
+
+const getStatusCounters = (status: RequirementStatus) => ({
+  pass: status === REQUIREMENT_STATUS.PASS ? 1 : 0,
+  fail: status === REQUIREMENT_STATUS.FAIL ? 1 : 0,
+  manual: status === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
+});
+
+export const mapComplianceData = (
+  attributesData: AttributesData,
+  requirementsData: RequirementsData,
+): Framework[] => {
+  const attributes = attributesData?.data || [];
+  const requirementsMap = createRequirementsMap(requirementsData);
+  const frameworks: Framework[] = [];
+
+  for (const attributeItem of attributes) {
+    const id = attributeItem.id;
+    const metadataArray = attributeItem.attributes?.attributes?.metadata;
+    const attrs = metadataArray?.[0];
+    if (!isOktaIDaaSStigAttributesMetadata(attrs)) continue;
+
+    const requirementData = requirementsMap.get(id);
+    if (!requirementData) continue;
+
+    const frameworkName = attributeItem.attributes.framework;
+    // Level 1: Section maps to the STIG severity category (e.g. "CAT II (Medium)")
+    const categoryName = attrs.Section;
+    // Level 2: each requirement is its own control, labelled by its STIG ID
+    const controlLabel = id;
+    const description = attributeItem.attributes.description;
+    // Human-readable STIG title (e.g. "Okta must log out a session after a
+    // 15-minute period of inactivity."). Surface it next to the STIG ID and
+    // fall back to the bare ID when missing, mirroring DORA/CSA.
+    const requirementName = attributeItem.attributes.name || "";
+    const status = requirementData.attributes.status || "";
+    const checks = attributeItem.attributes.attributes.check_ids || [];
+
+    const framework = findOrCreateFramework(frameworks, frameworkName);
+    const category = findOrCreateCategory(framework.categories, categoryName);
+    const control = findOrCreateControl(category.controls, controlLabel);
+
+    const finalStatus: RequirementStatus = status as RequirementStatus;
+    const requirement = {
+      name: requirementName ? `${id} - ${requirementName}` : id,
+      description,
+      status: finalStatus,
+      check_ids: checks,
+      ...getStatusCounters(finalStatus),
+      severity: attrs.Severity,
+      rule_id: attrs.RuleID,
+      stig_id: attrs.StigID,
+      cci: attrs.CCI,
+      check_text: attrs.CheckText,
+      fix_text: attrs.FixText,
+    } satisfies OktaIDaaSStigRequirement;
+
+    control.requirements.push(requirement);
+  }
+
+  calculateFrameworkCounters(frameworks);
+
+  return frameworks;
+};
+
+const createRequirementItem = (
+  requirement: Requirement,
+  frameworkName: string,
+  categoryName: string,
+  controlIndex: number,
+  scanId: string,
+): AccordionItemProps => ({
+  key: `${frameworkName}-${categoryName}-control-${controlIndex}`,
+  title: (
+    <ComplianceAccordionRequirementTitle
+      type=""
+      name={requirement.name}
+      status={requirement.status as FindingStatus}
+    />
+  ),
+  content: (
+    <ClientAccordionContent
+      key={`content-${frameworkName}-${categoryName}-control-${controlIndex}`}
+      requirement={requirement}
+      scanId={scanId}
+      framework={frameworkName}
+      disableFindings={
+        requirement.check_ids.length === 0 && requirement.manual === 0
+      }
+    />
+  ),
+  items: [],
+});
+
+const createControlItem = (
+  control: Control,
+  frameworkName: string,
+  categoryName: string,
+  controlIndex: number,
+  scanId: string,
+): AccordionItemProps =>
+  createRequirementItem(
+    control.requirements[0],
+    frameworkName,
+    categoryName,
+    controlIndex,
+    scanId,
+  );
+
+export const toAccordionItems = (
+  data: Framework[],
+  scanId: string | undefined,
+): AccordionItemProps[] => {
+  const safeId = scanId || "";
+
+  return data.flatMap((framework) =>
+    framework.categories.map((category) => ({
+      key: `${framework.name}-${category.name}`,
+      title: (
+        <ComplianceAccordionTitle
+          label={category.name}
+          pass={category.pass}
+          fail={category.fail}
+          manual={category.manual}
+          isParentLevel={true}
+        />
+      ),
+      content: "",
+      items: category.controls.map((control, controlIndex) =>
+        createControlItem(
+          control,
+          framework.name,
+          category.name,
+          controlIndex,
+          safeId,
+        ),
+      ),
+    })),
+  );
+};
diff --git a/ui/lib/date-utils.ts b/ui/lib/date-utils.ts
index 7bce896580..894ff9a513 100644
--- a/ui/lib/date-utils.ts
+++ b/ui/lib/date-utils.ts
@@ -22,6 +22,41 @@ export function toLocalDateString(
   }
 }
 
+/** Local date in the app's table format (e.g. "Jun 15, 2026"), as shown by DateWithTime. */
+export function formatLocalDate(
+  value: string | null | undefined,
+): string | undefined {
+  if (!value) return undefined;
+  try {
+    const date = parseISO(value);
+    if (isNaN(date.getTime())) return undefined;
+    return format(date, "MMM dd, yyyy");
+  } catch {
+    return undefined;
+  }
+}
+
+/** Local time with the browser's short zone label (e.g. "12:00AM MAD"), as shown by DateWithTime. */
+export function formatLocalTimeWithZone(
+  value: string | null | undefined,
+): string | undefined {
+  if (!value) return undefined;
+  try {
+    const date = parseISO(value);
+    if (isNaN(date.getTime())) return undefined;
+    const zone =
+      Intl.DateTimeFormat()
+        .resolvedOptions()
+        .timeZone.split("/")
+        .pop()
+        ?.substring(0, 3)
+        .toUpperCase() || "";
+    return `${format(date, "h:mma")} ${zone}`.trim();
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Formats a duration in seconds to a human-readable string like "2h 5m 30s".
  */
diff --git a/ui/lib/env.test.ts b/ui/lib/env.test.ts
new file mode 100644
index 0000000000..5824bbeab0
--- /dev/null
+++ b/ui/lib/env.test.ts
@@ -0,0 +1,46 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+describe("lib/env boot assertion", () => {
+  beforeEach(() => {
+    // Re-evaluate the module per case so its top-level assertion re-runs.
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("throws a clear error when a required env var is missing", async () => {
+    // Given - UI_API_BASE_URL and its legacy empty, the others present
+    vi.stubEnv("UI_API_BASE_URL", "");
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "");
+    vi.stubEnv("AUTH_URL", "http://localhost:3000");
+    vi.stubEnv("AUTH_SECRET", "secret");
+
+    // When / Then
+    await expect(import("@/lib/env")).rejects.toThrow(
+      "Missing required env: UI_API_BASE_URL",
+    );
+  });
+
+  it("does not throw when every required env var is present", async () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "https://api.example.com/api/v1");
+    vi.stubEnv("AUTH_URL", "http://localhost:3000");
+    vi.stubEnv("AUTH_SECRET", "secret");
+
+    // When / Then
+    await expect(import("@/lib/env")).resolves.toBeDefined();
+  });
+
+  it("accepts the deprecated NEXT_PUBLIC_API_BASE_URL as a fallback", async () => {
+    // Given - the new name is unset but the legacy name is configured
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://api.example.com/api/v1");
+    vi.stubEnv("AUTH_URL", "http://localhost:3000");
+    vi.stubEnv("AUTH_SECRET", "secret");
+
+    // When / Then
+    await expect(import("@/lib/env")).resolves.toBeDefined();
+  });
+});
diff --git a/ui/lib/env.ts b/ui/lib/env.ts
new file mode 100644
index 0000000000..33057e60d4
--- /dev/null
+++ b/ui/lib/env.ts
@@ -0,0 +1,21 @@
+import { readEnv } from "@/lib/runtime-env";
+
+// Boot-time required-env assertion so a misconfigured container fails fast
+// with a clear message. A key with a deprecated legacy name is satisfied by
+// either name (see readEnv).
+const REQUIRED: ReadonlyArray<{
+  key: keyof NodeJS.ProcessEnv;
+  legacy?: keyof NodeJS.ProcessEnv;
+}> = [
+  { key: "UI_API_BASE_URL", legacy: "NEXT_PUBLIC_API_BASE_URL" },
+  { key: "AUTH_URL" },
+  { key: "AUTH_SECRET" },
+];
+
+for (const { key, legacy } of REQUIRED) {
+  if (!readEnv(key, legacy)) {
+    throw new Error(`Missing required env: ${key}`);
+  }
+}
+
+export {};
diff --git a/ui/lib/get-runtime-config.client.test.ts b/ui/lib/get-runtime-config.client.test.ts
new file mode 100644
index 0000000000..553c3be421
--- /dev/null
+++ b/ui/lib/get-runtime-config.client.test.ts
@@ -0,0 +1,115 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { RUNTIME_CONFIG_SCRIPT_ID } from "./runtime-config.shared";
+
+const writeIsland = (content: string) => {
+  const el = document.createElement("script");
+  el.id = RUNTIME_CONFIG_SCRIPT_ID;
+  el.type = "application/json";
+  // textContent (not innerHTML) mirrors how the browser parses an
+  // application/json island: the escaped < sequences are already decoded.
+  el.textContent = content;
+  document.head.appendChild(el);
+};
+
+describe("getRuntimeConfigClient", () => {
+  beforeEach(() => {
+    // Reset modules so each dynamic import re-evaluates the file and its
+    // module-level memoization cache starts empty.
+    vi.resetModules();
+    document.head.innerHTML = "";
+  });
+
+  afterEach(() => {
+    document.head.innerHTML = "";
+  });
+
+  it("parses the data island when present", async () => {
+    // Given
+    writeIsland(
+      JSON.stringify({
+        sentryDsn: "https://key@o0.ingest.sentry.io/1",
+        apiBaseUrl: "https://api.example.com/api/v1",
+      }),
+    );
+    const { getRuntimeConfigClient } = await import(
+      "./get-runtime-config.client"
+    );
+
+    // When
+    const config = getRuntimeConfigClient();
+
+    // Then
+    expect(config.sentryDsn).toBe("https://key@o0.ingest.sentry.io/1");
+    expect(config.apiBaseUrl).toBe("https://api.example.com/api/v1");
+    // Keys not present in the island fall back to null.
+    expect(config.googleTagManagerId).toBeNull();
+    expect(config.posthogKey).toBeNull();
+  });
+
+  it("falls back to an all-null config when the island is absent", async () => {
+    // Given no island in the document
+    const { getRuntimeConfigClient } = await import(
+      "./get-runtime-config.client"
+    );
+
+    // When
+    const config = getRuntimeConfigClient();
+
+    // Then
+    expect(config.sentryDsn).toBeNull();
+    expect(config.apiBaseUrl).toBeNull();
+    expect(config.reoDevClientId).toBeNull();
+  });
+
+  it("falls back to an all-null config when the island is malformed JSON", async () => {
+    // Given
+    writeIsland("{ not valid json");
+    const { getRuntimeConfigClient } = await import(
+      "./get-runtime-config.client"
+    );
+
+    // When
+    const config = getRuntimeConfigClient();
+
+    // Then
+    expect(config.sentryDsn).toBeNull();
+    expect(config.apiBaseUrl).toBeNull();
+  });
+
+  it("exposes only the allowlisted keys and ignores anything extra", async () => {
+    // Given an island carrying an unexpected key and a __proto__ payload
+    writeIsland(
+      JSON.stringify({
+        apiBaseUrl: "https://api.example.com/api/v1",
+        notAllowlisted: "should-not-survive",
+        __proto__: { polluted: true },
+      }),
+    );
+    const { getRuntimeConfigClient } = await import(
+      "./get-runtime-config.client"
+    );
+
+    // When
+    const config = getRuntimeConfigClient();
+
+    // Then - exactly the eight allowlisted keys, nothing else
+    expect(Object.keys(config).sort()).toEqual(
+      [
+        "apiBaseUrl",
+        "apiDocsUrl",
+        "googleTagManagerId",
+        "posthogHost",
+        "posthogKey",
+        "reoDevClientId",
+        "sentryDsn",
+        "sentryEnvironment",
+      ].sort(),
+    );
+    expect(config.apiBaseUrl).toBe("https://api.example.com/api/v1");
+    expect(
+      (config as unknown as Record<string, unknown>).notAllowlisted,
+    ).toBeUndefined();
+    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
+  });
+});
diff --git a/ui/lib/get-runtime-config.client.ts b/ui/lib/get-runtime-config.client.ts
new file mode 100644
index 0000000000..c27378d6f9
--- /dev/null
+++ b/ui/lib/get-runtime-config.client.ts
@@ -0,0 +1,43 @@
+"use client";
+
+import {
+  EMPTY_RUNTIME_PUBLIC_CONFIG,
+  RUNTIME_CONFIG_SCRIPT_ID,
+  type RuntimePublicConfig,
+} from "@/lib/runtime-config.shared";
+
+let cached: RuntimePublicConfig | null = null;
+
+// Explicit per-key copy (not a spread) so unexpected island keys can't leak through.
+const pickConfig = (
+  parsed: Partial<RuntimePublicConfig>,
+): RuntimePublicConfig => ({
+  sentryDsn: parsed.sentryDsn ?? null,
+  sentryEnvironment: parsed.sentryEnvironment ?? null,
+  googleTagManagerId: parsed.googleTagManagerId ?? null,
+  apiBaseUrl: parsed.apiBaseUrl ?? null,
+  apiDocsUrl: parsed.apiDocsUrl ?? null,
+  posthogKey: parsed.posthogKey ?? null,
+  posthogHost: parsed.posthogHost ?? null,
+  reoDevClientId: parsed.reoDevClientId ?? null,
+});
+
+// Reads the <head> island once (memoized); all-null during SSR or if it's
+// missing/malformed, so callers can treat every integration as disabled.
+export function getRuntimeConfigClient(): RuntimePublicConfig {
+  if (cached) return cached;
+  if (typeof document === "undefined") return EMPTY_RUNTIME_PUBLIC_CONFIG;
+
+  const el = document.getElementById(RUNTIME_CONFIG_SCRIPT_ID);
+  let resolved: RuntimePublicConfig;
+  try {
+    resolved = el?.textContent
+      ? pickConfig(JSON.parse(el.textContent) as Partial<RuntimePublicConfig>)
+      : EMPTY_RUNTIME_PUBLIC_CONFIG;
+  } catch {
+    resolved = EMPTY_RUNTIME_PUBLIC_CONFIG;
+  }
+
+  cached = resolved;
+  return resolved;
+}
diff --git a/ui/lib/helper.test.ts b/ui/lib/helper.test.ts
index bfe3796453..f2de6e9145 100644
--- a/ui/lib/helper.test.ts
+++ b/ui/lib/helper.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-import { downloadScanZip } from "./helper";
+import { downloadScanZip, getErrorMessage } from "./helper";
 
 vi.mock("@/actions/scans", () => ({
   getComplianceCsv: vi.fn(),
@@ -118,3 +118,20 @@ describe("downloadScanZip", () => {
     });
   });
 });
+
+describe("getErrorMessage", () => {
+  it("does not expose HTML gateway pages", () => {
+    // Given
+    const error = new Error(
+      "<html><head><title>502 Bad Gateway</title></head><body><h1>502 Bad Gateway</h1></body></html>",
+    );
+
+    // When
+    const message = getErrorMessage(error);
+
+    // Then
+    expect(message).toBe(
+      "Server is temporarily unavailable. Please try again in a few minutes.",
+    );
+  });
+});
diff --git a/ui/lib/helper.ts b/ui/lib/helper.ts
index d460b9697c..9674ea0d73 100644
--- a/ui/lib/helper.ts
+++ b/ui/lib/helper.ts
@@ -1,5 +1,6 @@
 import {
   getComplianceCsv,
+  getComplianceOcsf,
   getCompliancePdfReport,
   type ScanBinaryResult,
 } from "@/actions/scans";
@@ -10,10 +11,14 @@ import {
   COMPLIANCE_REPORT_DISPLAY_NAMES,
   type ComplianceReportType,
 } from "@/lib/compliance/compliance-report-types";
+import { readEnv } from "@/lib/runtime-env";
 import { AuthSocialProvider, MetaDataProps, PermissionInfo } from "@/types";
 
-export const baseUrl = process.env.AUTH_URL || "http://localhost:3000";
-export const apiBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL;
+export const baseUrl = process.env.AUTH_URL;
+export const apiBaseUrl = readEnv(
+  "UI_API_BASE_URL",
+  "NEXT_PUBLIC_API_BASE_URL",
+);
 
 /**
  * Extracts a form value from a FormData object
@@ -104,6 +109,25 @@ export const getAuthUrl = (provider: AuthSocialProvider) => {
 const REPORT_PREPARATION_ERROR =
   "Unable to prepare the scan report. Please try again in a few minutes.";
 
+export const GENERIC_SERVER_ERROR_MESSAGE =
+  "Server is temporarily unavailable. Please try again in a few minutes.";
+
+const HTML_ERROR_PATTERN =
+  /(?:<!doctype\s+html|<html\b|<\/?(?:head|title|body|center|h1|h2|pre)\b)/i;
+
+export const sanitizeErrorMessage = (
+  message: string,
+  fallback = GENERIC_SERVER_ERROR_MESSAGE,
+): string => {
+  const trimmedMessage = message.trim();
+
+  if (!trimmedMessage) {
+    return fallback;
+  }
+
+  return HTML_ERROR_PATTERN.test(trimmedMessage) ? fallback : trimmedMessage;
+};
+
 const getPreflightErrorMessage = async (response: Response) => {
   const contentType = response.headers.get("content-type")?.toLowerCase() || "";
 
@@ -247,6 +271,32 @@ export const downloadComplianceCsv = async (
   );
 };
 
+/**
+ * Download the per-framework OCSF JSON export.
+ *
+ * Only universal frameworks declaring an ``outputs`` block produce this
+ * artifact (currently DORA and CSA CCM 4.0); callers must gate the call
+ * via ``isOcsfSupported`` to avoid surfacing a broken download on
+ * frameworks the API will 404 on.
+ */
+export const downloadComplianceOcsf = async (
+  scanId: string,
+  complianceId: string,
+  toast: ReturnType<typeof useToast>["toast"],
+): Promise<void> => {
+  toast({
+    title: "Download Started",
+    description: "Preparing the OCSF report. This may take a moment.",
+  });
+  const result = await getComplianceOcsf(scanId, complianceId);
+  await downloadFile(
+    result,
+    "application/json",
+    "The compliance OCSF report has been downloaded successfully.",
+    toast,
+  );
+};
+
 /**
  * Download a compliance PDF report.
  *
@@ -373,11 +423,11 @@ export function decryptKey(passkey: string) {
 
 export const getErrorMessage = (error: unknown): string => {
   if (error instanceof Error) {
-    return error.message;
+    return sanitizeErrorMessage(error.message);
   } else if (error && typeof error === "object" && "message" in error) {
-    return String(error.message);
+    return sanitizeErrorMessage(String(error.message));
   } else if (typeof error === "string") {
-    return error;
+    return sanitizeErrorMessage(error);
   } else {
     return "Oops! Something went wrong.";
   }
diff --git a/ui/lib/menu-list.test.ts b/ui/lib/menu-list.test.ts
index 7b21883d48..b06237a44a 100644
--- a/ui/lib/menu-list.test.ts
+++ b/ui/lib/menu-list.test.ts
@@ -13,11 +13,52 @@ const findSubmenu = (label: string) =>
     .flatMap((menu) => menu.submenus ?? [])
     .find((submenu) => submenu.label === label);
 
+const findApiReference = (options: Parameters<typeof getMenuList>[0]) =>
+  getMenuList(options)
+    .flatMap((group) => group.menus)
+    .flatMap((menu) => menu.submenus ?? [])
+    .find((submenu) => submenu.label === "API reference");
+
 describe("getMenuList", () => {
   afterEach(() => {
     delete process.env.NEXT_PUBLIC_IS_CLOUD_ENV;
   });
 
+  describe("API reference link", () => {
+    it("should use the apiDocsUrl provided by the caller in OSS", () => {
+      // Given / When — the caller resolves the runtime value (hydration-safe)
+      const apiRef = findApiReference({
+        pathname: "/",
+        apiDocsUrl: "https://self-hosted.example/api/v1/docs",
+      });
+
+      // Then
+      expect(apiRef?.href).toBe("https://self-hosted.example/api/v1/docs");
+    });
+
+    it("should default to an empty href when no apiDocsUrl is provided", () => {
+      // Given / When — no island read here, so SSR and client agree
+      const apiRef = findApiReference({ pathname: "/" });
+
+      // Then
+      expect(apiRef?.href).toBe("");
+    });
+
+    it("should use the Cloud docs URL and ignore apiDocsUrl when Cloud is enabled", () => {
+      // Given
+      process.env.NEXT_PUBLIC_IS_CLOUD_ENV = "true";
+
+      // When
+      const apiRef = findApiReference({
+        pathname: "/",
+        apiDocsUrl: "https://ignored.example/docs",
+      });
+
+      // Then
+      expect(apiRef?.href).toBe("https://api.prowler.com/api/v1/docs");
+    });
+  });
+
   it("should show Alerts as disabled Cloud-only in OSS when Cloud is disabled", () => {
     // Given / When
     const alerts = findSubmenu("Alerts");
diff --git a/ui/lib/menu-list.ts b/ui/lib/menu-list.ts
index 03458d6873..56b0e115c2 100644
--- a/ui/lib/menu-list.ts
+++ b/ui/lib/menu-list.ts
@@ -30,9 +30,15 @@ import { GroupProps } from "@/types";
 
 interface MenuListOptions {
   pathname: string;
+  // Passed in (not read here) so the island isn't read during SSR — that would
+  // cause a hydration mismatch. See useRuntimeConfig.
+  apiDocsUrl?: string | null;
 }
 
-export const getMenuList = ({ pathname }: MenuListOptions): GroupProps[] => {
+export const getMenuList = ({
+  pathname,
+  apiDocsUrl = null,
+}: MenuListOptions): GroupProps[] => {
   const isCloudEnv = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
 
   return [
@@ -164,26 +170,30 @@ export const getMenuList = ({ pathname }: MenuListOptions): GroupProps[] => {
               icon: DocIcon,
             },
             {
-              href:
-                process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true"
-                  ? "https://api.prowler.com/api/v1/docs"
-                  : `${process.env.NEXT_PUBLIC_API_DOCS_URL}`,
+              href: isCloudEnv
+                ? "https://api.prowler.com/api/v1/docs"
+                : (apiDocsUrl ?? ""),
               target: "_blank",
               label: "API reference",
               icon: APIdocIcon,
             },
-            {
-              href: "https://customer.support.prowler.com/servicedesk/customer/portal/9/create/102",
-              target: "_blank",
-              label: "Customer Support",
-              icon: MessageCircleQuestion,
-            },
-            {
-              href: "https://github.com/prowler-cloud/prowler/issues",
-              target: "_blank",
-              label: "Community Support",
-              icon: GithubIcon,
-            },
+            ...(isCloudEnv
+              ? [
+                  {
+                    href: "https://customer.support.prowler.com/servicedesk/customer/portal/9/create/102",
+                    target: "_blank",
+                    label: "Support Desk",
+                    icon: MessageCircleQuestion,
+                  },
+                ]
+              : [
+                  {
+                    href: "https://github.com/prowler-cloud/prowler/issues",
+                    target: "_blank",
+                    label: "Community Support",
+                    icon: GithubIcon,
+                  },
+                ]),
           ],
           defaultOpen: false,
         },
diff --git a/ui/lib/onboarding/README.md b/ui/lib/onboarding/README.md
new file mode 100644
index 0000000000..eab352ca2b
--- /dev/null
+++ b/ui/lib/onboarding/README.md
@@ -0,0 +1,74 @@
+# Onboarding system (developer guide)
+
+The onboarding system runs short, anchored driver.js tours and orchestrates a
+cross-route **guided sequence** after a user connects their first provider.
+Everything lives in client state and localStorage — there is **zero backend
+coupling**.
+
+## Building blocks
+
+| Concern                                | File                                                                  |
+| -------------------------------------- | --------------------------------------------------------------------- |
+| Flow registry (single source of truth) | `ui/lib/onboarding/registry.ts`                                       |
+| Flow type (`OnboardingFlow`)           | `ui/lib/onboarding/onboarding-types.ts`                               |
+| Tour definitions (`*.tour.ts`)         | `ui/lib/tours/`                                                       |
+| Driver primitive (`useDriverTour`)     | `ui/lib/tours/use-driver-tour.ts`                                     |
+| Per-route trigger                      | `ui/components/onboarding/onboarding-trigger.tsx`                     |
+| Ephemeral sequence slice               | `ui/store/onboarding-sequence.ts`                                     |
+| Checkpoint watcher + dialog            | `ui/components/onboarding/onboarding-checkpoint-{watcher,dialog}.tsx` |
+| Mandatory new-user gate                | `ui/components/onboarding/onboarding-gate.tsx`                        |
+| Manual replay list                     | `ui/components/ui/user-nav/user-nav.tsx`                              |
+
+## How the guided sequence works
+
+1. The `(prowler)/layout.tsx` derives a tri-state `hasProviders` on every
+   navigation and mounts `<OnboardingCheckpointWatcher />` (sibling to the gate).
+2. When the watcher observes a concrete `false → true` `hasProviders` flip (the
+   user actually connected a provider), it opens the checkpoint dialog **once**.
+   An `undefined → true` (user already had providers) never fires. A localStorage
+   marker (`prowler.onboarding.checkpoint`) prevents re-appearance.
+3. "Continue the tour" calls `startSequence(nextFlowId)` on the ephemeral
+   `useOnboardingSequenceStore` and navigates to that flow's route.
+4. Each route mounts an `<OnboardingTrigger flow={...} />`. The trigger force
+   starts the flow when `slice.currentFlowId === flow.id` (sequence) **or** when
+   the `?onboarding=<id>` param matches (replay). The StrictMode-safe latch /
+   keyed runner / empty-deps force-start is preserved verbatim.
+5. On tour close, `useDriverTour`'s `onClosed(state)` reports the outcome:
+   `completed` → `advance()` (navigate to the next flow), `skipped`/`dismissed`
+   → `stop()` (the sequence ends; closing any tour ends the sequence).
+6. The slice is **ephemeral** (plain Zustand `create`, no `persist`). It carries
+   `currentFlowId` across client navigations but resets on a hard reload, so a
+   mid-sequence refresh never re-fires.
+
+`attack-paths` is special: its page already owns a driver, so its registry entry
+sets `ownsAutoOpen: true`, the trigger does **not** mount a runner for it, and
+the page wires `onClosed` to the slice itself (single-fire).
+
+## Add a new flow (the extensibility contract)
+
+A new flow is **one registry entry + one tour file + its anchors + a trigger
+mount** — no gate, modal, or nav edits.
+
+1. **Tour file** — `ui/lib/tours/<flow-id>.tour.ts` via `defineTour<Target>` and
+   the `assets/tour-template.ts`. Keep it shallow: a centered welcome step plus
+   1–2 anchored steps. `coversFiles` scopes the drift check.
+2. **Anchors** — add `data-tour-id="<flow-id>-<target>"` on the page-specific
+   **client** component for each anchored step (never the shared Navbar).
+   The tour file and its anchors MUST ship in the SAME PR (`tour:check`
+   hard-fails a tour target with no matching anchor).
+3. **Registry entry** — add `{ id, order, title, description, route, tour }` to
+   `onboardingFlows` in `registry.ts`. Ordering is data (`order`).
+4. **Trigger mount** — render `<OnboardingTrigger flow={getFlowById("<id>")!} />`
+   inside the route's client host. Pass `stepHandlers`/`configOverrides` only if
+   the flow needs them (e.g. add-provider opens the wizard).
+
+The avatar "Product tour" submenu and `advance()` both derive from
+`getOrderedFlows()`, so a new flow appears in the replay list and participates in
+the sequence automatically.
+
+## CI gates
+
+- `pnpm run tour:check` (`ui/scripts/check-tour-alignment.mjs`) — every tour
+  `target` must resolve to a real `data-tour-id` anchor within its `coversFiles`.
+- `pnpm exec vitest run --project unit` — pure logic (slice, helpers, registry,
+  tour shapes). The driver primitive short-circuits in `NODE_ENV==="test"`.
diff --git a/ui/lib/onboarding/__tests__/gate-decision.test.ts b/ui/lib/onboarding/__tests__/gate-decision.test.ts
new file mode 100644
index 0000000000..833987be7e
--- /dev/null
+++ b/ui/lib/onboarding/__tests__/gate-decision.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+
+import type { TourCompletionRecord } from "@/lib/tours/tour-types";
+import { TOUR_COMPLETION_STATES } from "@/lib/tours/tour-types";
+
+import { shouldStartOnboarding } from "../gate-decision";
+
+const recordWithState = (
+  state: TourCompletionRecord["state"],
+): TourCompletionRecord => ({
+  tourId: "add-provider",
+  version: 1,
+  state,
+  completedAt: "2026-01-15T12:00:00.000Z",
+});
+
+describe("shouldStartOnboarding", () => {
+  it("returns true for a zero-provider user with no completion record", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: false,
+      completionRecord: null,
+    });
+    expect(result).toBe(true);
+  });
+
+  it("returns false when the user already has providers", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: true,
+      completionRecord: null,
+    });
+    expect(result).toBe(false);
+  });
+
+  it("returns false when a dismissed record exists", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: false,
+      completionRecord: recordWithState(TOUR_COMPLETION_STATES.DISMISSED),
+    });
+    expect(result).toBe(false);
+  });
+
+  it("returns false when a completed record exists", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: false,
+      completionRecord: recordWithState(TOUR_COMPLETION_STATES.COMPLETED),
+    });
+    expect(result).toBe(false);
+  });
+
+  it("returns false when a skipped record exists", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: false,
+      completionRecord: recordWithState(TOUR_COMPLETION_STATES.SKIPPED),
+    });
+    expect(result).toBe(false);
+  });
+
+  it("fails open when hasProviders is undefined", () => {
+    // strict === false check rejects non-false values; don't force onboarding on unknown state
+    const result = shouldStartOnboarding({
+      hasProviders: undefined,
+      completionRecord: null,
+    });
+    expect(result).toBe(false);
+  });
+
+  it("fails open when hasProviders is null", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: null as unknown as boolean,
+      completionRecord: null,
+    });
+    expect(result).toBe(false);
+  });
+});
diff --git a/ui/lib/onboarding/__tests__/registry.test.ts b/ui/lib/onboarding/__tests__/registry.test.ts
new file mode 100644
index 0000000000..cb677a268d
--- /dev/null
+++ b/ui/lib/onboarding/__tests__/registry.test.ts
@@ -0,0 +1,185 @@
+import { describe, expect, it } from "vitest";
+
+import type { TourDefinition } from "@/lib/tours/tour-types";
+
+import * as onboardingPublicApi from "../index";
+import type { OnboardingContext, OnboardingFlow } from "../onboarding-types";
+import { getFlowById, getOrderedFlows, onboardingFlows } from "../registry";
+
+// Registry only reads { id, version } from tours, so a flat stub is sufficient.
+const buildTour = (id: string, version = 1): TourDefinition => ({
+  id,
+  version,
+  coversFiles: [],
+  steps: [],
+});
+
+const buildFlow = (
+  overrides: Partial<OnboardingFlow> = {},
+): OnboardingFlow => ({
+  id: overrides.id ?? "flow",
+  order: overrides.order ?? 1,
+  title: overrides.title ?? "Title",
+  description: overrides.description ?? "Description",
+  route: overrides.route ?? "/route",
+  tour: overrides.tour ?? buildTour(overrides.id ?? "flow"),
+  isComplete: overrides.isComplete,
+  ownsAutoOpen: overrides.ownsAutoOpen,
+});
+
+describe("OnboardingFlow / OnboardingContext types", () => {
+  it("compiles a fully-populated OnboardingFlow against the declared contract", () => {
+    const ctx: OnboardingContext = { hasProviders: false };
+    const flow: OnboardingFlow = {
+      id: "add-provider",
+      order: 1,
+      title: "Add your first provider",
+      description: "Connect a cloud account to start scanning.",
+      route: "/providers",
+      tour: buildTour("add-provider"),
+      isComplete: (c: OnboardingContext) => c.hasProviders,
+    };
+
+    expect(flow.id).toBe("add-provider");
+    expect(flow.order).toBe(1);
+    expect(flow.route).toBe("/providers");
+    expect(flow.isComplete?.(ctx)).toBe(false);
+    expect(flow.isComplete?.({ hasProviders: true })).toBe(true);
+  });
+});
+
+describe("onboardingFlows (production registry)", () => {
+  it("registers the add-provider flow as the first onboarding flow", () => {
+    const addProvider = getFlowById("add-provider", onboardingFlows);
+    expect(addProvider).toBeDefined();
+    expect(addProvider?.order).toBe(1);
+    expect(addProvider?.route).toBe("/providers");
+    expect(addProvider?.tour.id).toBe("add-provider");
+  });
+
+  it("treats add-provider as complete when the context reports providers", () => {
+    const addProvider = getFlowById("add-provider", onboardingFlows);
+    expect(addProvider?.isComplete?.({ hasProviders: true })).toBe(true);
+    expect(addProvider?.isComplete?.({ hasProviders: false })).toBe(false);
+  });
+
+  it("registers the view-first-scan flow at order 2 on the active scans tab", () => {
+    const flow = getFlowById("view-first-scan", onboardingFlows);
+    expect(flow).toBeDefined();
+    expect(flow?.order).toBe(2);
+    expect(flow?.route).toBe("/scans?tab=active");
+    expect(flow?.tour.id).toBe("view-first-scan");
+  });
+
+  it("registers the explore-findings flow at order 3 on the findings route", () => {
+    const flow = getFlowById("explore-findings", onboardingFlows);
+    expect(flow).toBeDefined();
+    expect(flow?.order).toBe(3);
+    expect(flow?.route).toBe("/findings");
+    expect(flow?.tour.id).toBe("explore-findings");
+  });
+
+  it("registers the view-compliance flow at order 4 on the compliance route", () => {
+    const flow = getFlowById("view-compliance", onboardingFlows);
+    expect(flow).toBeDefined();
+    expect(flow?.order).toBe(4);
+    expect(flow?.route).toBe("/compliance");
+    expect(flow?.tour.id).toBe("view-compliance");
+  });
+
+  it("registers the attack-paths flow at order 5 on the attack-paths route", () => {
+    const flow = getFlowById("attack-paths", onboardingFlows);
+    expect(flow).toBeDefined();
+    expect(flow?.order).toBe(5);
+    expect(flow?.route).toBe("/attack-paths");
+    expect(flow?.tour.id).toBe("attack-paths");
+  });
+
+  it("flags attack-paths with ownsAutoOpen so the shared trigger never drives it", () => {
+    // attack-paths page owns its own driver; all other flows must be falsy
+    const attackPaths = getFlowById("attack-paths", onboardingFlows);
+    expect(attackPaths?.ownsAutoOpen).toBe(true);
+    for (const flow of onboardingFlows) {
+      if (flow.id === "attack-paths") continue;
+      expect(flow.ownsAutoOpen).toBeFalsy();
+    }
+  });
+
+  it("sets a data requirement hint on the scan-dependent flows only", () => {
+    const scanDependent = [
+      "explore-findings",
+      "view-compliance",
+      "attack-paths",
+    ];
+    const standalone = ["add-provider", "view-first-scan"];
+    const expectedHint = "Wait for the scan to finish and have findings.";
+
+    for (const id of scanDependent) {
+      const flow = getFlowById(id, onboardingFlows);
+      expect(flow?.dataRequirementHint).toBe(expectedHint);
+    }
+    for (const id of standalone) {
+      const flow = getFlowById(id, onboardingFlows);
+      expect(flow?.dataRequirementHint).toBeUndefined();
+    }
+  });
+
+  it("orders the five sequence flows 1..5 by registry order", () => {
+    const ordered = getOrderedFlows(onboardingFlows);
+    expect(ordered.map((flow) => flow.id)).toEqual([
+      "add-provider",
+      "view-first-scan",
+      "explore-findings",
+      "view-compliance",
+      "attack-paths",
+    ]);
+  });
+});
+
+describe("public api barrel", () => {
+  it("re-exports the registry and gate-decision surface", () => {
+    expect(onboardingPublicApi.getOrderedFlows).toBe(getOrderedFlows);
+    expect(onboardingPublicApi.getFlowById).toBe(getFlowById);
+    expect(onboardingPublicApi.onboardingFlows).toBe(onboardingFlows);
+    expect(typeof onboardingPublicApi.shouldStartOnboarding).toBe("function");
+  });
+});
+
+describe("getOrderedFlows", () => {
+  it("returns an empty array when the registry has no flows", () => {
+    expect(getOrderedFlows([])).toEqual([]);
+  });
+
+  it("sorts ascending by order, stably preserving array position on ties", () => {
+    const second = buildFlow({ id: "second", order: 2 });
+    const first = buildFlow({ id: "first", order: 1 });
+    const secondTie = buildFlow({ id: "second-tie", order: 2 });
+    const flows = [second, first, secondTie];
+
+    // order 1 first, then the two order-2 entries in original sequence
+    expect(getOrderedFlows(flows).map((f) => f.id)).toEqual([
+      "first",
+      "second",
+      "second-tie",
+    ]);
+  });
+});
+
+describe("getFlowById", () => {
+  it("returns the matching flow when the id exists", () => {
+    const addProvider = buildFlow({ id: "add-provider", order: 1 });
+    const flows = [addProvider, buildFlow({ id: "other", order: 2 })];
+    expect(getFlowById("add-provider", flows)).toBe(addProvider);
+  });
+
+  it("returns undefined when the id is unknown", () => {
+    const flows = [buildFlow({ id: "add-provider", order: 1 })];
+    expect(getFlowById("unknown-xyz", flows)).toBeUndefined();
+  });
+});
+
+describe("getFlowById fallback", () => {
+  it("returns undefined for an unknown id against the production registry", () => {
+    expect(getFlowById("does-not-exist", onboardingFlows)).toBeUndefined();
+  });
+});
diff --git a/ui/lib/onboarding/gate-decision.ts b/ui/lib/onboarding/gate-decision.ts
new file mode 100644
index 0000000000..656a3b0cb4
--- /dev/null
+++ b/ui/lib/onboarding/gate-decision.ts
@@ -0,0 +1,17 @@
+import type { TourCompletionRecord } from "@/lib/tours/tour-types";
+
+export interface GateDecisionInput {
+  // `undefined` allowed; strict `=== false` check below fails open on ambiguous signals.
+  hasProviders: boolean | undefined;
+  completionRecord: TourCompletionRecord | null;
+}
+
+// Only forces onboarding when providers are provably absent and no record exists.
+export function shouldStartOnboarding({
+  hasProviders,
+  completionRecord,
+}: GateDecisionInput): boolean {
+  const hasNoRecord =
+    completionRecord === null || completionRecord === undefined;
+  return hasProviders === false && hasNoRecord;
+}
diff --git a/ui/lib/onboarding/index.ts b/ui/lib/onboarding/index.ts
new file mode 100644
index 0000000000..8ba6906ff2
--- /dev/null
+++ b/ui/lib/onboarding/index.ts
@@ -0,0 +1,6 @@
+// Public barrel — import from `@/lib/onboarding`, not individual modules.
+
+export type { GateDecisionInput } from "./gate-decision";
+export { shouldStartOnboarding } from "./gate-decision";
+export type { OnboardingContext, OnboardingFlow } from "./onboarding-types";
+export { getFlowById, getOrderedFlows, onboardingFlows } from "./registry";
diff --git a/ui/lib/onboarding/onboarding-types.ts b/ui/lib/onboarding/onboarding-types.ts
new file mode 100644
index 0000000000..7733120ec3
--- /dev/null
+++ b/ui/lib/onboarding/onboarding-types.ts
@@ -0,0 +1,22 @@
+import type { TourDefinition } from "@/lib/tours/tour-types";
+
+// Single argument passed to every `isComplete(ctx)` predicate.
+export interface OnboardingContext {
+  hasProviders: boolean;
+}
+
+// Completion is persisted via the tour's own id/version — no second source of truth.
+// `order` gaps are allowed; reordering is a data edit.
+export interface OnboardingFlow {
+  id: string;
+  order: number;
+  title: string;
+  description: string;
+  route: string;
+  tour: TourDefinition;
+  isComplete?: (ctx: OnboardingContext) => boolean;
+  // When true, the page owns auto-open; OnboardingTrigger must not mount a second runner.
+  ownsAutoOpen?: boolean;
+  // Shown in the sequence banner when the step needs a completed scan to display data.
+  dataRequirementHint?: string;
+}
diff --git a/ui/lib/onboarding/registry.ts b/ui/lib/onboarding/registry.ts
new file mode 100644
index 0000000000..32a6a12afa
--- /dev/null
+++ b/ui/lib/onboarding/registry.ts
@@ -0,0 +1,80 @@
+import { addProviderTour } from "@/lib/tours/add-provider.tour";
+import { attackPathsTour } from "@/lib/tours/attack-paths.tour";
+import { exploreFindingsTour } from "@/lib/tours/explore-findings.tour";
+import { viewComplianceTour } from "@/lib/tours/view-compliance.tour";
+import { viewFirstScanTour } from "@/lib/tours/view-first-scan.tour";
+
+import type { OnboardingFlow } from "./onboarding-types";
+
+// Shown in the sequence banner when the step needs a completed scan.
+const SCAN_DATA_HINT = "Wait for the scan to finish and have findings.";
+
+// Add a flow: one entry here + a `*.tour.ts` file. No gate/modal/nav edits needed.
+export const onboardingFlows: readonly OnboardingFlow[] = [
+  {
+    id: "add-provider",
+    order: 1,
+    title: "Add your first provider",
+    description:
+      "Connect a provider so Prowler has something to scan and assess.",
+    route: "/providers",
+    tour: addProviderTour,
+    // Server-derived: existing providers bypass this flow regardless of local record.
+    isComplete: (ctx) => ctx.hasProviders,
+  },
+  {
+    id: "view-first-scan",
+    order: 2,
+    title: "Run your first scan",
+    description:
+      "Launch a scan and watch Prowler assess your connected provider.",
+    // Land on the In Progress tab so a running scan is the first thing the tour shows.
+    route: "/scans?tab=active",
+    tour: viewFirstScanTour,
+  },
+  {
+    id: "explore-findings",
+    order: 3,
+    title: "Explore your findings",
+    description: "See what Prowler detected and how to fix it.",
+    route: "/findings",
+    tour: exploreFindingsTour,
+    dataRequirementHint: SCAN_DATA_HINT,
+  },
+  {
+    id: "view-compliance",
+    order: 4,
+    title: "Check compliance",
+    description: "Map your findings to frameworks like CIS.",
+    route: "/compliance",
+    tour: viewComplianceTour,
+    dataRequirementHint: SCAN_DATA_HINT,
+  },
+  {
+    id: "attack-paths",
+    order: 5,
+    title: "Visualize attack paths",
+    description: "See how a compromise could spread across your cloud.",
+    route: "/attack-paths",
+    tour: attackPathsTour,
+    dataRequirementHint: SCAN_DATA_HINT,
+    ownsAutoOpen: true, // page drives this tour; OnboardingTrigger must not mount a second runner
+  },
+];
+
+// Stable sort by `order`; `flows` defaults to the production registry so tests can inject.
+export function getOrderedFlows(
+  flows: readonly OnboardingFlow[] = onboardingFlows,
+): OnboardingFlow[] {
+  return flows
+    .map((flow, index) => ({ flow, index }))
+    .sort((a, b) => a.flow.order - b.flow.order || a.index - b.index)
+    .map(({ flow }) => flow);
+}
+
+export function getFlowById(
+  id: string,
+  flows: readonly OnboardingFlow[] = onboardingFlows,
+): OnboardingFlow | undefined {
+  return flows.find((flow) => flow.id === id);
+}
diff --git a/ui/lib/providers-navigation.ts b/ui/lib/providers-navigation.ts
new file mode 100644
index 0000000000..7428eed540
--- /dev/null
+++ b/ui/lib/providers-navigation.ts
@@ -0,0 +1,3 @@
+export const ADD_PROVIDER_SEARCH_PARAM = "addProvider";
+export const ADD_PROVIDER_SEARCH_VALUE = "true";
+export const ADD_PROVIDER_HREF = `/providers?${ADD_PROVIDER_SEARCH_PARAM}=${ADD_PROVIDER_SEARCH_VALUE}`;
diff --git a/ui/lib/runtime-config.shared.ts b/ui/lib/runtime-config.shared.ts
new file mode 100644
index 0000000000..98a76f8c3a
--- /dev/null
+++ b/ui/lib/runtime-config.shared.ts
@@ -0,0 +1,26 @@
+// Side-effect-free shape shared by the server and client readers (no
+// server-only code, so it's safe to import from the client bundle).
+export interface RuntimePublicConfig {
+  sentryDsn: string | null;
+  sentryEnvironment: string | null;
+  googleTagManagerId: string | null;
+  apiBaseUrl: string | null;
+  apiDocsUrl: string | null;
+  posthogKey: string | null; // reserved
+  posthogHost: string | null; // reserved
+  reoDevClientId: string | null; // reserved
+}
+
+export const RUNTIME_CONFIG_SCRIPT_ID = "__PROWLER_RUNTIME_CONFIG__";
+
+// All-null fallback (SSR or parse failure).
+export const EMPTY_RUNTIME_PUBLIC_CONFIG: RuntimePublicConfig = {
+  sentryDsn: null,
+  sentryEnvironment: null,
+  googleTagManagerId: null,
+  apiBaseUrl: null,
+  apiDocsUrl: null,
+  posthogKey: null,
+  posthogHost: null,
+  reoDevClientId: null,
+};
diff --git a/ui/lib/runtime-config.ts b/ui/lib/runtime-config.ts
new file mode 100644
index 0000000000..c799a6fced
--- /dev/null
+++ b/ui/lib/runtime-config.ts
@@ -0,0 +1,30 @@
+import "server-only";
+
+import { connection } from "next/server";
+
+import type { RuntimePublicConfig } from "@/lib/runtime-config.shared";
+import { readEnv } from "@/lib/runtime-env";
+
+// `connection()` forces a per-request runtime read (never build-snapshotted);
+// only this allowlist reaches the client. Each migrated key falls back to its
+// deprecated NEXT_PUBLIC_* name during migration (see readEnv).
+export async function getRuntimePublicConfig(): Promise<RuntimePublicConfig> {
+  await connection();
+
+  return {
+    sentryDsn: readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN"),
+    sentryEnvironment: readEnv(
+      "UI_SENTRY_ENVIRONMENT",
+      "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+    ),
+    googleTagManagerId: readEnv(
+      "UI_GOOGLE_TAG_MANAGER_ID",
+      "NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID",
+    ),
+    apiBaseUrl: readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL"),
+    apiDocsUrl: readEnv("UI_API_DOCS_URL", "NEXT_PUBLIC_API_DOCS_URL"),
+    posthogKey: readEnv("POSTHOG_KEY"),
+    posthogHost: readEnv("POSTHOG_HOST"),
+    reoDevClientId: readEnv("REO_DEV_CLIENT_ID"),
+  };
+}
diff --git a/ui/lib/runtime-env.test.ts b/ui/lib/runtime-env.test.ts
new file mode 100644
index 0000000000..b353b0ba11
--- /dev/null
+++ b/ui/lib/runtime-env.test.ts
@@ -0,0 +1,75 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { readEnv } from "./runtime-env";
+
+describe("readEnv", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("returns the primary value when it is set", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "https://primary.example.com");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL")).toBe("https://primary.example.com");
+  });
+
+  it("returns null when the primary is unset and no legacy is given", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL")).toBeNull();
+  });
+
+  it("treats an empty or whitespace-only primary as unset", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "   ");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL")).toBeNull();
+  });
+
+  it("falls back to the legacy var when the primary is unset", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL")).toBe(
+      "https://legacy.example.com",
+    );
+  });
+
+  it("falls back to the legacy var when the primary is empty", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "");
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL")).toBe(
+      "https://legacy.example.com",
+    );
+  });
+
+  it("prefers the primary over the legacy when both are set", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "https://primary.example.com");
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL")).toBe(
+      "https://primary.example.com",
+    );
+  });
+
+  it("returns null when neither the primary nor the legacy is set", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", undefined);
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL")).toBeNull();
+  });
+});
diff --git a/ui/lib/runtime-env.ts b/ui/lib/runtime-env.ts
new file mode 100644
index 0000000000..7426a2e357
--- /dev/null
+++ b/ui/lib/runtime-env.ts
@@ -0,0 +1,21 @@
+// Reads a runtime env var, with an optional deprecated-name fallback.
+//
+// Both names are read through a computed key (never a literal `process.env.X`
+// member access) so Next.js/Turbopack does NOT inline them at build time. This
+// is essential for the legacy `NEXT_PUBLIC_*` names: a literal read would be
+// replaced with the build-time snapshot, defeating the runtime fallback. The
+// new `UI_*` names are not `NEXT_PUBLIC_`-prefixed, so they are runtime reads
+// regardless. Empty/whitespace values are treated as unset so a leftover empty
+// `UI_*` still falls through to a configured legacy var.
+const clean = (value?: string): string | null =>
+  value && value.trim() !== "" ? value : null;
+
+export function readEnv(
+  primary: keyof NodeJS.ProcessEnv,
+  legacy?: keyof NodeJS.ProcessEnv,
+): string | null {
+  const env = typeof process === "undefined" ? undefined : process.env;
+  if (!env) return null;
+
+  return clean(env[primary]) ?? (legacy ? clean(env[legacy]) : null);
+}
diff --git a/ui/lib/safe-json.test.ts b/ui/lib/safe-json.test.ts
new file mode 100644
index 0000000000..a1c154813f
--- /dev/null
+++ b/ui/lib/safe-json.test.ts
@@ -0,0 +1,83 @@
+import { describe, expect, it } from "vitest";
+
+import { serializeForScript } from "./safe-json";
+
+const LINE_SEPARATOR = String.fromCharCode(0x2028); // U+2028
+const PARAGRAPH_SEPARATOR = String.fromCharCode(0x2029); // U+2029
+
+describe("serializeForScript", () => {
+  it("neutralizes a </script> breakout so the script tag is not terminated early", () => {
+    // Given
+    const value = { sentryDsn: "</script><script>alert(1)</script>" };
+
+    // When
+    const serialized = serializeForScript(value);
+
+    // Then
+    expect(serialized).not.toContain("</script>");
+    expect(serialized).not.toContain("<");
+    expect(serialized).not.toContain(">");
+  });
+
+  it("neutralizes the HTML comment opener <!--", () => {
+    // Given
+    const value = { sentryDsn: "<!-- not a comment -->" };
+
+    // When
+    const serialized = serializeForScript(value);
+
+    // Then
+    expect(serialized).not.toContain("<!--");
+    expect(serialized).not.toContain("<");
+  });
+
+  it("escapes ampersands", () => {
+    // When
+    const serialized = serializeForScript({ apiBaseUrl: "https://x?a=1&b=2" });
+
+    // Then
+    expect(serialized).not.toContain("&");
+    expect(serialized).toContain("\\u0026");
+  });
+
+  it("escapes U+2028 and U+2029 so output stays safe in an executed-JS context", () => {
+    // Given - JSON.stringify leaves these line terminators raw, which would
+    // break a JS string literal if the island were ever inlined as executed JS.
+    const value = { sentryDsn: `a${LINE_SEPARATOR}b${PARAGRAPH_SEPARATOR}c` };
+
+    // When
+    const serialized = serializeForScript(value);
+
+    // Then
+    expect(serialized).not.toContain(LINE_SEPARATOR);
+    expect(serialized).not.toContain(PARAGRAPH_SEPARATOR);
+    expect(serialized).toContain("\\u2028");
+    expect(serialized).toContain("\\u2029");
+  });
+
+  it("round-trips back to the original value via JSON.parse", () => {
+    // Given
+    const value = {
+      sentryDsn: "</script>",
+      apiBaseUrl: "https://api.example.com?a=1&b=2",
+      googleTagManagerId: null,
+    };
+
+    // When
+    const parsed = JSON.parse(serializeForScript(value));
+
+    // Then
+    expect(parsed).toEqual(value);
+  });
+
+  it("round-trips line terminators back to their original characters", () => {
+    // Given
+    const value = { sentryDsn: `a${LINE_SEPARATOR}b${PARAGRAPH_SEPARATOR}c` };
+
+    // When
+    const parsed = JSON.parse(serializeForScript(value));
+
+    // Then
+    expect(parsed).toEqual(value);
+  });
+});
diff --git a/ui/lib/safe-json.ts b/ui/lib/safe-json.ts
new file mode 100644
index 0000000000..1437de2f50
--- /dev/null
+++ b/ui/lib/safe-json.ts
@@ -0,0 +1,16 @@
+// Escape a value for an inline <script>. Neutralizes < > & to block the
+// </script>/<!-- breakout (the only vector when read as inert JSON), plus the
+// U+2028/U+2029 line terminators that JSON.stringify leaves raw, so the output
+// is also safe if ever inlined into an executed-JS context. JSON.parse decodes
+// all of these back to the original characters.
+const LINE_SEPARATOR = new RegExp(String.fromCharCode(0x2028), "g");
+const PARAGRAPH_SEPARATOR = new RegExp(String.fromCharCode(0x2029), "g");
+
+export function serializeForScript(value: unknown): string {
+  return JSON.stringify(value)
+    .replace(/</g, "\\u003c")
+    .replace(/>/g, "\\u003e")
+    .replace(/&/g, "\\u0026")
+    .replace(LINE_SEPARATOR, "\\u2028")
+    .replace(PARAGRAPH_SEPARATOR, "\\u2029");
+}
diff --git a/ui/lib/schedules.test.ts b/ui/lib/schedules.test.ts
new file mode 100644
index 0000000000..4004de0ee1
--- /dev/null
+++ b/ui/lib/schedules.test.ts
@@ -0,0 +1,490 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+  buildProviderScheduleSummary,
+  buildSchedulesByProviderId,
+  buildScheduleUpdatePayload,
+  formatScheduleHour,
+  getBrowserTimezone,
+  getNextScheduledRun,
+  getScanScheduleCapability,
+  getScheduleFormValues,
+  isScheduleConfigured,
+} from "@/lib/schedules";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  SCHEDULE_FREQUENCY,
+  type ScheduleAttributes,
+  type ScheduleProps,
+} from "@/types/schedules";
+
+describe("schedule payload mapping", () => {
+  beforeEach(() => {
+    vi.spyOn(Intl, "DateTimeFormat").mockReturnValue({
+      resolvedOptions: () => ({ timeZone: "Europe/Madrid" }),
+    } as Intl.DateTimeFormat);
+  });
+
+  it("maps daily schedules and clears unused fields", () => {
+    // Given
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.DAILY,
+      hour: 8,
+      dayOfWeek: 2,
+      dayOfMonth: 12,
+      intervalHours: 48,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload).toEqual({
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+      scan_hour: 8,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: null,
+      scan_day_of_week: null,
+      scan_day_of_month: null,
+    });
+  });
+
+  it("maps every 48 hours schedules as an interval", () => {
+    // Given
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.INTERVAL,
+      hour: 23,
+      dayOfWeek: 0,
+      dayOfMonth: 1,
+      intervalHours: 48,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload).toEqual({
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.INTERVAL,
+      scan_hour: 23,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: 48,
+      scan_day_of_week: null,
+      scan_day_of_month: null,
+    });
+  });
+
+  it("preserves a custom interval instead of rewriting it to 48 hours", () => {
+    // Given a schedule whose interval was set outside the UI (e.g. bulk API)
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.INTERVAL,
+      hour: 5,
+      dayOfWeek: 0,
+      dayOfMonth: 1,
+      intervalHours: 72,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload.scan_interval_hours).toBe(72);
+  });
+
+  it("maps weekly schedules with 0 as Sunday and clears interval/month", () => {
+    // Given
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.WEEKLY,
+      hour: 6,
+      dayOfWeek: 0,
+      dayOfMonth: 28,
+      intervalHours: 48,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload).toEqual({
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.WEEKLY,
+      scan_hour: 6,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: null,
+      scan_day_of_week: 0,
+      scan_day_of_month: null,
+    });
+  });
+
+  it("maps monthly schedules and keeps scan_hour 0 (not falsy-coerced)", () => {
+    // Given
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.MONTHLY,
+      hour: 0,
+      dayOfWeek: 5,
+      dayOfMonth: 28,
+      intervalHours: 48,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload).toEqual({
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.MONTHLY,
+      scan_hour: 0,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: null,
+      scan_day_of_week: null,
+      scan_day_of_month: 28,
+    });
+  });
+});
+
+describe("formatScheduleHour", () => {
+  it.each([
+    [0, "12:00am"],
+    [12, "12:00pm"],
+    [13, "1:00pm"],
+    [23, "11:00pm"],
+    [-1, "11:00pm"],
+    [24, "12:00am"],
+  ])("formats hour %i as %s", (hour, expected) => {
+    expect(formatScheduleHour(hour)).toBe(expected);
+  });
+});
+
+describe("isScheduleConfigured", () => {
+  it("treats a null scan_hour as not configured", () => {
+    expect(isScheduleConfigured({ scan_hour: null })).toBe(false);
+  });
+
+  it("treats scan_hour 0 (midnight) as configured", () => {
+    expect(isScheduleConfigured({ scan_hour: 0 })).toBe(true);
+  });
+
+  it("treats a set scan_hour as configured", () => {
+    expect(isScheduleConfigured({ scan_hour: 14 })).toBe(true);
+  });
+});
+
+describe("getScheduleFormValues", () => {
+  const buildAttributes = (
+    overrides: Partial<ScheduleAttributes> = {},
+  ): ScheduleAttributes => ({
+    scan_enabled: true,
+    scan_frequency: SCHEDULE_FREQUENCY.WEEKLY,
+    scan_hour: 9,
+    scan_timezone: "Europe/Madrid",
+    scan_interval_hours: null,
+    scan_day_of_week: 4,
+    scan_day_of_month: 20,
+    ...overrides,
+  });
+
+  it("returns defaults when there is no schedule", () => {
+    expect(getScheduleFormValues(null)).toEqual({
+      frequency: SCHEDULE_FREQUENCY.DAILY,
+      hour: 0,
+      dayOfWeek: 1,
+      dayOfMonth: 1,
+      intervalHours: 48,
+      launchInitialScan: false,
+    });
+  });
+
+  it("returns defaults when scan_hour is null (unconfigured provider)", () => {
+    expect(getScheduleFormValues(buildAttributes({ scan_hour: null }))).toEqual(
+      {
+        frequency: SCHEDULE_FREQUENCY.DAILY,
+        hour: 0,
+        dayOfWeek: 1,
+        dayOfMonth: 1,
+        intervalHours: 48,
+        launchInitialScan: false,
+      },
+    );
+  });
+
+  it("maps a configured schedule onto the form", () => {
+    expect(getScheduleFormValues(buildAttributes())).toEqual({
+      frequency: SCHEDULE_FREQUENCY.WEEKLY,
+      hour: 9,
+      dayOfWeek: 4,
+      dayOfMonth: 20,
+      intervalHours: 48,
+      launchInitialScan: false,
+    });
+  });
+
+  it("keeps a custom interval from the stored schedule", () => {
+    const values = getScheduleFormValues(
+      buildAttributes({
+        scan_frequency: SCHEDULE_FREQUENCY.INTERVAL,
+        scan_interval_hours: 72,
+        scan_day_of_week: null,
+        scan_day_of_month: null,
+      }),
+    );
+    expect(values.frequency).toBe(SCHEDULE_FREQUENCY.INTERVAL);
+    expect(values.intervalHours).toBe(72);
+  });
+
+  it("falls back to default day fields when the schedule leaves them null", () => {
+    const values = getScheduleFormValues(
+      buildAttributes({ scan_day_of_week: null, scan_day_of_month: null }),
+    );
+    expect(values.dayOfWeek).toBe(1);
+    expect(values.dayOfMonth).toBe(1);
+  });
+});
+
+describe("getNextScheduledRun", () => {
+  const baseValues = {
+    frequency: SCHEDULE_FREQUENCY.DAILY,
+    hour: 14,
+    dayOfWeek: 5,
+    dayOfMonth: 15,
+    intervalHours: 48,
+    launchInitialScan: false,
+  };
+  // Wednesday 2026-06-10 10:30 local.
+  const now = new Date(2026, 5, 10, 10, 30, 0, 0);
+
+  const parts = (date: Date) => ({
+    year: date.getFullYear(),
+    month: date.getMonth(),
+    day: date.getDate(),
+    hour: date.getHours(),
+  });
+
+  it("DAILY: same day when the hour is still ahead", () => {
+    expect(
+      parts(getNextScheduledRun({ ...baseValues, hour: 14 }, now)),
+    ).toEqual({ year: 2026, month: 5, day: 10, hour: 14 });
+  });
+
+  it("DAILY: next day when the hour already passed", () => {
+    expect(parts(getNextScheduledRun({ ...baseValues, hour: 8 }, now))).toEqual(
+      {
+        year: 2026,
+        month: 5,
+        day: 11,
+        hour: 8,
+      },
+    );
+  });
+
+  it("INTERVAL: anchors at the next occurrence of the hour, like DAILY", () => {
+    // The backend derives the INTERVAL anchor as today/tomorrow at scan_hour
+    // and fires the first run there; repeats only start after that.
+    expect(
+      parts(
+        getNextScheduledRun(
+          { ...baseValues, frequency: SCHEDULE_FREQUENCY.INTERVAL, hour: 14 },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 10, hour: 14 });
+
+    expect(
+      parts(
+        getNextScheduledRun(
+          { ...baseValues, frequency: SCHEDULE_FREQUENCY.INTERVAL, hour: 8 },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 11, hour: 8 });
+  });
+
+  it("WEEKLY: advances to the target weekday this week", () => {
+    expect(
+      parts(
+        getNextScheduledRun(
+          {
+            ...baseValues,
+            frequency: SCHEDULE_FREQUENCY.WEEKLY,
+            dayOfWeek: 5,
+            hour: 9,
+          },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 12, hour: 9 });
+  });
+
+  it("WEEKLY: jumps a week when the target day/hour already passed today", () => {
+    expect(
+      parts(
+        getNextScheduledRun(
+          {
+            ...baseValues,
+            frequency: SCHEDULE_FREQUENCY.WEEKLY,
+            dayOfWeek: 3,
+            hour: 8,
+          },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 17, hour: 8 });
+  });
+
+  it("MONTHLY: this month when the day is still ahead", () => {
+    expect(
+      parts(
+        getNextScheduledRun(
+          {
+            ...baseValues,
+            frequency: SCHEDULE_FREQUENCY.MONTHLY,
+            dayOfMonth: 15,
+          },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 15, hour: 14 });
+  });
+
+  it("MONTHLY: next month when the day already passed", () => {
+    expect(
+      parts(
+        getNextScheduledRun(
+          {
+            ...baseValues,
+            frequency: SCHEDULE_FREQUENCY.MONTHLY,
+            dayOfMonth: 5,
+          },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 6, day: 5, hour: 14 });
+  });
+});
+
+describe("browser timezone", () => {
+  it("falls back to UTC when browser timezone is unavailable", () => {
+    // Given
+    vi.spyOn(Intl, "DateTimeFormat").mockReturnValue({
+      resolvedOptions: () => ({}),
+    } as Intl.DateTimeFormat);
+
+    // When / Then
+    expect(getBrowserTimezone()).toBe("UTC");
+  });
+});
+
+describe("scan schedule capability", () => {
+  it("returns DAILY_LEGACY for non-Cloud (OSS)", () => {
+    expect(getScanScheduleCapability(false)).toBe(
+      SCAN_SCHEDULE_CAPABILITY.DAILY_LEGACY,
+    );
+  });
+
+  it("returns ADVANCED for Cloud", () => {
+    expect(getScanScheduleCapability(true)).toBe(
+      SCAN_SCHEDULE_CAPABILITY.ADVANCED,
+    );
+  });
+});
+
+describe("buildSchedulesByProviderId", () => {
+  const buildSchedule = (
+    id: string,
+    overrides: Partial<ScheduleAttributes> = {},
+  ): ScheduleProps => ({
+    type: "schedules",
+    id,
+    attributes: {
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+      scan_hour: 9,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: null,
+      scan_day_of_week: null,
+      scan_day_of_month: null,
+      ...overrides,
+    },
+    relationships: {
+      provider: { data: { type: "providers", id } },
+    },
+  });
+
+  it("indexes schedule attributes by provider id (the schedule's own id)", () => {
+    const result = {
+      data: [
+        buildSchedule("provider-1", { scan_hour: 6 }),
+        buildSchedule("provider-2", { scan_hour: null }),
+      ],
+    };
+
+    expect(buildSchedulesByProviderId(result)).toEqual({
+      "provider-1": result.data[0].attributes,
+      "provider-2": result.data[1].attributes,
+    });
+  });
+
+  it("returns an empty map when the request errored (e.g. OSS without /schedules)", () => {
+    expect(buildSchedulesByProviderId({ error: "Not found" })).toEqual({});
+  });
+
+  it("returns an empty map for a null/undefined result", () => {
+    expect(buildSchedulesByProviderId(null)).toEqual({});
+    expect(buildSchedulesByProviderId(undefined)).toEqual({});
+  });
+});
+
+describe("buildProviderScheduleSummary", () => {
+  const buildAttributes = (
+    overrides: Partial<ScheduleAttributes> = {},
+  ): ScheduleAttributes => ({
+    scan_enabled: true,
+    scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+    scan_hour: 9,
+    scan_timezone: "Europe/Madrid",
+    scan_interval_hours: null,
+    scan_day_of_week: null,
+    scan_day_of_month: null,
+    ...overrides,
+  });
+
+  const now = new Date(2026, 5, 10, 10, 30, 0, 0);
+
+  it.each([
+    [{ scan_frequency: SCHEDULE_FREQUENCY.DAILY }, "Daily"],
+    [
+      { scan_frequency: SCHEDULE_FREQUENCY.WEEKLY, scan_day_of_week: 1 },
+      "Weekly on Monday",
+    ],
+    [
+      { scan_frequency: SCHEDULE_FREQUENCY.MONTHLY, scan_day_of_month: 15 },
+      "Monthly on day 15",
+    ],
+    [
+      { scan_frequency: SCHEDULE_FREQUENCY.INTERVAL, scan_interval_hours: 72 },
+      "Every 72 hours",
+    ],
+  ])("exposes the %o cadence as %s", (overrides, cadence) => {
+    expect(
+      buildProviderScheduleSummary(buildAttributes(overrides), now).cadence,
+    ).toBe(cadence);
+  });
+
+  it("passes through server-computed next/last run timestamps", () => {
+    const summary = buildProviderScheduleSummary(
+      buildAttributes({
+        next_scan_at: "2026-06-15T07:00:00Z",
+        last_scan_at: "2026-06-08T07:00:00Z",
+      }),
+      now,
+    );
+
+    expect(summary.nextScanAt).toBe("2026-06-15T07:00:00Z");
+    expect(summary.lastScanAt).toBe("2026-06-08T07:00:00Z");
+  });
+});
diff --git a/ui/lib/schedules.ts b/ui/lib/schedules.ts
new file mode 100644
index 0000000000..1117ababe1
--- /dev/null
+++ b/ui/lib/schedules.ts
@@ -0,0 +1,290 @@
+import { z } from "zod";
+
+import type { ScanScheduleSummary } from "@/types/scans";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+  SCHEDULE_FREQUENCY,
+  SCHEDULE_WEEKDAY_LABELS,
+  type ScheduleAttributes,
+  type ScheduleFormValues,
+  type ScheduleProps,
+  type ScheduleUpdatePayload,
+} from "@/types/schedules";
+
+const DEFAULT_SCHEDULE_HOUR = 0;
+const DEFAULT_DAY_OF_WEEK = 1;
+const DEFAULT_DAY_OF_MONTH = 1;
+// The backend (prowler-cloud) enforces SCAN_INTERVAL_HOURS_MIN = 24. 48 is well
+// above that floor.
+const SCAN_INTERVAL_HOURS_MIN = 24;
+const DEFAULT_INTERVAL_HOURS = 48;
+
+export const scheduleFormSchema = z.object({
+  frequency: z.enum(SCHEDULE_FREQUENCY),
+  hour: z.number().int().min(0).max(23),
+  dayOfWeek: z.number().int().min(0).max(6),
+  dayOfMonth: z.number().int().min(1).max(28),
+  intervalHours: z.number().int().min(SCAN_INTERVAL_HOURS_MIN),
+  launchInitialScan: z.boolean(),
+});
+
+/**
+ * Default scan-schedule capability for the current environment.
+ *
+ * Pure function (no side effects) so it is trivial to unit-test. Prowler OSS has
+ * no billing, so the only distinction it can make is Cloud vs non-Cloud:
+ * non-Cloud → legacy daily-only, Cloud → full scheduling. The prowler-cloud
+ * overlay computes its own (billing-aware) capability and passes it down via the
+ * optional `capability` prop, overriding this default — no billing concept ever
+ * leaks into OSS.
+ */
+export function getScanScheduleCapability(
+  isCloud: boolean,
+): ScanScheduleCapability {
+  return isCloud
+    ? SCAN_SCHEDULE_CAPABILITY.ADVANCED
+    : SCAN_SCHEDULE_CAPABILITY.DAILY_LEGACY;
+}
+
+export function formatScheduleHour(hour: number): string {
+  const normalizedHour = ((hour % 24) + 24) % 24;
+  const period = normalizedHour >= 12 ? "pm" : "am";
+  const displayHour = normalizedHour % 12 === 0 ? 12 : normalizedHour % 12;
+
+  return `${displayHour}:00${period}`;
+}
+
+export function getBrowserTimezone(): string {
+  if (typeof window === "undefined") {
+    return "UTC";
+  }
+
+  return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+}
+
+export function getScheduleFormDefaults(): ScheduleFormValues {
+  return {
+    frequency: SCHEDULE_FREQUENCY.DAILY,
+    hour: DEFAULT_SCHEDULE_HOUR,
+    dayOfWeek: DEFAULT_DAY_OF_WEEK,
+    dayOfMonth: DEFAULT_DAY_OF_MONTH,
+    intervalHours: DEFAULT_INTERVAL_HOURS,
+    launchInitialScan: false,
+  };
+}
+
+export function getScheduleFormValues(
+  schedule?: ScheduleAttributes | null,
+): ScheduleFormValues {
+  const defaults = getScheduleFormDefaults();
+
+  if (!schedule || schedule.scan_hour === null) {
+    return defaults;
+  }
+
+  return {
+    frequency: schedule.scan_frequency,
+    hour: schedule.scan_hour,
+    dayOfWeek: schedule.scan_day_of_week ?? defaults.dayOfWeek,
+    dayOfMonth: schedule.scan_day_of_month ?? defaults.dayOfMonth,
+    intervalHours: schedule.scan_interval_hours ?? defaults.intervalHours,
+    launchInitialScan: false,
+  };
+}
+
+export function buildScheduleUpdatePayload(
+  values: ScheduleFormValues,
+): ScheduleUpdatePayload {
+  return {
+    scan_enabled: true,
+    scan_frequency: values.frequency,
+    scan_hour: values.hour,
+    scan_timezone: getBrowserTimezone(),
+    scan_interval_hours:
+      values.frequency === SCHEDULE_FREQUENCY.INTERVAL
+        ? values.intervalHours
+        : null,
+    scan_day_of_week:
+      values.frequency === SCHEDULE_FREQUENCY.WEEKLY ? values.dayOfWeek : null,
+    scan_day_of_month:
+      values.frequency === SCHEDULE_FREQUENCY.MONTHLY
+        ? values.dayOfMonth
+        : null,
+  };
+}
+
+interface SchedulesActionResult {
+  data?: ScheduleProps[] | null;
+  error?: unknown;
+}
+
+/**
+ * Indexes a `getSchedules()` result by provider id — the schedule resource's own
+ * `id` IS the provider id. Returns an empty map on error or missing data, so
+ * callers can treat schedules as best-effort (e.g. OSS, where the `/schedules`
+ * list endpoint may not exist). Shared by the scans and providers views.
+ */
+export function buildSchedulesByProviderId(
+  result: SchedulesActionResult | null | undefined,
+): Record<string, ScheduleAttributes> {
+  const byProviderId: Record<string, ScheduleAttributes> = {};
+  if (!result || result.error) return byProviderId;
+
+  for (const schedule of result.data ?? []) {
+    byProviderId[schedule.id] = schedule.attributes;
+  }
+
+  return byProviderId;
+}
+
+/**
+ * Whether a provider has an explicitly configured scan schedule.
+ *
+ * The schedule resource is backed by the Provider row itself: an unconfigured
+ * provider — or one whose schedule was removed (DELETE resets the schedule to
+ * defaults: `scan_hour=null`, but leaves `scan_enabled=true`) — comes back with
+ * `scan_hour === null`. So `scan_hour` is the canonical "is configured" signal;
+ * `scan_enabled` is NOT, because a freshly created provider already reports
+ * `scan_enabled=true`.
+ */
+export function isScheduleConfigured(
+  attributes: Pick<ScheduleAttributes, "scan_hour">,
+): boolean {
+  return attributes.scan_hour !== null;
+}
+
+/**
+ * Computes the next time a schedule would run, as a local `Date`. Pure: `now` is
+ * injected so it is deterministic to test. Computation is done in the browser's
+ * local time, which matches the timezone shown next to it (`getBrowserTimezone`),
+ * so no timezone-conversion library is needed. This is an estimate for display;
+ * the backend is the source of truth for the actual fire time.
+ *
+ * INTERVAL shares the DAILY computation: the backend anchors its first run at
+ * the next occurrence of `scan_hour`.
+ */
+export function getNextScheduledRun(
+  values: ScheduleFormValues,
+  now: Date,
+): Date {
+  const next = new Date(now);
+  next.setHours(values.hour, 0, 0, 0);
+
+  switch (values.frequency) {
+    case SCHEDULE_FREQUENCY.WEEKLY: {
+      let delta = (values.dayOfWeek - next.getDay() + 7) % 7;
+      if (delta === 0 && next <= now) delta = 7;
+      next.setDate(next.getDate() + delta);
+      return next;
+    }
+    case SCHEDULE_FREQUENCY.MONTHLY: {
+      next.setDate(values.dayOfMonth);
+      if (next <= now) {
+        next.setMonth(next.getMonth() + 1, values.dayOfMonth);
+      }
+      return next;
+    }
+    default: {
+      // DAILY and INTERVAL (the interval anchor is the next occurrence of the hour)
+      if (next <= now) next.setDate(next.getDate() + 1);
+      return next;
+    }
+  }
+}
+
+export interface ScheduleCadenceParts {
+  /** e.g. "Weekly on Monday" */
+  cadence: string;
+  /** e.g. "9:00am (Europe/Madrid)" */
+  time: string;
+}
+
+export function getScheduleCadenceParts(
+  attributes: ScheduleAttributes,
+): ScheduleCadenceParts {
+  const time = `${formatScheduleHour(attributes.scan_hour ?? 0)} (${attributes.scan_timezone})`;
+
+  switch (attributes.scan_frequency) {
+    case SCHEDULE_FREQUENCY.WEEKLY: {
+      const weekday =
+        SCHEDULE_WEEKDAY_LABELS[attributes.scan_day_of_week ?? 0] ??
+        SCHEDULE_WEEKDAY_LABELS[0];
+      return { cadence: `Weekly on ${weekday}`, time };
+    }
+    case SCHEDULE_FREQUENCY.MONTHLY:
+      return {
+        cadence: `Monthly on day ${attributes.scan_day_of_month ?? 1}`,
+        time,
+      };
+    case SCHEDULE_FREQUENCY.INTERVAL:
+      return {
+        cadence: `Every ${attributes.scan_interval_hours ?? 0} hours`,
+        time,
+      };
+    default:
+      return { cadence: "Daily", time };
+  }
+}
+
+/** Human-readable cadence, e.g. "Weekly on Monday @ 9:00am (Europe/Madrid)". */
+export function describeScheduleCadence(
+  attributes: ScheduleAttributes,
+): string {
+  const { cadence, time } = getScheduleCadenceParts(attributes);
+  return `${cadence} @ ${time}`;
+}
+
+/**
+ * Next-run estimate honoring the schedule's own timezone: `toLocaleString`
+ * converts `now` to that timezone's wall-clock and the offset is applied back.
+ */
+export function getNextScheduledRunInTimezone(
+  attributes: ScheduleAttributes,
+  now: Date,
+): Date | null {
+  if (attributes.scan_hour === null) return null;
+
+  let timezoneNow: Date;
+  try {
+    timezoneNow = new Date(
+      now.toLocaleString("en-US", { timeZone: attributes.scan_timezone }),
+    );
+  } catch {
+    timezoneNow = new Date(now);
+  }
+  if (Number.isNaN(timezoneNow.getTime())) timezoneNow = new Date(now);
+
+  const target = getNextScheduledRun(
+    getScheduleFormValues(attributes),
+    timezoneNow,
+  );
+
+  return new Date(now.getTime() + (target.getTime() - timezoneNow.getTime()));
+}
+
+/**
+ * Builds the display summary (cadence + next/last run) for a provider's
+ * schedule, the way the scans and providers tables render it. Shared so both
+ * views show identical cadence labels.
+ *
+ * `next_scan_at` semantics: an absent field (older API) with an enabled
+ * schedule falls back to a client estimate; an explicit null (paused) means no
+ * next run.
+ */
+export function buildProviderScheduleSummary(
+  attributes: ScheduleAttributes,
+  now: Date,
+): ScanScheduleSummary {
+  const nextScanAt =
+    attributes.next_scan_at === undefined && attributes.scan_enabled
+      ? (getNextScheduledRunInTimezone(attributes, now)?.toISOString() ?? null)
+      : (attributes.next_scan_at ?? null);
+
+  return {
+    summary: describeScheduleCadence(attributes),
+    cadence: getScheduleCadenceParts(attributes).cadence,
+    nextScanAt,
+    lastScanAt: attributes.last_scan_at ?? null,
+  };
+}
diff --git a/ui/lib/server-actions-helper.test.ts b/ui/lib/server-actions-helper.test.ts
new file mode 100644
index 0000000000..bfb9fb5ced
--- /dev/null
+++ b/ui/lib/server-actions-helper.test.ts
@@ -0,0 +1,54 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { captureExceptionMock, captureMessageMock, revalidatePathMock } =
+  vi.hoisted(() => ({
+    captureExceptionMock: vi.fn(),
+    captureMessageMock: vi.fn(),
+    revalidatePathMock: vi.fn(),
+  }));
+
+vi.mock("@sentry/nextjs", () => ({
+  captureException: captureExceptionMock,
+  captureMessage: captureMessageMock,
+}));
+
+vi.mock("next/cache", () => ({
+  revalidatePath: revalidatePathMock,
+}));
+
+vi.mock("./helper", () => ({
+  GENERIC_SERVER_ERROR_MESSAGE:
+    "Server is temporarily unavailable. Please try again in a few minutes.",
+  getErrorMessage: (error: unknown) =>
+    error instanceof Error ? error.message : String(error),
+  parseStringify: (value: unknown) => value,
+  sanitizeErrorMessage: (message: string, fallback: string) =>
+    /<html\b|<\/?body\b|<\/?h1\b/i.test(message) ? fallback : message.trim(),
+}));
+
+import { handleApiResponse } from "./server-actions-helper";
+
+describe("server action error handling", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.spyOn(console, "error").mockImplementation(() => {});
+  });
+
+  it("throws a generic server error instead of raw HTML for 5xx responses", async () => {
+    // Given
+    const response = new Response(
+      "<html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center></body></html>",
+      {
+        status: 502,
+        statusText: "Bad Gateway",
+        headers: { "content-type": "text/html" },
+      },
+    );
+
+    // When / Then
+    const result = handleApiResponse(response);
+    await expect(result).rejects.toThrow(
+      "Server is temporarily unavailable. Please try again in a few minutes.",
+    );
+  });
+});
diff --git a/ui/lib/server-actions-helper.ts b/ui/lib/server-actions-helper.ts
index e368d10294..ae677f2ed2 100644
--- a/ui/lib/server-actions-helper.ts
+++ b/ui/lib/server-actions-helper.ts
@@ -3,7 +3,12 @@ import { revalidatePath } from "next/cache";
 
 import { SentryErrorSource, SentryErrorType } from "@/sentry";
 
-import { getErrorMessage, parseStringify } from "./helper";
+import {
+  GENERIC_SERVER_ERROR_MESSAGE,
+  getErrorMessage,
+  parseStringify,
+  sanitizeErrorMessage,
+} from "./helper";
 
 /**
  * Helper function to handle API responses consistently
@@ -17,6 +22,7 @@ export const handleApiResponse = async (
   if (!response.ok) {
     // Read error body safely; prefer JSON, fallback to plain text
     const rawErrorText = await response.text().catch(() => "");
+    const contentType = response.headers.get("content-type")?.toLowerCase();
     let errorData: any = null;
     try {
       errorData = rawErrorText ? JSON.parse(rawErrorText) : null;
@@ -27,13 +33,20 @@ export const handleApiResponse = async (
     const errorsArray = Array.isArray(errorData?.errors)
       ? (errorData.errors as any[])
       : undefined;
-    const errorDetail =
-      errorsArray?.[0]?.detail ||
-      errorData?.error ||
-      errorData?.message ||
-      (rawErrorText && rawErrorText.trim()) ||
-      response.statusText ||
-      "Oops! Something went wrong.";
+    const parsedErrorMessage =
+      errorsArray?.[0]?.detail || errorData?.error || errorData?.message;
+    const fallbackErrorMessage =
+      response.status >= 500 || contentType?.includes("text/html")
+        ? GENERIC_SERVER_ERROR_MESSAGE
+        : response.statusText || "Oops! Something went wrong.";
+    const rawErrorMessage =
+      parsedErrorMessage ||
+      (response.status < 500 && rawErrorText.trim()) ||
+      fallbackErrorMessage;
+    const errorDetail = sanitizeErrorMessage(
+      String(rawErrorMessage),
+      fallbackErrorMessage,
+    );
 
     // Capture error context for Sentry
     const errorContext = {
diff --git a/ui/lib/shared/env.ts b/ui/lib/shared/env.ts
new file mode 100644
index 0000000000..766394b970
--- /dev/null
+++ b/ui/lib/shared/env.ts
@@ -0,0 +1,14 @@
+/**
+ * Shared environment helpers.
+ */
+
+/**
+ * Whether the UI is running inside a Prowler Cloud deployment.
+ *
+ * `NEXT_PUBLIC_*` vars are statically inlined by Next.js wherever the literal
+ * `process.env.NEXT_PUBLIC_IS_CLOUD_ENV` appears in source, so keeping this read
+ * inside a helper is safe.
+ */
+export function isCloud(): boolean {
+  return process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+}
diff --git a/ui/lib/tours/__tests__/add-provider.tour.test.ts b/ui/lib/tours/__tests__/add-provider.tour.test.ts
new file mode 100644
index 0000000000..b361283d0a
--- /dev/null
+++ b/ui/lib/tours/__tests__/add-provider.tour.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  addProviderTour,
+  type AddProviderTourTarget,
+} from "../add-provider.tour";
+
+// These carry a `data-tour-id` in the UI; the welcome step has no target.
+const ALLOWED_TARGETS = ["trigger", "provider-type", "wizard-body"] as const;
+
+const definedTargets = (): AddProviderTourTarget[] =>
+  addProviderTour.steps
+    .map((step) => step.target)
+    .filter((target): target is AddProviderTourTarget => target !== undefined);
+
+describe("addProviderTour shape", () => {
+  it("declares the add-provider id", () => {
+    expect(addProviderTour.id).toBe("add-provider");
+  });
+
+  it("declares a positive integer version", () => {
+    expect(Number.isInteger(addProviderTour.version)).toBe(true);
+    expect(addProviderTour.version).toBeGreaterThan(0);
+  });
+
+  it("includes the trigger, provider-type, and wizard-body steps in order", () => {
+    const targets = definedTargets();
+    expect(targets).toEqual(["trigger", "provider-type", "wizard-body"]);
+  });
+
+  it("marks every anchored step as autoAdvance (no Next button)", () => {
+    // All anchored steps advance imperatively from the UI (clicking the real
+    // "Add a Provider" button, picking a type, etc.), so none renders a Next button.
+    const byTarget = (target: AddProviderTourTarget) =>
+      addProviderTour.steps.find((step) => step.target === target);
+
+    expect(byTarget("trigger")?.autoAdvance).toBe(true);
+    expect(byTarget("provider-type")?.autoAdvance).toBe(true);
+    expect(byTarget("wizard-body")?.autoAdvance).toBe(true);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    const targets = definedTargets();
+    for (const target of targets) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("includes a non-anchored welcome step (no target)", () => {
+    const welcomeSteps = addProviderTour.steps.filter(
+      (step) => step.target === undefined,
+    );
+    expect(welcomeSteps.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("covers the providers component tree for the tour:check gate", () => {
+    expect(addProviderTour.coversFiles).toContain("ui/components/providers/**");
+  });
+});
diff --git a/ui/lib/tours/__tests__/attack-paths.tour.test.ts b/ui/lib/tours/__tests__/attack-paths.tour.test.ts
new file mode 100644
index 0000000000..27e22b6313
--- /dev/null
+++ b/ui/lib/tours/__tests__/attack-paths.tour.test.ts
@@ -0,0 +1,120 @@
+import { describe, expect, it } from "vitest";
+
+import type { AttackPathQuery, AttackPathScan } from "@/types/attack-paths";
+import { ATTACK_PATH_QUERY_IDS } from "@/types/attack-paths";
+
+import {
+  attackPathsTour,
+  type AttackPathsTourTarget,
+  pickDemoQuery,
+  pickDemoScan,
+} from "../attack-paths.tour";
+
+// Only these carry a `data-tour-id` in the page; keep in sync with tour:check.
+const ALLOWED_TARGETS = [
+  "intro",
+  "scan-list",
+  "query-selector",
+  "execute-button",
+] as const;
+
+const definedTargets = (): AttackPathsTourTarget[] =>
+  attackPathsTour.steps
+    .map((step) => step.target)
+    .filter((target): target is AttackPathsTourTarget => target !== undefined);
+
+const makeScan = (overrides: {
+  id: string;
+  ready: boolean;
+  provider: AttackPathScan["attributes"]["provider_type"];
+}): AttackPathScan =>
+  ({
+    type: "attack-paths-scans",
+    id: overrides.id,
+    attributes: {
+      graph_data_ready: overrides.ready,
+      provider_type: overrides.provider,
+    },
+  }) as AttackPathScan;
+
+const makeQuery = (overrides: {
+  id: string;
+  paramCount: number;
+}): AttackPathQuery =>
+  ({
+    type: "attack-paths-scans",
+    id: overrides.id,
+    attributes: {
+      parameters: Array.from({ length: overrides.paramCount }, (_, index) => ({
+        name: `p${index}`,
+      })),
+    },
+  }) as AttackPathQuery;
+
+describe("attackPathsTour shape", () => {
+  it("declares the attack-paths id", () => {
+    expect(attackPathsTour.id).toBe("attack-paths");
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    for (const target of definedTargets()) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+});
+
+describe("pickDemoScan", () => {
+  it("prefers a ready AWS scan over other ready scans", () => {
+    const scans = [
+      makeScan({ id: "gcp", ready: true, provider: "gcp" }),
+      makeScan({ id: "aws", ready: true, provider: "aws" }),
+    ];
+    expect(pickDemoScan(scans)?.id).toBe("aws");
+  });
+
+  it("falls back to any ready scan when no ready AWS scan exists", () => {
+    const scans = [
+      makeScan({ id: "aws-not-ready", ready: false, provider: "aws" }),
+      makeScan({ id: "gcp-ready", ready: true, provider: "gcp" }),
+    ];
+    expect(pickDemoScan(scans)?.id).toBe("gcp-ready");
+  });
+
+  it("returns undefined when no scan is ready", () => {
+    const scans = [makeScan({ id: "x", ready: false, provider: "aws" })];
+    expect(pickDemoScan(scans)).toBeUndefined();
+  });
+});
+
+describe("pickDemoQuery", () => {
+  it("prefers the IAM wildcard query when it is runnable", () => {
+    const queries = [
+      makeQuery({ id: "other", paramCount: 0 }),
+      makeQuery({ id: "aws-iam-statements-allow-all-actions", paramCount: 0 }),
+    ];
+    expect(pickDemoQuery(queries)?.id).toBe(
+      "aws-iam-statements-allow-all-actions",
+    );
+  });
+
+  it("falls back to any parameter-free non-custom query", () => {
+    const queries = [
+      makeQuery({ id: ATTACK_PATH_QUERY_IDS.CUSTOM, paramCount: 0 }),
+      makeQuery({ id: "needs-params", paramCount: 2 }),
+      makeQuery({ id: "runnable", paramCount: 0 }),
+    ];
+    expect(pickDemoQuery(queries)?.id).toBe("runnable");
+  });
+
+  it("never picks the custom query (it needs Cypher input)", () => {
+    const queries = [
+      makeQuery({ id: ATTACK_PATH_QUERY_IDS.CUSTOM, paramCount: 0 }),
+    ];
+    expect(pickDemoQuery(queries)).toBeUndefined();
+  });
+
+  it("never picks a query with required parameters", () => {
+    const queries = [makeQuery({ id: "needs-params", paramCount: 1 })];
+    expect(pickDemoQuery(queries)).toBeUndefined();
+  });
+});
diff --git a/ui/lib/tours/__tests__/explore-findings.tour.test.ts b/ui/lib/tours/__tests__/explore-findings.tour.test.ts
new file mode 100644
index 0000000000..0c8ba2a063
--- /dev/null
+++ b/ui/lib/tours/__tests__/explore-findings.tour.test.ts
@@ -0,0 +1,89 @@
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  createExploreFindingsTourStepHandlers,
+  exploreFindingsTour,
+  type ExploreFindingsTourTarget,
+} from "../explore-findings.tour";
+
+// Only these carry a `data-tour-id` in the UI; welcome step has no target.
+const ALLOWED_TARGETS = ["filters", "group", "resources"] as const;
+
+const definedTargets = (): ExploreFindingsTourTarget[] =>
+  exploreFindingsTour.steps
+    .map((step) => step.target)
+    .filter(
+      (target): target is ExploreFindingsTourTarget => target !== undefined,
+    );
+
+describe("exploreFindingsTour shape", () => {
+  it("declares the explore-findings id", () => {
+    expect(exploreFindingsTour.id).toBe("explore-findings");
+  });
+
+  it("declares a positive integer version", () => {
+    expect(Number.isInteger(exploreFindingsTour.version)).toBe(true);
+    expect(exploreFindingsTour.version).toBeGreaterThan(0);
+  });
+
+  it("anchors filters, then the first group, then its resources, in that order", () => {
+    const targets = definedTargets();
+    // filters mounts immediately; group/resources appear after Suspense + drill-down, so order matters
+    expect(targets).toEqual(["filters", "group", "resources"]);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    const targets = definedTargets();
+    for (const target of targets) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("includes a non-anchored welcome step (no target)", () => {
+    const welcomeSteps = exploreFindingsTour.steps.filter(
+      (step) => step.target === undefined,
+    );
+    expect(welcomeSteps.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("covers the findings route and component trees for the tour:check gate", () => {
+    expect(exploreFindingsTour.coversFiles).toContain(
+      "ui/app/(prowler)/findings/**",
+    );
+    expect(exploreFindingsTour.coversFiles).toContain(
+      "ui/components/findings/**",
+    );
+  });
+});
+
+describe("createExploreFindingsTourStepHandlers", () => {
+  it("opens the first group and waits for the resources anchor before advancing", async () => {
+    const openFirstGroup = vi.fn(() => true);
+    const waitForStep = vi
+      .fn()
+      .mockResolvedValue(document.createElement("div"));
+    const handlers = createExploreFindingsTourStepHandlers(openFirstGroup);
+
+    await handlers.group?.onNext?.({ waitForStep });
+
+    expect(openFirstGroup).toHaveBeenCalledTimes(1);
+    expect(waitForStep).toHaveBeenCalledWith("resources");
+  });
+
+  it("does not wait for resources when no group can be opened", async () => {
+    const openFirstGroup = vi.fn(() => false);
+    const waitForStep = vi.fn();
+    const handlers = createExploreFindingsTourStepHandlers(openFirstGroup);
+
+    await handlers.group?.onNext?.({ waitForStep });
+
+    expect(openFirstGroup).toHaveBeenCalledTimes(1);
+    expect(waitForStep).not.toHaveBeenCalled();
+  });
+
+  it("registers a handler only for the group step", () => {
+    const handlers = createExploreFindingsTourStepHandlers(() => true);
+
+    expect(Object.keys(handlers)).toEqual(["group"]);
+  });
+});
diff --git a/ui/lib/tours/__tests__/use-driver-tour.lifecycle.test.tsx b/ui/lib/tours/__tests__/use-driver-tour.lifecycle.test.tsx
new file mode 100644
index 0000000000..1c300787d4
--- /dev/null
+++ b/ui/lib/tours/__tests__/use-driver-tour.lifecycle.test.tsx
@@ -0,0 +1,198 @@
+import { act, render } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { TourCompletionStore } from "../store/tour-completion-store";
+import type { TourCompletionRecord, TourDefinition } from "../tour-types";
+import { useDriverTour, type UseDriverTourResult } from "../use-driver-tour";
+
+const driverHarness = vi.hoisted(() => {
+  const instances: Array<{
+    destroy: ReturnType<typeof vi.fn>;
+    drive: ReturnType<typeof vi.fn>;
+    isActive: ReturnType<typeof vi.fn>;
+    isLastStep: ReturnType<typeof vi.fn>;
+  }> = [];
+
+  const driverMock = vi.fn((config: { onDestroyed?: () => void }) => {
+    let active = false;
+    const instance = {
+      destroy: vi.fn(() => {
+        active = false;
+        config.onDestroyed?.();
+      }),
+      drive: vi.fn(() => {
+        active = true;
+      }),
+      isActive: vi.fn(() => active),
+      isLastStep: vi.fn(() => false),
+      moveNext: vi.fn(),
+      movePrevious: vi.fn(),
+    };
+    instances.push(instance);
+    return instance;
+  });
+
+  return { driverMock, instances };
+});
+
+vi.mock("driver.js", () => ({
+  driver: driverHarness.driverMock,
+}));
+
+const themeHarness = vi.hoisted(() => ({ resolvedTheme: "dark" }));
+
+vi.mock("next-themes", () => ({
+  useTheme: () => ({ resolvedTheme: themeHarness.resolvedTheme }),
+}));
+
+const tour = {
+  id: "lifecycle-tour",
+  version: 1,
+  coversFiles: [],
+  steps: [
+    {
+      title: "Welcome",
+      description: "Tour lifecycle",
+    },
+  ],
+} satisfies TourDefinition;
+
+function createStore(): TourCompletionStore {
+  const records = new Map<string, TourCompletionRecord>();
+
+  return {
+    get: ({ id, version }) => records.get(`${id}.${version}`) ?? null,
+    set: ({ id, version }, record) => {
+      records.set(`${id}.${version}`, record);
+    },
+    clear: ({ id, version }) => {
+      records.delete(`${id}.${version}`);
+    },
+  };
+}
+
+function HookProbe({
+  autoOpen,
+  onResult,
+  store,
+}: {
+  autoOpen: boolean;
+  onResult: (result: UseDriverTourResult) => void;
+  store: TourCompletionStore;
+}) {
+  const result = useDriverTour(tour, { autoOpen, store });
+  onResult(result);
+  return null;
+}
+
+describe("useDriverTour lifecycle", () => {
+  beforeEach(() => {
+    vi.stubEnv("NODE_ENV", "development");
+    themeHarness.resolvedTheme = "dark";
+    driverHarness.driverMock.mockClear();
+    driverHarness.instances.length = 0;
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.unstubAllEnvs();
+  });
+
+  it("does not destroy an active manually-started tour when autoOpen changes after replay param cleanup", () => {
+    const store = createStore();
+    let latestResult: UseDriverTourResult | undefined;
+
+    const { rerender } = render(
+      <HookProbe
+        autoOpen={false}
+        store={store}
+        onResult={(result) => {
+          latestResult = result;
+        }}
+      />,
+    );
+
+    expect(driverHarness.instances).toHaveLength(1);
+
+    act(() => {
+      latestResult?.start();
+    });
+
+    rerender(
+      <HookProbe
+        autoOpen
+        store={store}
+        onResult={(result) => {
+          latestResult = result;
+        }}
+      />,
+    );
+
+    expect(driverHarness.instances[0].drive).toHaveBeenCalledTimes(1);
+    expect(driverHarness.instances[0].destroy).not.toHaveBeenCalled();
+  });
+
+  it("still auto-opens a new incomplete tour after the configured delay", () => {
+    vi.useFakeTimers();
+    const store = createStore();
+
+    render(
+      <HookProbe
+        autoOpen
+        store={store}
+        onResult={() => {
+          // Result surface is irrelevant for auto-open behavior.
+        }}
+      />,
+    );
+
+    expect(driverHarness.instances).toHaveLength(1);
+    expect(driverHarness.instances[0].drive).not.toHaveBeenCalled();
+
+    act(() => {
+      vi.advanceTimersByTime(50);
+    });
+
+    expect(driverHarness.instances[0].drive).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not record a completion when an active tour is torn down by a theme change", () => {
+    const store = createStore();
+    let latestResult: UseDriverTourResult | undefined;
+
+    const { rerender } = render(
+      <HookProbe
+        autoOpen={false}
+        store={store}
+        onResult={(result) => {
+          latestResult = result;
+        }}
+      />,
+    );
+
+    act(() => {
+      latestResult?.start();
+    });
+
+    // Toggling theme re-runs the driver effect; its cleanup destroys the active
+    // instance, which (like real driver.js) fires onDestroyed directly.
+    act(() => {
+      themeHarness.resolvedTheme = "light";
+      rerender(
+        <HookProbe
+          autoOpen={false}
+          store={store}
+          onResult={(result) => {
+            latestResult = result;
+          }}
+        />,
+      );
+    });
+
+    // The first instance was destroyed and a fresh one created for the new theme...
+    expect(driverHarness.instances[0].destroy).toHaveBeenCalledTimes(1);
+    expect(driverHarness.instances).toHaveLength(2);
+    // ...but no completion record was persisted, so the tour can reappear later.
+    expect(store.get({ id: tour.id, version: tour.version })).toBeNull();
+  });
+});
diff --git a/ui/lib/tours/__tests__/use-driver-tour.test.tsx b/ui/lib/tours/__tests__/use-driver-tour.test.tsx
new file mode 100644
index 0000000000..f9a523d80c
--- /dev/null
+++ b/ui/lib/tours/__tests__/use-driver-tour.test.tsx
@@ -0,0 +1,96 @@
+import { render } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { addProviderTour } from "../add-provider.tour";
+import type { TourCompletionRecord } from "../tour-types";
+import {
+  adaptStep,
+  advanceActiveTour,
+  endActiveTour,
+  useDriverTour,
+} from "../use-driver-tour";
+
+// Hook short-circuits driver.js in NODE_ENV=test; asserts public contract only.
+// Driver.js close behavior is covered by E2E (slice 9).
+
+function HookProbe({
+  onClosed,
+  onResult,
+}: {
+  onClosed?: (state: TourCompletionRecord["state"]) => void;
+  onResult: (result: ReturnType<typeof useDriverTour>) => void;
+}) {
+  const result = useDriverTour(addProviderTour, { autoOpen: false, onClosed });
+  onResult(result);
+  return null;
+}
+
+describe("useDriverTour onClosed option", () => {
+  it("accepts the onClosed option and returns the existing result surface", () => {
+    const onClosed = vi.fn();
+    const results: ReturnType<typeof useDriverTour>[] = [];
+
+    render(<HookProbe onClosed={onClosed} onResult={(r) => results.push(r)} />);
+
+    const result = results.at(-1);
+    expect(result).toBeDefined();
+    expect(typeof result?.start).toBe("function");
+    expect(typeof result?.stop).toBe("function");
+    expect(typeof result?.hasCompleted).toBe("boolean");
+    // onClosed is input-only; it must not leak into the returned surface
+    expect(result && "onClosed" in result).toBe(false);
+  });
+
+  it("keeps the same result surface when onClosed is omitted (backward-compatible)", () => {
+    const results: ReturnType<typeof useDriverTour>[] = [];
+
+    render(<HookProbe onResult={(r) => results.push(r)} />);
+
+    const result = results.at(-1);
+    expect(result).toBeDefined();
+    expect(typeof result?.start).toBe("function");
+    expect(typeof result?.stop).toBe("function");
+    expect(typeof result?.hasCompleted).toBe("boolean");
+  });
+});
+
+describe("endActiveTour", () => {
+  // The actual destroy path runs only outside NODE_ENV=test (driver.js is
+  // short-circuited here), so this asserts the imperative escape hatch the
+  // provider wizard relies on is exported and safe to call unconditionally.
+  it("is a no-op that does not throw when no tour is active", () => {
+    expect(() => endActiveTour()).not.toThrow();
+    expect(endActiveTour()).toBeUndefined();
+  });
+});
+
+describe("advanceActiveTour", () => {
+  // Sibling escape hatch to endActiveTour: the wizard calls it on provider-type
+  // selection to move past the autoAdvance step. Same NODE_ENV=test short-circuit.
+  it("is a no-op that does not throw when no tour is active", () => {
+    expect(() => advanceActiveTour()).not.toThrow();
+    expect(advanceActiveTour()).toBeUndefined();
+  });
+});
+
+describe("adaptStep autoAdvance", () => {
+  it("limits an autoAdvance step's popover to the close button only", () => {
+    const driveStep = adaptStep("add-provider", {
+      target: "provider-type",
+      autoAdvance: true,
+      title: "Pick a provider type",
+    });
+
+    // No Next/Back — the covered UI drives the flow via advanceActiveTour().
+    expect(driveStep.popover?.showButtons).toEqual(["close"]);
+  });
+
+  it("leaves showButtons unset on a normal step (driver.js defaults apply)", () => {
+    const driveStep = adaptStep("add-provider", {
+      target: "trigger",
+      title: "Open the wizard",
+    });
+
+    expect(driveStep.popover?.showButtons).toBeUndefined();
+  });
+});
diff --git a/ui/lib/tours/__tests__/view-compliance.tour.test.ts b/ui/lib/tours/__tests__/view-compliance.tour.test.ts
new file mode 100644
index 0000000000..4d6c042b51
--- /dev/null
+++ b/ui/lib/tours/__tests__/view-compliance.tour.test.ts
@@ -0,0 +1,105 @@
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  createViewComplianceTourStepHandlers,
+  viewComplianceTour,
+  type ViewComplianceTourTarget,
+} from "../view-compliance.tour";
+
+// Only these two carry a `data-tour-id` in the UI; welcome step has no target.
+const ALLOWED_TARGETS = ["frameworks", "search"] as const;
+
+const definedTargets = (): ViewComplianceTourTarget[] =>
+  viewComplianceTour.steps
+    .map((step) => step.target)
+    .filter(
+      (target): target is ViewComplianceTourTarget => target !== undefined,
+    );
+
+describe("viewComplianceTour shape", () => {
+  it("declares the view-compliance id", () => {
+    expect(viewComplianceTour.id).toBe("view-compliance");
+  });
+
+  it("declares a positive integer version", () => {
+    expect(Number.isInteger(viewComplianceTour.version)).toBe(true);
+    expect(viewComplianceTour.version).toBeGreaterThan(0);
+  });
+
+  it("anchors exactly the search and frameworks steps, in that order", () => {
+    // Search sits above the cards in the DOM; the tour must follow top-to-bottom
+    // so the spotlight never jumps back up the page.
+    const targets = definedTargets();
+    expect(targets).toEqual(["search", "frameworks"]);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    const targets = definedTargets();
+    for (const target of targets) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("includes a non-anchored welcome step (no target)", () => {
+    const welcomeSteps = viewComplianceTour.steps.filter(
+      (step) => step.target === undefined,
+    );
+    expect(welcomeSteps.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("covers the compliance route and component trees for the tour:check gate", () => {
+    expect(viewComplianceTour.coversFiles).toContain(
+      "ui/app/(prowler)/compliance/**",
+    );
+    expect(viewComplianceTour.coversFiles).toContain(
+      "ui/components/compliance/**",
+    );
+  });
+});
+
+describe("createViewComplianceTourStepHandlers", () => {
+  const makeHandlers = (overrides?: {
+    resetSearch?: () => boolean;
+    openFirstFramework?: () => void;
+  }) =>
+    createViewComplianceTourStepHandlers({
+      resetSearch: overrides?.resetSearch ?? vi.fn(() => true),
+      openFirstFramework: overrides?.openFirstFramework ?? vi.fn(),
+    });
+
+  it("resets the search and waits for the frameworks anchor before advancing", async () => {
+    // An empty search result unmounts every card (anchor included); resetting first
+    // guarantees the next step has an element to highlight.
+    const resetSearch = vi.fn(() => true);
+    const waitForStep = vi
+      .fn()
+      .mockResolvedValue(document.createElement("div"));
+    const handlers = makeHandlers({ resetSearch });
+
+    await handlers.search?.onNext?.({ waitForStep });
+
+    expect(resetSearch).toHaveBeenCalledTimes(1);
+    expect(waitForStep).toHaveBeenCalledWith("frameworks");
+  });
+
+  it("does not wait for frameworks when no card can render", async () => {
+    const resetSearch = vi.fn(() => false);
+    const waitForStep = vi.fn();
+    const handlers = makeHandlers({ resetSearch });
+
+    await handlers.search?.onNext?.({ waitForStep });
+
+    expect(waitForStep).not.toHaveBeenCalled();
+  });
+
+  it("opens the first framework when leaving the last step", async () => {
+    const openFirstFramework = vi.fn();
+    const waitForStep = vi.fn();
+    const handlers = makeHandlers({ openFirstFramework });
+
+    await handlers.frameworks?.onNext?.({ waitForStep });
+
+    expect(openFirstFramework).toHaveBeenCalledTimes(1);
+    expect(waitForStep).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/lib/tours/__tests__/view-first-scan.tour.test.ts b/ui/lib/tours/__tests__/view-first-scan.tour.test.ts
new file mode 100644
index 0000000000..8fead9fd33
--- /dev/null
+++ b/ui/lib/tours/__tests__/view-first-scan.tour.test.ts
@@ -0,0 +1,86 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  buildViewFirstScanTour,
+  viewFirstScanTour,
+  type ViewFirstScanTourTarget,
+} from "../view-first-scan.tour";
+
+// These carry a `data-tour-id` in the UI; the welcome step has no target.
+const ALLOWED_TARGETS = ["in-progress", "launch", "tabs"] as const;
+
+const definedTargets = (tour = viewFirstScanTour): ViewFirstScanTourTarget[] =>
+  tour.steps
+    .map((step) => step.target)
+    .filter(
+      (target): target is ViewFirstScanTourTarget => target !== undefined,
+    );
+
+describe("viewFirstScanTour shape (default, no running scan)", () => {
+  it("declares the view-first-scan id", () => {
+    expect(viewFirstScanTour.id).toBe("view-first-scan");
+  });
+
+  it("declares a positive integer version", () => {
+    expect(Number.isInteger(viewFirstScanTour.version)).toBe(true);
+    expect(viewFirstScanTour.version).toBeGreaterThan(0);
+  });
+
+  it("anchors exactly the launch and tabs steps, in that order", () => {
+    expect(definedTargets()).toEqual(["launch", "tabs"]);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    for (const target of definedTargets()) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("includes a non-anchored welcome step (no target)", () => {
+    const welcomeSteps = viewFirstScanTour.steps.filter(
+      (step) => step.target === undefined,
+    );
+    expect(welcomeSteps.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("covers the scans route and component trees for the tour:check gate", () => {
+    expect(viewFirstScanTour.coversFiles).toContain(
+      "ui/app/(prowler)/scans/**",
+    );
+    expect(viewFirstScanTour.coversFiles).toContain("ui/components/scans/**");
+  });
+
+  it("is the build output for the no-running-scan case", () => {
+    // The registry's default flow uses this variant; the scans page rebuilds live.
+    expect(definedTargets(buildViewFirstScanTour(false))).toEqual([
+      "launch",
+      "tabs",
+    ]);
+  });
+});
+
+describe("buildViewFirstScanTour with a running scan", () => {
+  const tour = buildViewFirstScanTour(true);
+
+  it("anchors the in-progress row first, then launch (no tabs step)", () => {
+    // The tabs are mentioned in the in-progress step's copy instead of a separate step.
+    expect(definedTargets(tour)).toEqual(["in-progress", "launch"]);
+  });
+
+  it("shares the same id and version as the default variant", () => {
+    expect(tour.id).toBe(viewFirstScanTour.id);
+    expect(tour.version).toBe(viewFirstScanTour.version);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    for (const target of definedTargets(tour)) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("keeps a non-anchored welcome step", () => {
+    expect(
+      tour.steps.filter((step) => step.target === undefined).length,
+    ).toBeGreaterThanOrEqual(1);
+  });
+});
diff --git a/ui/lib/tours/add-provider.tour.ts b/ui/lib/tours/add-provider.tour.ts
new file mode 100644
index 0000000000..614735d79b
--- /dev/null
+++ b/ui/lib/tours/add-provider.tour.ts
@@ -0,0 +1,67 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+} from "./tour-types";
+
+// Const map keeps the union narrow so `useDriverTour` can validate step keys.
+export const ADD_PROVIDER_TOUR_TARGETS = {
+  TRIGGER: "trigger",
+  PROVIDER_TYPE: "provider-type",
+  // Wraps the whole wizard modal so the final step's spotlight covers every input
+  // (UID, alias) and the footer — driver.js only keeps the highlighted element and
+  // its descendants interactive, so anchoring here stops the overlay from freezing
+  // those inputs.
+  WIZARD_BODY: "wizard-body",
+} as const;
+
+export type AddProviderTourTarget =
+  (typeof ADD_PROVIDER_TOUR_TARGETS)[keyof typeof ADD_PROVIDER_TOUR_TARGETS];
+
+export const addProviderTour = defineTour<AddProviderTourTarget>({
+  id: "add-provider",
+  // v2: the tour now drives the user into the wizard body (provider-type + wizard-body
+  // steps) instead of ending at type selection.
+  version: 2,
+  coversFiles: ["ui/components/providers/**"],
+  steps: [
+    {
+      title: "Connect your first provider",
+      description:
+        "Prowler scans the providers you connect. Let's walk through adding your first provider so scans have something to assess.",
+    },
+    {
+      target: "trigger",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      // No Next button: clicking the highlighted "Add a Provider" button opens the
+      // wizard and advances the tour (see openProviderWizard).
+      autoAdvance: true,
+      title: "Open the Add Provider wizard",
+      description:
+        "Click Add a Provider to open the setup wizard. We'll point out the first thing to choose.",
+    },
+    {
+      target: "provider-type",
+      side: TOUR_STEP_SIDES.RIGHT,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      // No Next button: the wizard advances the tour when a type is picked.
+      autoAdvance: true,
+      title: "Pick a provider type",
+      description:
+        "Choose the cloud you want to connect (AWS, Azure, GCP, and more). Selecting one takes you to the account details.",
+    },
+    {
+      target: "wizard-body",
+      // Pinned to the left of the form column, mirroring the provider-type step.
+      side: TOUR_STEP_SIDES.LEFT,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      // Final step: stays until the user closes it or advances to credentials, which
+      // the wizard ends the tour from. No Next button.
+      autoAdvance: true,
+      title: "Add your account details",
+      description:
+        "Enter your account ID and an optional alias, then continue. From here you'll add credentials, test the connection, and launch your first scan — at your own pace.",
+    },
+  ],
+});
diff --git a/ui/lib/tours/attack-paths-empty.tour.ts b/ui/lib/tours/attack-paths-empty.tour.ts
new file mode 100644
index 0000000000..34a1949eff
--- /dev/null
+++ b/ui/lib/tours/attack-paths-empty.tour.ts
@@ -0,0 +1,31 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+} from "./tour-types";
+
+// Companion to `attack-paths.tour.ts` with a distinct id so completing one
+// does not suppress the other.
+export const attackPathsEmptyTour = defineTour({
+  id: "attack-paths-empty",
+  version: 1,
+  coversFiles: [
+    "ui/app/(prowler)/attack-paths/**",
+    "ui/components/attack-paths/**",
+  ],
+  steps: [
+    {
+      title: "Welcome to Attack Paths",
+      description:
+        "Attack Paths visualizes how a compromise in one resource could spread through your cloud. It's currently available for AWS accounts only — you'll need a completed AWS scan first.",
+    },
+    {
+      target: "scans-cta",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Run your first scan",
+      description:
+        "Open Scan Jobs to launch one. The Attack Paths tour will pick up here once a scan is ready.",
+    },
+  ],
+});
diff --git a/ui/lib/tours/attack-paths.tour.ts b/ui/lib/tours/attack-paths.tour.ts
new file mode 100644
index 0000000000..b44a11e5b1
--- /dev/null
+++ b/ui/lib/tours/attack-paths.tour.ts
@@ -0,0 +1,98 @@
+import type { AttackPathQuery, AttackPathScan } from "@/types/attack-paths";
+import { ATTACK_PATH_QUERY_IDS } from "@/types/attack-paths";
+
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+} from "./tour-types";
+
+export const attackPathsTour = defineTour({
+  id: "attack-paths",
+  version: 1,
+  coversFiles: [
+    "ui/app/(prowler)/attack-paths/**",
+    "ui/components/attack-paths/**",
+  ],
+  steps: [
+    {
+      title: "Welcome to Attack Paths",
+      description:
+        "Attack Paths visualizes how a compromise in one resource could spread through your cloud. It's currently available for AWS accounts only.",
+    },
+    {
+      target: "intro",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Start with a scan",
+      description:
+        "Attack Paths analyses are generated from your existing AWS scans. Each scan is a point-in-time snapshot of one account.",
+    },
+    {
+      target: "scan-list",
+      side: TOUR_STEP_SIDES.TOP,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Pick a scan",
+      description:
+        "Each row is a scan. Click the radio button on the left to select one.",
+    },
+    {
+      target: "query-selector",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Choose a query",
+      description:
+        "Predefined queries cover common risk patterns (privilege escalation, public exposure, lateral movement). You can also write your own query.",
+    },
+    {
+      target: "execute-button",
+      side: TOUR_STEP_SIDES.TOP,
+      align: TOUR_STEP_ALIGNMENTS.END,
+      // No Next button: clicking the highlighted Execute Query button runs the query
+      // and advances the tour (see handleExecuteQuery in attack-paths-page).
+      autoAdvance: true,
+      title: "Run it whenever you're ready",
+      description:
+        "Click Execute Query to see the graph with the possible attack paths.",
+    },
+    {
+      title: "You're all set",
+      description:
+        "Explore the attack paths and dig into anything that looks risky.",
+    },
+  ],
+});
+
+export type AttackPathsTourTarget = NonNullable<
+  (typeof attackPathsTour.steps)[number]["target"]
+>;
+
+// Demo-pick logic lives here so page code never decides what to auto-run.
+// Preferred demo query: well-known and usually returns findings.
+const PREFERRED_DEMO_QUERY_ID = "aws-iam-statements-allow-all-actions";
+
+const isReadyScan = (scan: AttackPathScan): boolean =>
+  scan.attributes.graph_data_ready;
+
+// Prefer a ready AWS scan; fall back to any ready scan for non-AWS tenants.
+export function pickDemoScan(
+  scans: readonly AttackPathScan[],
+): AttackPathScan | undefined {
+  const preferredAws = scans.find(
+    (scan) => isReadyScan(scan) && scan.attributes.provider_type === "aws",
+  );
+  return preferredAws ?? scans.find(isReadyScan);
+}
+
+// Runnable = no required params and not Custom (needs manual Cypher).
+export function pickDemoQuery(
+  queries: readonly AttackPathQuery[],
+): AttackPathQuery | undefined {
+  const isRunnable = (query: AttackPathQuery): boolean =>
+    query.id !== ATTACK_PATH_QUERY_IDS.CUSTOM &&
+    query.attributes.parameters.length === 0;
+  const preferredIam = queries.find(
+    (query) => query.id === PREFERRED_DEMO_QUERY_ID && isRunnable(query),
+  );
+  return preferredIam ?? queries.find(isRunnable);
+}
diff --git a/ui/lib/tours/explore-findings.tour.ts b/ui/lib/tours/explore-findings.tour.ts
new file mode 100644
index 0000000000..920cd0742f
--- /dev/null
+++ b/ui/lib/tours/explore-findings.tour.ts
@@ -0,0 +1,74 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+  type TourStepHandlers,
+} from "./tour-types";
+
+// Const map keeps the union narrow so `useDriverTour` can validate step keys.
+export const EXPLORE_FINDINGS_TOUR_TARGETS = {
+  FILTERS: "filters",
+  // Anchored to the first finding group row (there may be only one), not the whole table.
+  GROUP: "group",
+  // The expanded resources panel revealed after opening a finding group.
+  RESOURCES: "resources",
+} as const;
+
+export type ExploreFindingsTourTarget =
+  (typeof EXPLORE_FINDINGS_TOUR_TARGETS)[keyof typeof EXPLORE_FINDINGS_TOUR_TARGETS];
+
+export const exploreFindingsTour = defineTour<ExploreFindingsTourTarget>({
+  id: "explore-findings",
+  version: 1,
+  coversFiles: ["ui/app/(prowler)/findings/**", "ui/components/findings/**"],
+  steps: [
+    {
+      title: "Explore your findings",
+      description:
+        "Findings are the issues Prowler detected across your scans, grouped so you can act on what matters most.",
+    },
+    {
+      // `filters` renders immediately; `group` waits on Suspense — order matters.
+      target: "filters",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Focus on what matters",
+      description:
+        "Filter by provider, severity, service, and more to narrow down to the findings you care about.",
+    },
+    {
+      target: "group",
+      side: TOUR_STEP_SIDES.TOP,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Open a finding group",
+      description:
+        "Each row groups related findings from a single check. Continue and we'll open the first one for you.",
+    },
+    {
+      target: "resources",
+      side: TOUR_STEP_SIDES.TOP,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Review the affected resources",
+      description:
+        "These are the resources flagged by the check. Click any row to inspect the finding details and how to remediate it.",
+    },
+  ],
+});
+
+// Step handlers are passed to `useDriverTour` at consumption time (not part of `TourDefinition`).
+// `group` opens the first finding group and waits for the resources panel before advancing.
+export function createExploreFindingsTourStepHandlers(
+  openFirstGroup: () => boolean,
+): {
+  [K in ExploreFindingsTourTarget]?: TourStepHandlers<ExploreFindingsTourTarget>;
+} {
+  return {
+    [EXPLORE_FINDINGS_TOUR_TARGETS.GROUP]: {
+      onNext: async ({ waitForStep }) => {
+        // No drillable group → skip the wait so the tour doesn't hang; driver advances next.
+        if (!openFirstGroup()) return;
+        await waitForStep(EXPLORE_FINDINGS_TOUR_TARGETS.RESOURCES);
+      },
+    },
+  };
+}
diff --git a/ui/lib/tours/store/local-storage-adapter.test.ts b/ui/lib/tours/store/local-storage-adapter.test.ts
new file mode 100644
index 0000000000..d58ef9a0f1
--- /dev/null
+++ b/ui/lib/tours/store/local-storage-adapter.test.ts
@@ -0,0 +1,104 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { TOUR_COMPLETION_STATES } from "../tour-types";
+
+import { buildStorageKey, localStorageAdapter } from "./local-storage-adapter";
+
+const TOUR_ID = { id: "attack-paths", version: 1 };
+// All tour records share one key as a single object — no per-tour proliferation.
+const STORAGE_KEY = "prowler.tours";
+
+const sampleRecord = {
+  tourId: "attack-paths",
+  version: 1,
+  state: TOUR_COMPLETION_STATES.COMPLETED,
+  completedAt: "2026-01-15T12:34:56.000Z",
+} as const;
+
+describe("buildStorageKey", () => {
+  it("composes the field key for the tours object", () => {
+    expect(buildStorageKey({ id: "attack-paths", version: 1 })).toBe(
+      "attack-paths.v1",
+    );
+  });
+
+  it("renders multi-digit versions verbatim", () => {
+    expect(buildStorageKey({ id: "lighthouse", version: 42 })).toBe(
+      "lighthouse.v42",
+    );
+  });
+});
+
+describe("localStorageAdapter", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+  });
+
+  afterEach(() => {
+    window.localStorage.clear();
+  });
+
+  it("set/get round-trips a record inside the single tours object", () => {
+    localStorageAdapter.set(TOUR_ID, sampleRecord);
+
+    const raw = window.localStorage.getItem(STORAGE_KEY);
+    expect(raw).not.toBeNull();
+    expect(JSON.parse(raw as string)).toEqual({
+      "attack-paths.v1": sampleRecord,
+    });
+
+    const fetched = localStorageAdapter.get(TOUR_ID);
+    expect(fetched).toEqual(sampleRecord);
+  });
+
+  it("stores every tour under one localStorage key", () => {
+    localStorageAdapter.set(TOUR_ID, sampleRecord);
+    localStorageAdapter.set({ id: "add-provider", version: 1 }, sampleRecord);
+
+    expect(window.localStorage.length).toBe(1);
+    expect(window.localStorage.key(0)).toBe(STORAGE_KEY);
+  });
+
+  it("returns null when no record exists for that (id, version)", () => {
+    expect(localStorageAdapter.get(TOUR_ID)).toBeNull();
+  });
+
+  it("isolates records by version under the same id", () => {
+    localStorageAdapter.set(TOUR_ID, sampleRecord);
+
+    const v2Record = { ...sampleRecord, version: 2 };
+    localStorageAdapter.set({ id: TOUR_ID.id, version: 2 }, v2Record);
+
+    expect(localStorageAdapter.get(TOUR_ID)).toEqual(sampleRecord);
+    expect(localStorageAdapter.get({ id: TOUR_ID.id, version: 2 })).toEqual(
+      v2Record,
+    );
+  });
+
+  it("clear() removes only the matching record", () => {
+    localStorageAdapter.set(TOUR_ID, sampleRecord);
+    localStorageAdapter.set({ id: "other", version: 1 }, sampleRecord);
+
+    localStorageAdapter.clear(TOUR_ID);
+
+    expect(localStorageAdapter.get(TOUR_ID)).toBeNull();
+    expect(localStorageAdapter.get({ id: "other", version: 1 })).toEqual(
+      sampleRecord,
+    );
+  });
+
+  it("returns null when the stored object is malformed JSON", () => {
+    window.localStorage.setItem(STORAGE_KEY, "{not json");
+
+    expect(localStorageAdapter.get(TOUR_ID)).toBeNull();
+  });
+
+  it("returns null when the stored record is missing required fields", () => {
+    window.localStorage.setItem(
+      STORAGE_KEY,
+      JSON.stringify({ "attack-paths.v1": { tourId: "attack-paths" } }),
+    );
+
+    expect(localStorageAdapter.get(TOUR_ID)).toBeNull();
+  });
+});
diff --git a/ui/lib/tours/store/local-storage-adapter.ts b/ui/lib/tours/store/local-storage-adapter.ts
new file mode 100644
index 0000000000..80154685a8
--- /dev/null
+++ b/ui/lib/tours/store/local-storage-adapter.ts
@@ -0,0 +1,71 @@
+import type { TourCompletionRecord, TourId } from "../tour-types";
+
+import type { TourCompletionStore } from "./tour-completion-store";
+
+// All records share ONE localStorage key, keyed by `<id>.v<version>`.
+const STORAGE_KEY = "prowler.tours";
+
+type ToursObject = Record<string, TourCompletionRecord>;
+
+export function buildStorageKey({ id, version }: TourId): string {
+  return `${id}.v${version}`;
+}
+
+function isValidRecord(value: unknown): value is TourCompletionRecord {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value as Partial<TourCompletionRecord>;
+  return (
+    typeof record.tourId === "string" &&
+    typeof record.version === "number" &&
+    typeof record.state === "string" &&
+    typeof record.completedAt === "string"
+  );
+}
+
+function readAll(): ToursObject {
+  if (typeof window === "undefined") return {};
+
+  let raw: string | null;
+  try {
+    raw = window.localStorage.getItem(STORAGE_KEY);
+  } catch {
+    return {};
+  }
+  if (raw === null) return {};
+
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null) {
+      return parsed as ToursObject;
+    }
+    return {};
+  } catch {
+    return {};
+  }
+}
+
+function writeAll(tours: ToursObject): void {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(tours));
+  } catch {
+    // Non-fatal: a re-shown tour beats a thrown render.
+  }
+}
+
+export const localStorageAdapter: TourCompletionStore = {
+  get(id) {
+    const record = readAll()[buildStorageKey(id)];
+    return isValidRecord(record) ? record : null;
+  },
+  set(id, record) {
+    const tours = readAll();
+    tours[buildStorageKey(id)] = record;
+    writeAll(tours);
+  },
+  clear(id) {
+    const tours = readAll();
+    delete tours[buildStorageKey(id)];
+    writeAll(tours);
+  },
+};
diff --git a/ui/lib/tours/store/tour-completion-store.ts b/ui/lib/tours/store/tour-completion-store.ts
new file mode 100644
index 0000000000..4fd79258f7
--- /dev/null
+++ b/ui/lib/tours/store/tour-completion-store.ts
@@ -0,0 +1,8 @@
+import type { TourCompletionRecord, TourId } from "../tour-types";
+
+// Persistence backend contract; swap the adapter without touching consumers.
+export interface TourCompletionStore {
+  get(id: TourId): TourCompletionRecord | null;
+  set(id: TourId, record: TourCompletionRecord): void;
+  clear(id: TourId): void;
+}
diff --git a/ui/lib/tours/tour-config.test.ts b/ui/lib/tours/tour-config.test.ts
new file mode 100644
index 0000000000..6676caa44e
--- /dev/null
+++ b/ui/lib/tours/tour-config.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  baseDriverConfig,
+  getDriverConfig,
+  TOUR_OVERLAY_COLORS,
+  TOUR_THEMES,
+} from "./tour-config";
+
+describe("getDriverConfig", () => {
+  it("returns dark overlay color for the dark theme", () => {
+    const config = getDriverConfig(TOUR_THEMES.DARK);
+    expect(config.overlayColor).toBe(TOUR_OVERLAY_COLORS[TOUR_THEMES.DARK]);
+  });
+
+  it("returns light overlay color for the light theme", () => {
+    const config = getDriverConfig(TOUR_THEMES.LIGHT);
+    expect(config.overlayColor).toBe(TOUR_OVERLAY_COLORS[TOUR_THEMES.LIGHT]);
+  });
+
+  it("preserves base config defaults when no overrides are passed", () => {
+    const config = getDriverConfig(TOUR_THEMES.LIGHT);
+
+    expect(config.popoverClass).toBe("prowler-theme");
+    expect(config.showProgress).toBe(true);
+    expect(config.progressText).toBe("Step {{current}} of {{total}}");
+    expect(config.prevBtnText).toBe("Back");
+    expect(config.doneBtnText).toBe("Got it");
+    expect(config.stagePadding).toBe(baseDriverConfig.stagePadding);
+  });
+
+  it("merges overrides on top of the base config", () => {
+    const config = getDriverConfig(TOUR_THEMES.LIGHT, {
+      stagePadding: 24,
+      doneBtnText: "Finish",
+    });
+
+    expect(config.stagePadding).toBe(24);
+    expect(config.doneBtnText).toBe("Finish");
+    expect(config.popoverClass).toBe("prowler-theme");
+  });
+
+  it("lets overrides win over the theme-derived overlayColor", () => {
+    const config = getDriverConfig(TOUR_THEMES.LIGHT, {
+      overlayColor: "#abcdef",
+    });
+
+    expect(config.overlayColor).toBe("#abcdef");
+  });
+
+  it("does not mutate the shared baseDriverConfig", () => {
+    const snapshot = { ...baseDriverConfig };
+    getDriverConfig(TOUR_THEMES.DARK, { stagePadding: 99 });
+    expect(baseDriverConfig).toEqual(snapshot);
+  });
+});
diff --git a/ui/lib/tours/tour-config.ts b/ui/lib/tours/tour-config.ts
new file mode 100644
index 0000000000..d7c2ce851f
--- /dev/null
+++ b/ui/lib/tours/tour-config.ts
@@ -0,0 +1,50 @@
+import type { Config } from "driver.js";
+
+import { renderTourPopover } from "./tour-popover-render";
+
+export const TOUR_THEMES = {
+  LIGHT: "light",
+  DARK: "dark",
+} as const;
+
+export type TourTheme = (typeof TOUR_THEMES)[keyof typeof TOUR_THEMES];
+
+export const TOUR_OVERLAY_COLORS = {
+  [TOUR_THEMES.LIGHT]: "#0f172a",
+  [TOUR_THEMES.DARK]: "#0a0a0a",
+} as const;
+
+// Per-step overrides go on the step; per-tour overrides merge in via getDriverConfig.
+export const baseDriverConfig: Config = {
+  popoverClass: "prowler-theme",
+  animate: true,
+  smoothScroll: true,
+  allowClose: true,
+  overlayClickBehavior: "close",
+  overlayOpacity: 0.72,
+  stagePadding: 10,
+  stageRadius: 10,
+  popoverOffset: 12,
+  showButtons: ["next", "previous", "close"],
+  showProgress: true,
+  progressText: "Step {{current}} of {{total}}",
+  nextBtnText: "Next",
+  prevBtnText: "Back",
+  doneBtnText: "Got it",
+  allowKeyboardControl: true,
+  disableActiveInteraction: false,
+  onPopoverRender: renderTourPopover,
+};
+
+// driver.js exposes `overlayColor` only via JS (no CSS variable hook), so the
+// theme is resolved at the call site and passed in here.
+export function getDriverConfig(
+  theme: TourTheme,
+  overrides?: Partial<Config>,
+): Config {
+  return {
+    ...baseDriverConfig,
+    overlayColor: TOUR_OVERLAY_COLORS[theme],
+    ...(overrides ?? {}),
+  };
+}
diff --git a/ui/lib/tours/tour-popover-render.test.tsx b/ui/lib/tours/tour-popover-render.test.tsx
new file mode 100644
index 0000000000..598f7f8bab
--- /dev/null
+++ b/ui/lib/tours/tour-popover-render.test.tsx
@@ -0,0 +1,139 @@
+import { act, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { PopoverDOM } from "driver.js";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  renderTourPopover,
+  unmountActiveTourPopover,
+} from "./tour-popover-render";
+
+function createPopover(): PopoverDOM {
+  const wrapper = document.createElement("div");
+  const arrow = document.createElement("div");
+  const title = document.createElement("header");
+  const description = document.createElement("div");
+  const footer = document.createElement("footer");
+  const progress = document.createElement("span");
+  const previousButton = document.createElement("button");
+  const nextButton = document.createElement("button");
+  const closeButton = document.createElement("button");
+  const footerButtons = document.createElement("span");
+
+  title.textContent = "Explore findings";
+  description.textContent = "Review grouped findings and resources.";
+  progress.textContent = "Step 2 of 4";
+  previousButton.textContent = "Back";
+  nextButton.textContent = "Next";
+  closeButton.setAttribute("aria-label", "Close");
+
+  wrapper.append(title, description, footer, closeButton, arrow);
+  footer.append(progress, footerButtons);
+  footerButtons.append(previousButton, nextButton);
+  document.body.appendChild(wrapper);
+
+  return {
+    wrapper,
+    arrow,
+    title,
+    description,
+    footer,
+    progress,
+    previousButton,
+    nextButton,
+    closeButton,
+    footerButtons,
+  };
+}
+
+describe("renderTourPopover", () => {
+  afterEach(() => {
+    act(() => unmountActiveTourPopover());
+    document.body.innerHTML = "";
+  });
+
+  it("renders tour UI with existing app components", async () => {
+    // Given
+    const popover = createPopover();
+
+    // When
+    await act(async () => renderTourPopover(popover));
+    const tourUi = within(
+      popover.wrapper.querySelector<HTMLElement>("[data-tour-popover-root]")!,
+    );
+
+    // Then
+    expect(tourUi.getByText("Explore findings")).toBeVisible();
+    expect(
+      tourUi.getByText("Review grouped findings and resources."),
+    ).toBeVisible();
+    expect(tourUi.getByText("Step 2 of 4")).toBeVisible();
+    expect(tourUi.getByRole("progressbar")).toHaveAttribute(
+      "aria-valuenow",
+      "50",
+    );
+    expect(tourUi.getByText("Explore findings")).toHaveAttribute(
+      "data-slot",
+      "card-title",
+    );
+    expect(tourUi.getByRole("button", { name: "Next" })).toHaveAttribute(
+      "data-slot",
+      "button",
+    );
+    expect(popover.title).not.toBeVisible();
+    expect(popover.footer).not.toBeVisible();
+  });
+
+  it("renders synchronously so driver.js measures the real card dimensions", () => {
+    // Given
+    const popover = createPopover();
+
+    // When
+    renderTourPopover(popover);
+
+    // Then
+    expect(
+      popover.wrapper.querySelector('[data-slot="card"]'),
+    ).toBeInTheDocument();
+  });
+
+  it("applies the onboarding popover styling on the card and its slots", async () => {
+    // Given
+    const popover = createPopover();
+
+    // When
+    await act(async () => renderTourPopover(popover));
+
+    // Then — styling lives at this callsite, not in a shared Card variant.
+    const card = popover.wrapper.querySelector('[data-slot="card"]')!;
+    expect(card).toHaveClass("gap-0");
+    expect(card).toHaveClass("shadow-lg");
+    const footer = popover.wrapper.querySelector('[data-slot="card-footer"]')!;
+    expect(footer).toHaveClass("justify-end");
+    expect(footer).toHaveClass("gap-2");
+    expect(footer).toHaveClass("px-0");
+  });
+
+  it("delegates visible button clicks to driver.js native controls", async () => {
+    // Given
+    const user = userEvent.setup();
+    const popover = createPopover();
+    const onPrevious = vi.fn();
+    const onNext = vi.fn();
+    const onClose = vi.fn();
+    popover.previousButton.addEventListener("click", onPrevious);
+    popover.nextButton.addEventListener("click", onNext);
+    popover.closeButton.addEventListener("click", onClose);
+    await act(async () => renderTourPopover(popover));
+
+    // When
+    await user.click(screen.getByRole("button", { name: "Back" }));
+    await user.click(screen.getByRole("button", { name: "Next" }));
+    await user.click(screen.getByRole("button", { name: "Close" }));
+
+    // Then
+    expect(onPrevious).toHaveBeenCalledTimes(1);
+    expect(onNext).toHaveBeenCalledTimes(1);
+    expect(onClose).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/ui/lib/tours/tour-popover-render.tsx b/ui/lib/tours/tour-popover-render.tsx
new file mode 100644
index 0000000000..5dc2bbd19d
--- /dev/null
+++ b/ui/lib/tours/tour-popover-render.tsx
@@ -0,0 +1,197 @@
+"use client";
+
+import type { PopoverDOM } from "driver.js";
+import { XIcon } from "lucide-react";
+import { flushSync } from "react-dom";
+import { createRoot, type Root } from "react-dom/client";
+
+import {
+  Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardFooter,
+  CardHeader,
+  CardTitle,
+  Progress,
+} from "@/components/shadcn";
+
+interface TourPopoverProps {
+  title: string;
+  description: string;
+  progressText: string;
+  progressValue: number;
+  previousLabel: string;
+  nextLabel: string;
+  closeLabel: string;
+  showPrevious: boolean;
+  showNext: boolean;
+  showClose: boolean;
+  previousDisabled: boolean;
+  onPrevious: () => void;
+  onNext: () => void;
+  onClose: () => void;
+}
+
+let activeRoot: Root | null = null;
+let activeWrapper: HTMLElement | null = null;
+
+function isDisplayed(element: HTMLElement): boolean {
+  return element.style.display !== "none";
+}
+
+function parseProgressValue(progressText: string): number {
+  const match = progressText.match(/(\d+)\D+(\d+)/);
+  if (!match) return 0;
+
+  const current = Number(match[1]);
+  const total = Number(match[2]);
+  if (total <= 0) return 0;
+
+  return Math.min(100, Math.max(0, (current / total) * 100));
+}
+
+function getText(element: HTMLElement, fallback: string): string {
+  const text = element.textContent?.trim();
+  return text && text.length > 0 ? text : fallback;
+}
+
+function hideDriverPopoverDom(popover: PopoverDOM) {
+  popover.title.hidden = true;
+  popover.description.hidden = true;
+  popover.footer.hidden = true;
+  popover.closeButton.hidden = true;
+  popover.arrow.hidden = true;
+}
+
+function getOrCreateMount(popover: PopoverDOM): HTMLElement {
+  const existing = popover.wrapper.querySelector<HTMLElement>(
+    "[data-tour-popover-root]",
+  );
+  if (existing) {
+    existing.style.width = "100%";
+    return existing;
+  }
+
+  const mount = document.createElement("div");
+  mount.dataset.tourPopoverRoot = "";
+  mount.style.width = "100%";
+  popover.wrapper.appendChild(mount);
+  return mount;
+}
+
+function TourPopover({
+  title,
+  description,
+  progressText,
+  progressValue,
+  previousLabel,
+  nextLabel,
+  closeLabel,
+  showPrevious,
+  showNext,
+  showClose,
+  previousDisabled,
+  onPrevious,
+  onNext,
+  onClose,
+}: TourPopoverProps) {
+  return (
+    <Card variant="inner" className="gap-0 shadow-lg">
+      <CardHeader className="mb-4">
+        <CardTitle className="text-base leading-snug">{title}</CardTitle>
+        {showClose ? (
+          <CardAction>
+            <Button
+              aria-label={closeLabel}
+              size="icon-xs"
+              variant="bare"
+              onClick={onClose}
+            >
+              <XIcon aria-hidden="true" />
+            </Button>
+          </CardAction>
+        ) : null}
+        {description ? (
+          <CardDescription className="mt-2 text-xs leading-relaxed">
+            {description}
+          </CardDescription>
+        ) : null}
+      </CardHeader>
+      <CardContent className="mt-2">
+        {progressText ? (
+          <>
+            <CardDescription className="mt-2 text-xs leading-relaxed">
+              {progressText}
+            </CardDescription>
+            <Progress value={progressValue} />
+          </>
+        ) : null}
+      </CardContent>
+      <CardFooter className="mt-4 justify-end gap-2 px-0">
+        {showPrevious ? (
+          <Button
+            disabled={previousDisabled}
+            size="sm"
+            // Match the app's modal secondary action (e.g. Launch Scan's Cancel).
+            variant="outline"
+            onClick={onPrevious}
+          >
+            {previousLabel}
+          </Button>
+        ) : null}
+        {showNext ? (
+          <Button size="sm" onClick={onNext}>
+            {nextLabel}
+          </Button>
+        ) : null}
+      </CardFooter>
+    </Card>
+  );
+}
+
+export function unmountActiveTourPopover() {
+  activeRoot?.unmount();
+  activeRoot = null;
+  activeWrapper = null;
+}
+
+export function renderTourPopover(popover: PopoverDOM) {
+  if (activeWrapper !== popover.wrapper) {
+    unmountActiveTourPopover();
+  }
+
+  hideDriverPopoverDom(popover);
+
+  const mount = getOrCreateMount(popover);
+  activeRoot = activeRoot ?? createRoot(mount);
+  activeWrapper = popover.wrapper;
+
+  const progressText = isDisplayed(popover.progress)
+    ? getText(popover.progress, "")
+    : "";
+
+  flushSync(() => {
+    activeRoot?.render(
+      <TourPopover
+        title={getText(popover.title, "")}
+        description={getText(popover.description, "")}
+        progressText={progressText}
+        progressValue={parseProgressValue(progressText)}
+        previousLabel={getText(popover.previousButton, "Back")}
+        nextLabel={getText(popover.nextButton, "Next")}
+        closeLabel={popover.closeButton.getAttribute("aria-label") ?? "Close"}
+        showPrevious={isDisplayed(popover.previousButton)}
+        showNext={isDisplayed(popover.nextButton)}
+        showClose={isDisplayed(popover.closeButton)}
+        previousDisabled={popover.previousButton.disabled}
+        onPrevious={() => {
+          if (!popover.previousButton.disabled) popover.previousButton.click();
+        }}
+        onNext={() => popover.nextButton.click()}
+        onClose={() => popover.closeButton.click()}
+      />,
+    );
+  });
+}
diff --git a/ui/lib/tours/tour-types.ts b/ui/lib/tours/tour-types.ts
new file mode 100644
index 0000000000..d443f21489
--- /dev/null
+++ b/ui/lib/tours/tour-types.ts
@@ -0,0 +1,91 @@
+// Import from this module — never from `driver.js` directly — to keep the
+// library a swappable implementation detail.
+
+export const TOUR_COMPLETION_STATES = {
+  COMPLETED: "completed",
+  SKIPPED: "skipped",
+  DISMISSED: "dismissed",
+} as const;
+
+export type TourCompletionState =
+  (typeof TOUR_COMPLETION_STATES)[keyof typeof TOUR_COMPLETION_STATES];
+
+export const TOUR_STEP_SIDES = {
+  TOP: "top",
+  RIGHT: "right",
+  BOTTOM: "bottom",
+  LEFT: "left",
+  OVER: "over",
+} as const;
+
+export type TourStepSide =
+  (typeof TOUR_STEP_SIDES)[keyof typeof TOUR_STEP_SIDES];
+
+export const TOUR_STEP_ALIGNMENTS = {
+  START: "start",
+  CENTER: "center",
+  END: "end",
+} as const;
+
+export type TourStepAlignment =
+  (typeof TOUR_STEP_ALIGNMENTS)[keyof typeof TOUR_STEP_ALIGNMENTS];
+
+export interface TourId {
+  id: string;
+  version: number;
+}
+
+export interface TourCompletionRecord {
+  tourId: string;
+  version: number;
+  state: TourCompletionState;
+  completedAt: string;
+}
+
+// Modal step omits `target`; anchored step provides the `data-tour-id` value (no brackets).
+export interface TourStep<TTarget extends string = string> {
+  target?: TTarget;
+  title?: string;
+  description?: string;
+  side?: TourStepSide;
+  align?: TourStepAlignment;
+  disableActiveInteraction?: boolean;
+  // Step with no Next/Back buttons (only Close); the flow advances via imperative
+  // `advanceActiveTour()` calls from the covered UI instead of popover clicks. Used
+  // when progress is driven by a user action (e.g. picking a provider type) rather
+  // than the tour's own button.
+  autoAdvance?: boolean;
+}
+
+// `coversFiles` is consumed by the `prowler-tour` skill to scope drift checks.
+export interface TourDefinition<TTarget extends string = string> {
+  id: string;
+  version: number;
+  coversFiles: readonly string[];
+  steps: ReadonlyArray<TourStep<TTarget>>;
+}
+
+// `waitForStep` resolves when `data-tour-id="<tour-id>-<target>"` appears in the document.
+export interface TourStepHandlerContext<TTarget extends string = string> {
+  waitForStep: (
+    target: TTarget,
+    options?: WaitForStepOptions,
+  ) => Promise<Element>;
+}
+
+export interface WaitForStepOptions {
+  timeoutMs?: number;
+}
+
+// Overrides driver.js's default Next/Back for the step it's registered on.
+export interface TourStepHandlers<TTarget extends string = string> {
+  onNext?: (context: TourStepHandlerContext<TTarget>) => void | Promise<void>;
+  onPrev?: (context: TourStepHandlerContext<TTarget>) => void | Promise<void>;
+}
+
+// Use instead of `: TourDefinition` to preserve literal step targets for `stepHandlers`/`waitForStep` validation.
+export function defineTour<const TTarget extends string>(
+  definition: TourDefinition<TTarget>,
+): TourDefinition<TTarget> {
+  return definition;
+}
diff --git a/ui/lib/tours/use-driver-tour.ts b/ui/lib/tours/use-driver-tour.ts
new file mode 100644
index 0000000000..a0ab78523b
--- /dev/null
+++ b/ui/lib/tours/use-driver-tour.ts
@@ -0,0 +1,401 @@
+"use client";
+
+// driver.js's own stylesheet provides the overlay/stage geometry and base popover
+// positioning. tours.css only themes on top of it (strips the popover chrome so our
+// React card shows). Without this import the spotlight and popover placement break.
+import "driver.js/dist/driver.css";
+
+import { type Config, type Driver, driver, type DriveStep } from "driver.js";
+import { useTheme } from "next-themes";
+import { useEffect, useRef } from "react";
+
+import { localStorageAdapter } from "./store/local-storage-adapter";
+import type { TourCompletionStore } from "./store/tour-completion-store";
+import { getDriverConfig, type TourTheme } from "./tour-config";
+import { unmountActiveTourPopover } from "./tour-popover-render";
+import {
+  TOUR_COMPLETION_STATES,
+  type TourCompletionRecord,
+  type TourDefinition,
+  type TourStep,
+  type TourStepHandlerContext,
+  type TourStepHandlers,
+  type WaitForStepOptions,
+} from "./tour-types";
+
+const AUTO_OPEN_DELAY_MS = 50;
+const DEFAULT_WAIT_TIMEOUT_MS = 8000;
+
+// Handle to the tour that is currently driving. driver.js permits a single active
+// tour at a time, so one module-level ref is enough. It lets imperative callers
+// outside the tour's React subtree end it — e.g. the provider wizard ends the
+// add-provider tour once the user advances past the anchored step, so driver.js's
+// overlay stops applying `pointer-events: none` to the rest of the wizard's inputs.
+let activeTourInstance: Driver | null = null;
+
+/** Ends whatever tour is currently driving. No-op when none is active. */
+export function endActiveTour(): void {
+  const instance = activeTourInstance;
+  activeTourInstance = null;
+  if (!instance?.isActive()) return;
+  // Defer out of React's render/commit cycle: destroy() synchronously unmounts the
+  // popover's React root (see tour-popover-render), and React 19 throws if that
+  // happens mid-render — e.g. when this is called from an effect reacting to a
+  // provider-type selection. The microtask runs before paint, so no visible flash.
+  queueMicrotask(() => {
+    if (instance.isActive()) instance.destroy();
+  });
+}
+
+/**
+ * Advances the currently driving tour by one step. No-op when none is active or
+ * the tour is already on its last step. Used to drive `autoAdvance` steps — those
+ * have no Next button, so the covered UI moves the tour forward when the user takes
+ * the expected action (e.g. the provider wizard advances past the provider-type
+ * step once a type is picked).
+ */
+export function advanceActiveTour(): void {
+  const instance = activeTourInstance;
+  if (!instance?.isActive()) return;
+  // Same React-19 reason as endActiveTour: moveNext re-renders the popover via
+  // flushSync, which throws if called mid-render (this fires from a change handler).
+  // Idempotent: re-checking isActive/isLastStep inside the microtask means repeat
+  // calls after reaching the final step are no-ops, never overshooting.
+  queueMicrotask(() => {
+    if (instance.isActive() && !instance.isLastStep()) instance.moveNext();
+  });
+}
+
+/**
+ * Advances the active tour once `targetSelector` appears in the DOM. Used when the
+ * next step anchors to an element that mounts asynchronously after a user action —
+ * e.g. clicking "Add a Provider" opens the wizard, and the provider-type anchor only
+ * exists once the modal renders. No-op when no tour is active; silently gives up if
+ * the element never mounts (e.g. the modal was closed again).
+ */
+export function advanceActiveTourWhenReady(targetSelector: string): void {
+  const instance = activeTourInstance;
+  if (!instance?.isActive()) return;
+  waitForElement(targetSelector)
+    .then(() => {
+      // .then is already off the render path, so moveNext()'s flushSync is safe here
+      // (same pattern as the step onNext handlers below).
+      if (instance.isActive() && !instance.isLastStep()) instance.moveNext();
+    })
+    .catch(() => {
+      // Target never appeared (e.g. the wizard was dismissed); leave the tour as-is.
+    });
+}
+
+export interface UseDriverTourOptions<TTarget extends string = string> {
+  /** Auto-open on mount when no completion record exists. Defaults to true. */
+  autoOpen?: boolean;
+  /** Gate that delays initialization until anchored DOM is ready. Defaults to true. */
+  enabled?: boolean;
+  /** Defaults to `localStorageAdapter`. */
+  store?: TourCompletionStore;
+  configOverrides?: Partial<Config>;
+  /** Indexed by step `target`; overrides driver.js's default Next/Back for that step. */
+  stepHandlers?: { [K in TTarget]?: TourStepHandlers<TTarget> };
+  /** Fired after persist when the tour is destroyed; invoked via ref so identity changes don't recreate the driver. */
+  onClosed?: (state: TourCompletionRecord["state"]) => void;
+}
+
+export interface UseDriverTourResult {
+  start: () => void;
+  stop: () => void;
+  /** True if a completion record exists for `(tour.id, tour.version)`. */
+  hasCompleted: boolean;
+}
+
+function resolveTheme(resolvedTheme: string | undefined): TourTheme {
+  return resolvedTheme === "dark" ? "dark" : "light";
+}
+
+function toSelector(target: string): string {
+  return `[data-tour-id="${target}"]`;
+}
+
+/** Builds the `[data-tour-id="<tourId>-<target>"]` selector for a step's anchor. */
+export function getTourTargetSelector(tourId: string, target: string): string {
+  return toSelector(`${tourId}-${target}`);
+}
+
+function waitForElement(
+  selector: string,
+  options: WaitForStepOptions = {},
+): Promise<Element> {
+  const { timeoutMs = DEFAULT_WAIT_TIMEOUT_MS } = options;
+  if (typeof document === "undefined") {
+    return Promise.reject(new Error("waitForElement called without a DOM"));
+  }
+
+  const existing = document.querySelector(selector);
+  if (existing) return Promise.resolve(existing);
+
+  return new Promise((resolve, reject) => {
+    const observer = new MutationObserver(() => {
+      const found = document.querySelector(selector);
+      if (found) {
+        observer.disconnect();
+        window.clearTimeout(timer);
+        resolve(found);
+      }
+    });
+
+    observer.observe(document.body, { childList: true, subtree: true });
+
+    const timer = window.setTimeout(() => {
+      observer.disconnect();
+      reject(
+        new Error(
+          `Tour element ${selector} did not appear within ${timeoutMs}ms`,
+        ),
+      );
+    }, timeoutMs);
+  });
+}
+
+// Exported for unit testing the step → driver.js mapping (e.g. autoAdvance buttons).
+export function adaptStep<TTarget extends string>(
+  tourId: string,
+  step: TourStep<TTarget>,
+): DriveStep {
+  const driveStep: DriveStep = {
+    popover: {
+      title: step.title,
+      description: step.description,
+      side: step.side,
+      align: step.align,
+    },
+  };
+
+  if (step.target) {
+    const selector = toSelector(`${tourId}-${step.target}`);
+    driveStep.element = () => {
+      if (typeof document === "undefined") {
+        throw new Error("Tour element resolved without a DOM");
+      }
+      const found = document.querySelector(selector);
+      if (!found) {
+        throw new Error(
+          `Tour "${tourId}" references missing selector: ${selector}`,
+        );
+      }
+      return found;
+    };
+  }
+
+  if (step.disableActiveInteraction !== undefined) {
+    driveStep.disableActiveInteraction = step.disableActiveInteraction;
+  }
+
+  if (step.autoAdvance) {
+    // No Next/Back — only Close. driver.js hides the other buttons (display:none),
+    // so the React popover's showNext/showPrevious resolve false. The flow advances
+    // via advanceActiveTour() called imperatively from the covered UI.
+    driveStep.popover = { ...driveStep.popover, showButtons: ["close"] };
+  }
+
+  return driveStep;
+}
+
+function nowIso(): string {
+  return new Date().toISOString();
+}
+
+function buildHandlerContext<TTarget extends string>(
+  tourId: string,
+): TourStepHandlerContext<TTarget> {
+  return {
+    waitForStep: (target, options) =>
+      waitForElement(toSelector(`${tourId}-${target}`), options),
+  };
+}
+
+// Generic over `TTarget` so `stepHandlers` keys and `waitForStep` calls are type-checked against the tour's literal union.
+export function useDriverTour<TTarget extends string>(
+  tour: TourDefinition<TTarget>,
+  options: UseDriverTourOptions<TTarget> = {},
+): UseDriverTourResult {
+  const {
+    autoOpen = true,
+    enabled = true,
+    store = localStorageAdapter,
+    configOverrides,
+    stepHandlers,
+    onClosed,
+  } = options;
+
+  const { resolvedTheme } = useTheme();
+  const theme = resolveTheme(resolvedTheme);
+
+  const driverRef = useRef<Driver | null>(null);
+  const finalStateRef = useRef<TourCompletionRecord["state"]>(
+    TOUR_COMPLETION_STATES.DISMISSED,
+  );
+  // Widened internally: indexing `{ [K in TTarget]?: ... }` by a generic `TTarget` resolves to `never`.
+  const stepHandlersRef = useRef<
+    Record<string, TourStepHandlers<TTarget> | undefined> | undefined
+  >(stepHandlers as Record<string, TourStepHandlers<TTarget> | undefined>);
+  stepHandlersRef.current = stepHandlers as
+    | Record<string, TourStepHandlers<TTarget> | undefined>
+    | undefined;
+
+  // Stable ref — not in the effect dep array, so changing identity never recreates the driver.
+  const onClosedRef = useRef<
+    ((state: TourCompletionRecord["state"]) => void) | undefined
+  >(onClosed);
+  onClosedRef.current = onClosed;
+
+  // True while an involuntary teardown is in flight (theme re-render / unmount).
+  // driver.js's destroy() bypasses onDestroyStarted but still fires onDestroyed, so
+  // without this flag onDestroyed would persist the default DISMISSED record and the
+  // tour would be marked resolved forever after a simple theme toggle.
+  const teardownRef = useRef(false);
+
+  const tourId = tour.id;
+  const tourVersion = tour.version;
+  const existing = store.get({ id: tourId, version: tourVersion });
+  const hasCompleted = existing !== null;
+
+  useEffect(() => {
+    // Skip in vitest — the driver.js overlay would race click-through tests.
+    if (process.env.NODE_ENV === "test") return;
+    if (!enabled) return;
+    if (tour.steps.length === 0) return;
+
+    finalStateRef.current = TOUR_COMPLETION_STATES.DISMISSED;
+    const tourKey = { id: tourId, version: tourVersion };
+
+    const persist = (state: TourCompletionRecord["state"]) => {
+      store.set(tourKey, {
+        tourId,
+        version: tourVersion,
+        state,
+        completedAt: nowIso(),
+      });
+    };
+
+    const handlerContext = buildHandlerContext(tourId);
+
+    const steps: DriveStep[] = tour.steps.map((step) => {
+      const driveStep = adaptStep(tourId, step);
+      const target = step.target;
+      if (!target) return driveStep;
+
+      // Read handlers via ref so identity changes don't recreate the driver.
+      driveStep.popover = {
+        ...driveStep.popover,
+        onNextClick: (_element, _step, { driver: instance }) => {
+          const handler = stepHandlersRef.current?.[target]?.onNext;
+          if (!handler) {
+            instance.moveNext();
+            return;
+          }
+          Promise.resolve(handler(handlerContext))
+            .then(() => {
+              if (instance.isActive()) instance.moveNext();
+            })
+            .catch((err) => {
+              console.error(
+                `Tour "${tourId}" step "${target}" onNext failed:`,
+                err,
+              );
+              if (instance.isActive()) instance.destroy();
+            });
+        },
+        onPrevClick: (_element, _step, { driver: instance }) => {
+          const handler = stepHandlersRef.current?.[target]?.onPrev;
+          if (!handler) {
+            instance.movePrevious();
+            return;
+          }
+          Promise.resolve(handler(handlerContext))
+            .then(() => {
+              if (instance.isActive()) instance.movePrevious();
+            })
+            .catch((err) => {
+              console.error(
+                `Tour "${tourId}" step "${target}" onPrev failed:`,
+                err,
+              );
+              if (instance.isActive()) instance.destroy();
+            });
+        },
+      };
+
+      return driveStep;
+    });
+
+    const config = getDriverConfig(theme, {
+      ...configOverrides,
+      steps,
+      onDestroyStarted: (_element, _step, { driver: instance }) => {
+        if (instance.isLastStep()) {
+          finalStateRef.current = TOUR_COMPLETION_STATES.COMPLETED;
+        } else {
+          finalStateRef.current = TOUR_COMPLETION_STATES.SKIPPED;
+        }
+        instance.destroy();
+      },
+      onDestroyed: () => {
+        unmountActiveTourPopover();
+        if (activeTourInstance === driverRef.current) {
+          activeTourInstance = null;
+        }
+        // Involuntary teardown: close the tour without recording a resolution so it
+        // can reappear later (e.g. the user just switched theme mid-tour).
+        if (teardownRef.current) {
+          teardownRef.current = false;
+          return;
+        }
+        persist(finalStateRef.current);
+        onClosedRef.current?.(finalStateRef.current);
+      },
+    });
+
+    driverRef.current = driver(config);
+
+    return () => {
+      const instance = driverRef.current;
+      if (instance?.isActive()) {
+        teardownRef.current = true;
+        instance.destroy();
+      }
+      unmountActiveTourPopover();
+      driverRef.current = null;
+    };
+  }, [theme, tour, tourId, tourVersion, enabled, store, configOverrides]);
+
+  useEffect(() => {
+    // Skip in vitest — the driver.js overlay would race click-through tests.
+    if (process.env.NODE_ENV === "test") return;
+    if (!enabled || !autoOpen || hasCompleted) return;
+
+    const instance = driverRef.current;
+    if (!instance || instance.isActive()) return;
+
+    const timer = window.setTimeout(() => {
+      if (!instance.isActive()) {
+        activeTourInstance = instance;
+        instance.drive();
+      }
+    }, AUTO_OPEN_DELAY_MS);
+
+    return () => {
+      window.clearTimeout(timer);
+    };
+  }, [autoOpen, enabled, hasCompleted, tourId, tourVersion]);
+
+  return {
+    start: () => {
+      const instance = driverRef.current;
+      if (!instance) return;
+      activeTourInstance = instance;
+      instance.drive();
+    },
+    stop: () => driverRef.current?.destroy(),
+    hasCompleted,
+  };
+}
diff --git a/ui/lib/tours/use-tour-completion.ts b/ui/lib/tours/use-tour-completion.ts
new file mode 100644
index 0000000000..70a685fde4
--- /dev/null
+++ b/ui/lib/tours/use-tour-completion.ts
@@ -0,0 +1,36 @@
+"use client";
+
+import { useSyncExternalStore } from "react";
+
+import { localStorageAdapter } from "./store/local-storage-adapter";
+import type { TourCompletionRecord, TourId } from "./tour-types";
+
+// Subscribes to cross-tab storage events only; same-tab writes manage their own state.
+function subscribe(callback: () => void): () => void {
+  if (typeof window === "undefined") return () => {};
+  window.addEventListener("storage", callback);
+  return () => window.removeEventListener("storage", callback);
+}
+
+// `localStorageAdapter.get` re-parses JSON each call; cache by serialized form to keep snapshot reference-stable.
+const recordCache = new Map<string, TourCompletionRecord | null>();
+const serializedCache = new Map<string, string | null>();
+
+// Server snapshot is `null` (no localStorage), avoiding hydration mismatch.
+export function useTourCompletion(
+  tour: TourId | null,
+): TourCompletionRecord | null {
+  const getSnapshot = (): TourCompletionRecord | null => {
+    if (!tour) return null;
+    const cacheKey = `${tour.id}.v${tour.version}`;
+    const record = localStorageAdapter.get(tour);
+    const serialized = record ? JSON.stringify(record) : null;
+    if (serializedCache.get(cacheKey) !== serialized) {
+      serializedCache.set(cacheKey, serialized);
+      recordCache.set(cacheKey, record);
+    }
+    return recordCache.get(cacheKey) ?? null;
+  };
+
+  return useSyncExternalStore(subscribe, getSnapshot, () => null);
+}
diff --git a/ui/lib/tours/view-compliance.tour.ts b/ui/lib/tours/view-compliance.tour.ts
new file mode 100644
index 0000000000..5aa23c77ca
--- /dev/null
+++ b/ui/lib/tours/view-compliance.tour.ts
@@ -0,0 +1,76 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+  type TourStepHandlers,
+} from "./tour-types";
+
+// Const map keeps the union narrow so `useDriverTour` can validate step keys.
+export const VIEW_COMPLIANCE_TOUR_TARGETS = {
+  FRAMEWORKS: "frameworks",
+  SEARCH: "search",
+} as const;
+
+export type ViewComplianceTourTarget =
+  (typeof VIEW_COMPLIANCE_TOUR_TARGETS)[keyof typeof VIEW_COMPLIANCE_TOUR_TARGETS];
+
+export const viewComplianceTour = defineTour<ViewComplianceTourTarget>({
+  id: "view-compliance",
+  version: 1,
+  coversFiles: [
+    "ui/app/(prowler)/compliance/**",
+    "ui/components/compliance/**",
+  ],
+  steps: [
+    {
+      title: "Check your compliance",
+      description:
+        "Compliance maps your findings to frameworks like CIS so you can see where you stand against each standard.",
+    },
+    {
+      target: "search",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Find a framework fast",
+      description:
+        "Search by name to jump straight to a specific framework instead of scrolling through every card.",
+    },
+    {
+      target: "frameworks",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Browse the frameworks",
+      description:
+        "Each card is a framework with your passed and total requirement counts. Continue and we'll open the first one so you can drill into its requirements.",
+    },
+  ],
+});
+
+// Step handlers are passed to `useDriverTour` at consumption time (not part of `TourDefinition`).
+// `search` resets the query so the frameworks anchor is back in the DOM (an empty result
+// set unmounts every card, including the anchored one, and breaks navigation otherwise).
+// `frameworks` is the last step: opening the card navigates to the detail route, and the
+// tour is destroyed as completed (persisted synchronously) before the grid unmounts.
+export function createViewComplianceTourStepHandlers(handlers: {
+  /** Clears the search box; returns false when no framework card will render. */
+  resetSearch: () => boolean;
+  /** Opens the first framework card's detail page. */
+  openFirstFramework: () => void;
+}): {
+  [K in ViewComplianceTourTarget]?: TourStepHandlers<ViewComplianceTourTarget>;
+} {
+  return {
+    [VIEW_COMPLIANCE_TOUR_TARGETS.SEARCH]: {
+      onNext: async ({ waitForStep }) => {
+        // No card at all → skip the wait so the tour doesn't hang; driver advances next.
+        if (!handlers.resetSearch()) return;
+        await waitForStep(VIEW_COMPLIANCE_TOUR_TARGETS.FRAMEWORKS);
+      },
+    },
+    [VIEW_COMPLIANCE_TOUR_TARGETS.FRAMEWORKS]: {
+      onNext: () => {
+        handlers.openFirstFramework();
+      },
+    },
+  };
+}
diff --git a/ui/lib/tours/view-first-scan.tour.ts b/ui/lib/tours/view-first-scan.tour.ts
new file mode 100644
index 0000000000..c6b5a00d8d
--- /dev/null
+++ b/ui/lib/tours/view-first-scan.tour.ts
@@ -0,0 +1,98 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+  type TourDefinition,
+} from "./tour-types";
+
+// Const map keeps the union narrow so `useDriverTour` can validate step keys.
+export const VIEW_FIRST_SCAN_TOUR_TARGETS = {
+  // The first row of the active (In Progress) tab — present only while a scan runs.
+  IN_PROGRESS: "in-progress",
+  LAUNCH: "launch",
+  TABS: "tabs",
+} as const;
+
+export type ViewFirstScanTourTarget =
+  (typeof VIEW_FIRST_SCAN_TOUR_TARGETS)[keyof typeof VIEW_FIRST_SCAN_TOUR_TARGETS];
+
+const COVERS_FILES = [
+  "ui/app/(prowler)/scans/**",
+  "ui/components/scans/**",
+] as const;
+
+// v2: lands on the In Progress tab and highlights the running scan when there is one.
+const VERSION = 2;
+
+const INTRO_STEP = {
+  title: "This is Scan Jobs",
+  description:
+    "Scan Jobs is where you run and track scans against your connected providers.",
+} as const;
+
+/**
+ * Builds the tour for the scans page. When a scan is already running we anchor the
+ * In Progress row first (and mention the other tabs in copy); otherwise we fall back
+ * to highlighting Launch Scan and the tabs. Gating on `hasInProgressScan` keeps the
+ * tour from anchoring to a missing row — the same guard pattern the findings tour
+ * uses for an empty table.
+ */
+export function buildViewFirstScanTour(
+  hasInProgressScan: boolean,
+): TourDefinition<ViewFirstScanTourTarget> {
+  if (hasInProgressScan) {
+    return defineTour<ViewFirstScanTourTarget>({
+      id: "view-first-scan",
+      version: VERSION,
+      coversFiles: COVERS_FILES,
+      steps: [
+        INTRO_STEP,
+        {
+          target: "in-progress",
+          side: TOUR_STEP_SIDES.BOTTOM,
+          align: TOUR_STEP_ALIGNMENTS.START,
+          title: "Your scan is running",
+          description:
+            "Prowler is assessing your provider right now. Use the In Progress, Completed, and Scheduled tabs to follow this and other scan jobs as they progress.",
+        },
+        {
+          target: "launch",
+          side: TOUR_STEP_SIDES.BOTTOM,
+          align: TOUR_STEP_ALIGNMENTS.END,
+          title: "Launch another scan",
+          description:
+            "Click Launch Scan whenever you want to assess another connected provider. You can pick which provider and when to scan.",
+        },
+      ],
+    });
+  }
+
+  return defineTour<ViewFirstScanTourTarget>({
+    id: "view-first-scan",
+    version: VERSION,
+    coversFiles: COVERS_FILES,
+    steps: [
+      INTRO_STEP,
+      {
+        target: "launch",
+        side: TOUR_STEP_SIDES.BOTTOM,
+        align: TOUR_STEP_ALIGNMENTS.END,
+        title: "Launch a scan",
+        description:
+          "Click Launch Scan to start assessing a connected provider. You can pick which provider and when to scan.",
+      },
+      {
+        target: "tabs",
+        side: TOUR_STEP_SIDES.BOTTOM,
+        align: TOUR_STEP_ALIGNMENTS.START,
+        title: "Track your scan jobs",
+        description:
+          "Switch between these tabs to follow running, scheduled, and completed scan jobs as they progress.",
+      },
+    ],
+  });
+}
+
+// Default definition used by the onboarding registry; the scans page rebuilds it with
+// the live `hasInProgressScan` flag at render time.
+export const viewFirstScanTour = buildViewFirstScanTour(false);
diff --git a/ui/next.config.js b/ui/next.config.js
index d5987c3603..dc6811b53c 100644
--- a/ui/next.config.js
+++ b/ui/next.config.js
@@ -6,7 +6,11 @@ const { withSentryConfig } = require("@sentry/nextjs");
 /** @type {import('next').NextConfig} */
 
 // HTTP Security Headers
-// 'unsafe-eval' is configured under `script-src` because it is required by NextJS for development mode
+// 'unsafe-eval' is configured under `script-src` because it is required by NextJS for development mode.
+//
+// CSP is static; the JSON config island is inert (no nonce needed). A runtime
+// Sentry DSN must be in `connect-src` below — `*.sentry.io` covers Sentry Cloud,
+// but a self-hosted/region host is blocked until per-request CSP (middleware) lands.
 const cspHeader = `
   default-src 'self';
   script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com https://www.googletagmanager.com https://browser.sentry-cdn.com;
@@ -16,23 +20,8 @@ const cspHeader = `
   style-src 'self' 'unsafe-inline';
   frame-src 'self' https://js.stripe.com https://www.googletagmanager.com;
   frame-ancestors 'none';
-  report-to csp-endpoint;
 `;
 
-// Get Sentry CSP report endpoint if DSN is configured
-const getSentryReportEndpoint = () => {
-  if (!process.env.NEXT_PUBLIC_SENTRY_DSN) return null;
-  try {
-    const sentryKey =
-      process.env.NEXT_PUBLIC_SENTRY_DSN.split("@")[0]?.split("//")[1];
-    return sentryKey
-      ? `https://o0.ingest.sentry.io/api/0/security/?sentry_key=${sentryKey}`
-      : null;
-  } catch {
-    return null;
-  }
-};
-
 const nextConfig = {
   poweredByHeader: false,
   // Use standalone only in production deployments, not for CI/testing
@@ -47,7 +36,6 @@ const nextConfig = {
     root: __dirname,
   },
   async headers() {
-    const sentryEndpoint = getSentryReportEndpoint();
     const headers = [
       {
         key: "Content-Security-Policy",
@@ -63,14 +51,6 @@ const nextConfig = {
       },
     ];
 
-    // Add Reporting-Endpoints header if Sentry is configured
-    if (sentryEndpoint) {
-      headers.push({
-        key: "Reporting-Endpoints",
-        value: `csp-endpoint="${sentryEndpoint}"`,
-      });
-    }
-
     return [
       {
         source: "/(.*)",
@@ -92,6 +72,12 @@ const sentryWebpackPluginOptions = {
 };
 
 // Export with Sentry only if configuration is available
-module.exports = process.env.SENTRY_DSN
+const hasSentryBuildCredentials = Boolean(
+  process.env.SENTRY_AUTH_TOKEN &&
+    process.env.SENTRY_ORG &&
+    process.env.SENTRY_PROJECT,
+);
+
+module.exports = hasSentryBuildCredentials
   ? withSentryConfig(nextConfig, sentryWebpackPluginOptions)
   : nextConfig;
diff --git a/ui/package.json b/ui/package.json
index 0187677008..400fd66451 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -23,18 +23,19 @@
     "test:browser": "vitest run --project browser",
     "test:browser:watch": "vitest --project browser",
     "test:coverage": "vitest run --coverage",
-    "test:e2e": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans",
-    "test:e2e:debug": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --debug",
-    "test:e2e:headed": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --headed",
+    "test:e2e": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config",
+    "test:e2e:debug": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --debug",
+    "test:e2e:headed": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --headed",
     "test:e2e:install": "playwright install",
     "test:e2e:report": "playwright show-report",
-    "test:e2e:ui": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --ui",
+    "test:e2e:ui": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --ui",
     "test:unit": "vitest run --project unit",
     "test:watch": "vitest",
+    "tour:check": "node scripts/check-tour-alignment.mjs",
     "typecheck": "tsc"
   },
   "dependencies": {
-    "@ai-sdk/react": "2.0.111",
+    "@ai-sdk/react": "3.0.205",
     "@aws-sdk/client-bedrock-runtime": "3.1045.0",
     "@codemirror/language": "6.12.2",
     "@codemirror/state": "6.6.0",
@@ -48,7 +49,7 @@
     "@langchain/mcp-adapters": "1.1.3",
     "@langchain/openai": "1.4.5",
     "@lezer/highlight": "1.2.3",
-    "@next/third-parties": "16.2.6",
+    "@next/third-parties": "16.2.9",
     "@radix-ui/react-alert-dialog": "1.1.14",
     "@radix-ui/react-avatar": "1.1.11",
     "@radix-ui/react-checkbox": "1.3.3",
@@ -79,12 +80,13 @@
     "@types/js-yaml": "4.0.9",
     "@uiw/react-codemirror": "4.25.8",
     "@xyflow/react": "12.10.2",
-    "ai": "5.0.109",
+    "ai": "6.0.203",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "cmdk": "1.1.1",
     "d3": "7.9.0",
     "date-fns": "4.1.0",
+    "driver.js": "1.4.0",
     "framer-motion": "11.18.2",
     "import-in-the-middle": "2.0.0",
     "js-yaml": "4.1.1",
@@ -94,12 +96,12 @@
     "marked": "15.0.12",
     "modern-screenshot": "4.7.0",
     "nanoid": "5.1.6",
-    "next": "16.2.6",
+    "next": "16.2.9",
     "next-auth": "5.0.0-beta.30",
     "next-themes": "0.2.1",
-    "react": "19.2.6",
+    "react": "19.2.7",
     "react-day-picker": "9.13.0",
-    "react-dom": "19.2.6",
+    "react-dom": "19.2.7",
     "react-hook-form": "7.62.0",
     "react-markdown": "10.1.0",
     "recharts": "2.15.4",
@@ -118,7 +120,7 @@
   },
   "devDependencies": {
     "@iconify/react": "5.2.1",
-    "@next/eslint-plugin-next": "16.2.6",
+    "@next/eslint-plugin-next": "16.2.9",
     "@playwright/test": "1.56.1",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",
@@ -126,14 +128,14 @@
     "@types/d3": "7.4.3",
     "@types/geojson": "7946.0.16",
     "@types/node": "24.10.8",
-    "@types/react": "19.2.8",
+    "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
     "@types/topojson-client": "3.1.5",
     "@types/topojson-specification": "1.0.5",
     "@vitejs/plugin-react": "5.1.2",
-    "@vitest/browser": "4.0.18",
-    "@vitest/browser-playwright": "4.0.18",
-    "@vitest/coverage-v8": "4.0.18",
+    "@vitest/browser": "4.1.8",
+    "@vitest/browser-playwright": "4.1.8",
+    "@vitest/coverage-v8": "4.1.8",
     "babel-plugin-react-compiler": "1.0.0",
     "dotenv": "16.6.1",
     "dotenv-expand": "12.0.3",
@@ -157,7 +159,7 @@
     "tailwindcss": "4.1.18",
     "typescript": "5.5.4",
     "typescript-eslint": "8.59.3",
-    "vitest": "4.0.18",
+    "vitest": "4.1.8",
     "vitest-browser-react": "2.0.4"
   },
   "packageManager": "pnpm@11.1.3+sha512.c85357fe17ca12dd23dd7071822666dfd7e3cb76fe214e3370b5ea2fb34f2a231185509b63e717f3cd0acb38dd3f8d82bcd5e8172400ae678b70ea4fbed0896d",
diff --git a/ui/playwright.config.ts b/ui/playwright.config.ts
index 922fa0b125..b9730e0de6 100644
--- a/ui/playwright.config.ts
+++ b/ui/playwright.config.ts
@@ -120,6 +120,13 @@ export default defineConfig({
       use: { ...devices["Desktop Chrome"] },
       testMatch: /invitation-accept\/.*\.spec\.ts/,
     },
+    // This project runs the runtime public-config data island test suite
+    // Tests run unauthenticated (no auth setup dependency)
+    {
+      name: "runtime-config",
+      use: { ...devices["Desktop Chrome"] },
+      testMatch: /runtime-config\/.*\.spec\.ts/,
+    },
     // This project runs the scans test suite
     {
       name: "scans",
@@ -146,8 +153,9 @@ export default defineConfig({
     reuseExistingServer: !process.env.CI,
     timeout: 120 * 1000,
     env: {
-      NEXT_PUBLIC_API_BASE_URL:
-        process.env.NEXT_PUBLIC_API_BASE_URL || "http://localhost:8080/api/v1",
+      UI_API_BASE_URL:
+        process.env.UI_API_BASE_URL || "http://localhost:8080/api/v1",
+      AUTH_URL: process.env.AUTH_URL || "http://localhost:3000",
       AUTH_SECRET: process.env.AUTH_SECRET || "fallback-ci-secret-for-testing",
       AUTH_TRUST_HOST: process.env.AUTH_TRUST_HOST || "true",
       NEXTAUTH_URL: process.env.NEXTAUTH_URL || "http://localhost:3000",
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index e6a5c0d953..d028639602 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -7,34 +7,37 @@ settings:
 overrides:
   '@react-types/shared': 3.26.0
   '@internationalized/date': 3.10.0
-  '@react-aria/ssr>react': 19.2.6
-  '@react-aria/ssr>react-dom': 19.2.6
-  '@react-aria/visually-hidden>react': 19.2.6
-  '@react-aria/interactions>react': 19.2.6
+  '@react-aria/ssr>react': 19.2.7
+  '@react-aria/ssr>react-dom': 19.2.7
+  '@react-aria/visually-hidden>react': 19.2.7
+  '@react-aria/interactions>react': 19.2.7
   lodash: 4.18.1
   lodash-es: 4.18.1
-  hono: 4.12.18
+  hono: 4.12.21
   '@hono/node-server': 1.19.14
   '@isaacs/brace-expansion': 5.0.1
   fast-xml-parser: 5.8.0
   serialize-javascript: 7.0.5
+  postcss: 8.5.14
+  esbuild: 0.28.1
   rollup@>=4: 4.59.0
   minimatch@<4: 3.1.4
   minimatch@>=9 <10: 9.0.7
   minimatch@>=10: 10.2.3
   ajv@<7: 6.14.0
   ajv@>=8: 8.18.0
-  qs: 6.14.2
+  qs: 6.15.2
   express-rate-limit: 8.5.1
   uuid: 11.1.1
+  dompurify: 3.4.10
 
 importers:
 
   .:
     dependencies:
       '@ai-sdk/react':
-        specifier: 2.0.111
-        version: 2.0.111(react@19.2.6)(zod@4.4.3)
+        specifier: 3.0.205
+        version: 3.0.205(react@19.2.7)(zod@4.4.3)
       '@aws-sdk/client-bedrock-runtime':
         specifier: 3.1045.0
         version: 3.1045.0
@@ -55,10 +58,10 @@ importers:
         version: 7.1.7
       '@heroui/react':
         specifier: 2.8.4
-        version: 2.8.4(@types/react@19.2.8)(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(tailwindcss@4.1.18)
+        version: 2.8.4(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tailwindcss@4.1.18)
       '@hookform/resolvers':
         specifier: 5.2.2
-        version: 5.2.2(react-hook-form@7.62.0(react@19.2.6))
+        version: 5.2.2(react-hook-form@7.62.0(react@19.2.7))
       '@langchain/aws':
         specifier: 1.3.7
         version: 1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))
@@ -67,7 +70,7 @@ importers:
         version: 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       '@langchain/mcp-adapters':
         specifier: 1.1.3
-        version: 1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))
+        version: 1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))
       '@langchain/openai':
         specifier: 1.4.5
         version: 1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(ws@8.20.1)
@@ -75,80 +78,80 @@ importers:
         specifier: 1.2.3
         version: 1.2.3
       '@next/third-parties':
-        specifier: 16.2.6
-        version: 16.2.6(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)
+        specifier: 16.2.9
+        version: 16.2.9(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-alert-dialog':
         specifier: 1.1.14
-        version: 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-avatar':
         specifier: 1.1.11
-        version: 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-checkbox':
         specifier: 1.3.3
-        version: 1.3.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.3.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-collapsible':
         specifier: 1.1.12
-        version: 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-dialog':
         specifier: 1.1.14
-        version: 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-dropdown-menu':
         specifier: 2.1.15
-        version: 2.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 2.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-icons':
         specifier: 1.3.2
-        version: 1.3.2(react@19.2.6)
+        version: 1.3.2(react@19.2.7)
       '@radix-ui/react-label':
         specifier: 2.1.7
-        version: 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-popover':
         specifier: 1.1.15
-        version: 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-progress':
         specifier: 1.1.7
-        version: 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-radio-group':
         specifier: 1.3.8
-        version: 1.3.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.3.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-scroll-area':
         specifier: 1.2.10
-        version: 1.2.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.2.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-select':
         specifier: 2.2.5
-        version: 2.2.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 2.2.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-separator':
         specifier: 1.1.7
-        version: 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-slot':
         specifier: 1.2.3
-        version: 1.2.3(@types/react@19.2.8)(react@19.2.6)
+        version: 1.2.3(@types/react@19.2.17)(react@19.2.7)
       '@radix-ui/react-tabs':
         specifier: 1.1.13
-        version: 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-toast':
         specifier: 1.2.14
-        version: 1.2.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.2.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-tooltip':
         specifier: 1.2.8
-        version: 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-use-controllable-state':
         specifier: 1.2.2
-        version: 1.2.2(@types/react@19.2.8)(react@19.2.6)
+        version: 1.2.2(@types/react@19.2.17)(react@19.2.7)
       '@react-aria/ssr':
         specifier: 3.9.4
-        version: 3.9.4(react@19.2.6)
+        version: 3.9.4(react@19.2.7)
       '@react-aria/visually-hidden':
         specifier: 3.8.12
-        version: 3.8.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 3.8.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-stately/utils':
         specifier: 3.10.8
-        version: 3.10.8(react@19.2.6)
+        version: 3.10.8(react@19.2.7)
       '@react-types/shared':
         specifier: 3.26.0
-        version: 3.26.0(react@19.2.6)
+        version: 3.26.0(react@19.2.7)
       '@sentry/nextjs':
         specifier: 10.27.0
-        version: 10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
+        version: 10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
       '@tailwindcss/postcss':
         specifier: 4.1.18
         version: 4.1.18
@@ -157,19 +160,19 @@ importers:
         version: 0.5.16(tailwindcss@4.1.18)
       '@tanstack/react-table':
         specifier: 8.21.3
-        version: 8.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 8.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@types/js-yaml':
         specifier: 4.0.9
         version: 4.0.9
       '@uiw/react-codemirror':
         specifier: 4.25.8
-        version: 4.25.8(@babel/runtime@7.28.6)(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.40.0)(codemirror@6.0.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 4.25.8(@babel/runtime@7.28.6)(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.40.0)(codemirror@6.0.2)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@xyflow/react':
         specifier: 12.10.2
-        version: 12.10.2(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 12.10.2(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       ai:
-        specifier: 5.0.109
-        version: 5.0.109(zod@4.4.3)
+        specifier: 6.0.203
+        version: 6.0.203(zod@4.4.3)
       class-variance-authority:
         specifier: 0.7.1
         version: 0.7.1
@@ -178,16 +181,19 @@ importers:
         version: 2.1.1
       cmdk:
         specifier: 1.1.1
-        version: 1.1.1(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       d3:
         specifier: 7.9.0
         version: 7.9.0
       date-fns:
         specifier: 4.1.0
         version: 4.1.0
+      driver.js:
+        specifier: 1.4.0
+        version: 1.4.0
       framer-motion:
         specifier: 11.18.2
-        version: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       import-in-the-middle:
         specifier: 2.0.0
         version: 2.0.0
@@ -199,10 +205,10 @@ importers:
         version: 4.0.0
       langchain:
         specifier: 1.4.0
-        version: 1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))
+        version: 1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))
       lucide-react:
         specifier: 0.543.0
-        version: 0.543.0(react@19.2.6)
+        version: 0.543.0(react@19.2.7)
       marked:
         specifier: 15.0.12
         version: 15.0.12
@@ -213,32 +219,32 @@ importers:
         specifier: 5.1.6
         version: 5.1.6
       next:
-        specifier: 16.2.6
-        version: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        specifier: 16.2.9
+        version: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       next-auth:
         specifier: 5.0.0-beta.30
-        version: 5.0.0-beta.30(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)
+        version: 5.0.0-beta.30(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
       next-themes:
         specifier: 0.2.1
-        version: 0.2.1(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 0.2.1(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react:
-        specifier: 19.2.6
-        version: 19.2.6
+        specifier: 19.2.7
+        version: 19.2.7
       react-day-picker:
         specifier: 9.13.0
-        version: 9.13.0(react@19.2.6)
+        version: 9.13.0(react@19.2.7)
       react-dom:
-        specifier: 19.2.6
-        version: 19.2.6(react@19.2.6)
+        specifier: 19.2.7
+        version: 19.2.7(react@19.2.7)
       react-hook-form:
         specifier: 7.62.0
-        version: 7.62.0(react@19.2.6)
+        version: 7.62.0(react@19.2.7)
       react-markdown:
         specifier: 10.1.0
-        version: 10.1.0(@types/react@19.2.8)(react@19.2.6)
+        version: 10.1.0(@types/react@19.2.17)(react@19.2.7)
       recharts:
         specifier: 2.15.4
-        version: 2.15.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 2.15.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       require-in-the-middle:
         specifier: 8.0.1
         version: 8.0.1
@@ -250,7 +256,7 @@ importers:
         version: 0.33.5
       streamdown:
         specifier: 1.6.10
-        version: 1.6.10(@types/mdast@4.0.4)(micromark-util-types@2.0.2)(micromark@4.0.2)(react@19.2.6)
+        version: 1.6.10(@types/mdast@4.0.4)(micromark-util-types@2.0.2)(micromark@4.0.2)(react@19.2.7)
       tailwind-merge:
         specifier: 3.3.1
         version: 3.3.1
@@ -262,10 +268,10 @@ importers:
         version: 3.1.0
       use-stick-to-bottom:
         specifier: 1.1.1
-        version: 1.1.1(react@19.2.6)
+        version: 1.1.1(react@19.2.7)
       vaul:
         specifier: 1.1.2
-        version: 1.1.2(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.2(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       world-atlas:
         specifier: 2.0.2
         version: 2.0.2
@@ -274,14 +280,14 @@ importers:
         version: 4.4.3
       zustand:
         specifier: 5.0.8
-        version: 5.0.8(@types/react@19.2.8)(react@19.2.6)(use-sync-external-store@1.6.0(react@19.2.6))
+        version: 5.0.8(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))
     devDependencies:
       '@iconify/react':
         specifier: 5.2.1
-        version: 5.2.1(react@19.2.6)
+        version: 5.2.1(react@19.2.7)
       '@next/eslint-plugin-next':
-        specifier: 16.2.6
-        version: 16.2.6
+        specifier: 16.2.9
+        version: 16.2.9
       '@playwright/test':
         specifier: 1.56.1
         version: 1.56.1
@@ -290,7 +296,7 @@ importers:
         version: 6.9.1
       '@testing-library/react':
         specifier: 16.3.2
-        version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@testing-library/user-event':
         specifier: 14.6.1
         version: 14.6.1(@testing-library/dom@10.4.1)
@@ -304,11 +310,11 @@ importers:
         specifier: 24.10.8
         version: 24.10.8
       '@types/react':
-        specifier: 19.2.8
-        version: 19.2.8
+        specifier: 19.2.17
+        version: 19.2.17
       '@types/react-dom':
         specifier: 19.2.3
-        version: 19.2.3(@types/react@19.2.8)
+        version: 19.2.3(@types/react@19.2.17)
       '@types/topojson-client':
         specifier: 3.1.5
         version: 3.1.5
@@ -319,14 +325,14 @@ importers:
         specifier: 5.1.2
         version: 5.1.2(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
       '@vitest/browser':
-        specifier: 4.0.18
-        version: 4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.0.18)
+        specifier: 4.1.8
+        version: 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
       '@vitest/browser-playwright':
-        specifier: 4.0.18
-        version: 4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.0.18)
+        specifier: 4.1.8
+        version: 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
       '@vitest/coverage-v8':
-        specifier: 4.0.18
-        version: 4.0.18(@vitest/browser@4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.0.18))(vitest@4.0.18)
+        specifier: 4.1.8
+        version: 4.1.8(@vitest/browser@4.1.8)(vitest@4.1.8)
       babel-plugin-react-compiler:
         specifier: 1.0.0
         version: 1.0.0
@@ -397,11 +403,11 @@ importers:
         specifier: 8.59.3
         version: 8.59.3(eslint@9.39.2(jiti@2.7.0))(typescript@5.5.4)
       vitest:
-        specifier: 4.0.18
-        version: 4.0.18(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.0.18)(jiti@2.7.0)(jsdom@27.4.0)(lightningcss@1.30.2)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(terser@5.47.1)(yaml@2.9.0)
+        specifier: 4.1.8
+        version: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
       vitest-browser-react:
         specifier: 2.0.4
-        version: 2.0.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(vitest@4.0.18)
+        version: 2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.8)
 
 packages:
 
@@ -411,31 +417,27 @@ packages:
   '@adobe/css-tools@4.4.4':
     resolution: {integrity: sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg==}
 
-  '@ai-sdk/gateway@2.0.18':
-    resolution: {integrity: sha512-sDQcW+6ck2m0pTIHW6BPHD7S125WD3qNkx/B8sEzJp/hurocmJ5Cni0ybExg6sQMGo+fr/GWOwpHF1cmCdg5rQ==}
+  '@ai-sdk/gateway@3.0.129':
+    resolution: {integrity: sha512-KEQpZGJuCksc4iFxYtVHeHHG7yH0izGFzJLmRZlriI0hFIzJF9bT2AzJoaTHUI6minlxtP0WKYh84dP18o/Cuw==}
     engines: {node: '>=18'}
     peerDependencies:
       zod: ^3.25.76 || ^4.1.8
 
-  '@ai-sdk/provider-utils@3.0.18':
-    resolution: {integrity: sha512-ypv1xXMsgGcNKUP+hglKqtdDuMg68nWHucPPAhIENrbFAI+xCHiqPVN8Zllxyv1TNZwGWUghPxJXU+Mqps0YRQ==}
+  '@ai-sdk/provider-utils@4.0.29':
+    resolution: {integrity: sha512-uhukHaCBvqkwBHkT8C2PrnqKTCoLn3pdHXqtcR9I8ErH+flbzgW4o7VHSNIup9LRu+WBvZIZDQLsx6rwl2tiOA==}
     engines: {node: '>=18'}
     peerDependencies:
       zod: ^3.25.76 || ^4.1.8
 
-  '@ai-sdk/provider@2.0.0':
-    resolution: {integrity: sha512-6o7Y2SeO9vFKB8lArHXehNuusnpddKPk7xqL7T2/b+OvXMRIXUO1rR4wcv1hAFUAT9avGZshty3Wlua/XA7TvA==}
+  '@ai-sdk/provider@3.0.10':
+    resolution: {integrity: sha512-Q3BZ27qfpYqnCYGvE3vt+Qi6LGOF9R5Nmzn+9JoM1lCRsD9mYaIhfJLkSunN48nfGXJ6n+XNV0J/XVpqGQl7Dw==}
     engines: {node: '>=18'}
 
-  '@ai-sdk/react@2.0.111':
-    resolution: {integrity: sha512-CY2HW/bxTwpRMvd1SmnF1Fg/zv+v4wSDz+a6Vg+7AqF5YkFSmxsyYHEjZ8WzoeQDaDZXJbLM2ToajUHAQoZNtQ==}
+  '@ai-sdk/react@3.0.205':
+    resolution: {integrity: sha512-qh4H9dUqTJwdr+arKSIrVBHG4o4sYJdZGFUCJfAf9vMe/5IwDRwhq9z5ztpcUrXD3QACO01nuyfufNc0ZoGReA==}
     engines: {node: '>=18'}
     peerDependencies:
       react: ^18 || ~19.0.1 || ~19.1.2 || ^19.2.1
-      zod: ^3.25.76 || ^4.1.8
-    peerDependenciesMeta:
-      zod:
-        optional: true
 
   '@alloc/quick-lru@5.2.0':
     resolution: {integrity: sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==}
@@ -734,6 +736,9 @@ packages:
     resolution: {integrity: sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==}
     engines: {node: '>=18'}
 
+  '@blazediff/core@1.9.1':
+    resolution: {integrity: sha512-ehg3jIkYKulZh+8om/O25vkvSsXXwC+skXmyA87FFx6A/45eqOkZsBltMw/TVteb0mloiGT8oGRTcjRAz66zaA==}
+
   '@braintree/sanitize-url@7.1.1':
     resolution: {integrity: sha512-i1L7noDNxtFyL5DmZafWy1wRVhGehQmzZaz1HiN5e7iylJMSZR7ekOV7NsIqa5qBldlLrsKv4HbgFUVlQrz8Mw==}
 
@@ -819,158 +824,158 @@ packages:
   '@emnapi/wasi-threads@1.2.1':
     resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
 
-  '@esbuild/aix-ppc64@0.27.7':
-    resolution: {integrity: sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==}
+  '@esbuild/aix-ppc64@0.28.1':
+    resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [aix]
 
-  '@esbuild/android-arm64@0.27.7':
-    resolution: {integrity: sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==}
+  '@esbuild/android-arm64@0.28.1':
+    resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
 
-  '@esbuild/android-arm@0.27.7':
-    resolution: {integrity: sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==}
+  '@esbuild/android-arm@0.28.1':
+    resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
 
-  '@esbuild/android-x64@0.27.7':
-    resolution: {integrity: sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==}
+  '@esbuild/android-x64@0.28.1':
+    resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
 
-  '@esbuild/darwin-arm64@0.27.7':
-    resolution: {integrity: sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==}
+  '@esbuild/darwin-arm64@0.28.1':
+    resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
 
-  '@esbuild/darwin-x64@0.27.7':
-    resolution: {integrity: sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==}
+  '@esbuild/darwin-x64@0.28.1':
+    resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
 
-  '@esbuild/freebsd-arm64@0.27.7':
-    resolution: {integrity: sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==}
+  '@esbuild/freebsd-arm64@0.28.1':
+    resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
 
-  '@esbuild/freebsd-x64@0.27.7':
-    resolution: {integrity: sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==}
+  '@esbuild/freebsd-x64@0.28.1':
+    resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
 
-  '@esbuild/linux-arm64@0.27.7':
-    resolution: {integrity: sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==}
+  '@esbuild/linux-arm64@0.28.1':
+    resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
 
-  '@esbuild/linux-arm@0.27.7':
-    resolution: {integrity: sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==}
+  '@esbuild/linux-arm@0.28.1':
+    resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
 
-  '@esbuild/linux-ia32@0.27.7':
-    resolution: {integrity: sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==}
+  '@esbuild/linux-ia32@0.28.1':
+    resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
 
-  '@esbuild/linux-loong64@0.27.7':
-    resolution: {integrity: sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==}
+  '@esbuild/linux-loong64@0.28.1':
+    resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
 
-  '@esbuild/linux-mips64el@0.27.7':
-    resolution: {integrity: sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==}
+  '@esbuild/linux-mips64el@0.28.1':
+    resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
 
-  '@esbuild/linux-ppc64@0.27.7':
-    resolution: {integrity: sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==}
+  '@esbuild/linux-ppc64@0.28.1':
+    resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
 
-  '@esbuild/linux-riscv64@0.27.7':
-    resolution: {integrity: sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==}
+  '@esbuild/linux-riscv64@0.28.1':
+    resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
 
-  '@esbuild/linux-s390x@0.27.7':
-    resolution: {integrity: sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==}
+  '@esbuild/linux-s390x@0.28.1':
+    resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
 
-  '@esbuild/linux-x64@0.27.7':
-    resolution: {integrity: sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==}
+  '@esbuild/linux-x64@0.28.1':
+    resolution: {integrity: sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [linux]
 
-  '@esbuild/netbsd-arm64@0.27.7':
-    resolution: {integrity: sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==}
+  '@esbuild/netbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
 
-  '@esbuild/netbsd-x64@0.27.7':
-    resolution: {integrity: sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==}
+  '@esbuild/netbsd-x64@0.28.1':
+    resolution: {integrity: sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [netbsd]
 
-  '@esbuild/openbsd-arm64@0.27.7':
-    resolution: {integrity: sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==}
+  '@esbuild/openbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
 
-  '@esbuild/openbsd-x64@0.27.7':
-    resolution: {integrity: sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==}
+  '@esbuild/openbsd-x64@0.28.1':
+    resolution: {integrity: sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [openbsd]
 
-  '@esbuild/openharmony-arm64@0.27.7':
-    resolution: {integrity: sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==}
+  '@esbuild/openharmony-arm64@0.28.1':
+    resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openharmony]
 
-  '@esbuild/sunos-x64@0.27.7':
-    resolution: {integrity: sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==}
+  '@esbuild/sunos-x64@0.28.1':
+    resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
 
-  '@esbuild/win32-arm64@0.27.7':
-    resolution: {integrity: sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==}
+  '@esbuild/win32-arm64@0.28.1':
+    resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
 
-  '@esbuild/win32-ia32@0.27.7':
-    resolution: {integrity: sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==}
+  '@esbuild/win32-ia32@0.28.1':
+    resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
 
-  '@esbuild/win32-x64@0.27.7':
-    resolution: {integrity: sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==}
+  '@esbuild/win32-x64@0.28.1':
+    resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [win32]
@@ -1613,7 +1618,7 @@ packages:
     resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==}
     engines: {node: '>=18.14.1'}
     peerDependencies:
-      hono: 4.12.18
+      hono: 4.12.21
 
   '@hookform/resolvers@5.2.2':
     resolution: {integrity: sha512-A/IxlMLShx3KjV/HeTcTfaMxdwy690+L/ZADoeaTltLx+CVuzkeVIPuybK3jrRfw7YZnmdKsVVHAlEPIAEUNlA==}
@@ -2088,66 +2093,66 @@ packages:
   '@ndaidong/bellajs@12.0.1':
     resolution: {integrity: sha512-1iY42uiHz0cxNMbde7O3zVN+ZX1viOOUOBRt6ht6lkRZbSjwOnFV34Zv4URp3hGzEe6L9Byk7BOq/41H0PzAOQ==}
 
-  '@next/env@16.2.6':
-    resolution: {integrity: sha512-gd8HoHN4ufj73WmR3JmVolrpJR47ILK6LouP5xElPglaVxir6e1a7VzvTvDWkOoPXT9rkkTzyCxBu4yeZfZwcw==}
+  '@next/env@16.2.9':
+    resolution: {integrity: sha512-ki5VxxXfzD/9TDe13wyeTKIjQTAwBVpnr8KhRDUr8ltMUq1/NBpWNT5tiPoxiGl+PHM4X2ahSOiPk6iAimIzPg==}
 
-  '@next/eslint-plugin-next@16.2.6':
-    resolution: {integrity: sha512-Z8l6o4JWKUl755x4R+wogD86KPeU+Ckw4K+SYG4kHeOJtRenDeK+OSbGcqZpDtbwn9DsJVdir2UxmwXuinUbUw==}
+  '@next/eslint-plugin-next@16.2.9':
+    resolution: {integrity: sha512-UZi8+YT/MLgTC9nrrn2Xd4lBYv1B7lVmtWHfPcthAI5Tt/C1LuDe6DfmtCtJ+WQod3ksY4VrKSvk3oMVAnL7qw==}
 
-  '@next/swc-darwin-arm64@16.2.6':
-    resolution: {integrity: sha512-ZJGkkcNfYgrrMkqOdZ7zoLa1TOy0qpcMfk/z4Mh/FKUz40gVO+HNQWqmLxf67Z5WB64DRp0dhEbyHfel+6sJUg==}
+  '@next/swc-darwin-arm64@16.2.9':
+    resolution: {integrity: sha512-HkfxNYUCmcct0Xsqib5KxqMSHV4AHJq857BNRchyBDs4YS19aHzVfn1kDuBYKqLLQBjXgnkIsjV2Kd4d2wzYhw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@next/swc-darwin-x64@16.2.6':
-    resolution: {integrity: sha512-v/YLBHIY132Ced3puBJ7YJKw1lqsCrgcNo2aRJlCEyQrrCeRJlvGlnmxhPxNQI3KE3N1DN5r9TPNPvka3nq5RQ==}
+  '@next/swc-darwin-x64@16.2.9':
+    resolution: {integrity: sha512-7IAtK4MeybpqRV9GRABWEhJ62mOS+rzWOzOTFie4cSEtm12xsoOMJRcECoZx3FHPzFAqN/IJtHqWAFOLfl152w==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@next/swc-linux-arm64-gnu@16.2.6':
-    resolution: {integrity: sha512-RPOvqlYBbcQjkz9VQQDZ2T2bARIjXZV1KFlt+V2Mr6SW/e4I9fcKsaA0hdyf2FHoTlsV2xnBd5Y912rP/1Ce6w==}
+  '@next/swc-linux-arm64-gnu@16.2.9':
+    resolution: {integrity: sha512-hBD75iWpUtkL9SmQmcRhmLomn9jgkPzCEkbOcLgHymPEKzv+6ONy13RRiIEz/iEObjkS2Jlb5gYS2XGoS3X4rw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-arm64-musl@16.2.6':
-    resolution: {integrity: sha512-URUTu1+dMkxJsPFgm+OeEvq9wf5sujw0EvgYy80TDGHTSLTnIHeqb0Eu8A3sC95IRgjejQL+kC4mw+4yPxiAXA==}
+  '@next/swc-linux-arm64-musl@16.2.9':
+    resolution: {integrity: sha512-qZTI3pf9SGc/obr8NkQAekBxmp1QK+kVm+VAf3BALLfFAj+1kUhkTxmrWpVos9R/UYIA8AWX2p6cGI5WdwzVUA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-linux-x64-gnu@16.2.6':
-    resolution: {integrity: sha512-DOj182mPV8G3UkrayLoREM5YEYI+Dk5wv7Ox9xl1fFibAELEsFD0lDPfHIeILlutMMfdyhlzYPELG3peuKaurw==}
+  '@next/swc-linux-x64-gnu@16.2.9':
+    resolution: {integrity: sha512-xm0HfRNX+UkH4R3c18ynswjj5o5uEj/7iI9p9omdtTSIsRCzQqkGMA+10nzJ4EHnYC3as65IMhbbl5fWRUWHYg==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-x64-musl@16.2.6':
-    resolution: {integrity: sha512-HKQ5SP/V/ub73UvF7n/zeJlxk2kLmtL7Wzrg4WfmkjmNos5onJ2tKu7yZOPdL18A6Svfn3max29ym+ry7NkK4g==}
+  '@next/swc-linux-x64-musl@16.2.9':
+    resolution: {integrity: sha512-QumimHkGEG6vM3PfEDWKyKen03NcqLOkeKB1EfcPe7VxzmEiCa4jNnMyBn/US5zcd/VE1CI+O8Ovb3lfjVHfGw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-win32-arm64-msvc@16.2.6':
-    resolution: {integrity: sha512-LZXpTlPyS5v7HhSmnvsLGP3iIYgYOBnc8r8ArlT55sGHV89bR2HlDdBjWQ+PY6SJMmk8TuVGFuxalnP3k/0Dwg==}
+  '@next/swc-win32-arm64-msvc@16.2.9':
+    resolution: {integrity: sha512-hzQpKZvw8rAwI6A2uQh6SacCSvNAXaIkPNsWwzqqfRiIMiXMfH936skDhz1OO6KpvdKkJrgHHtqQOq5PIXOvdQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@next/swc-win32-x64-msvc@16.2.6':
-    resolution: {integrity: sha512-F0+4i0h9J6C4eE3EAPWsoCk7UW/dbzOjyzxY0qnDUOYFu6FFmdZ6l97/XdV3/Nz3VYyO7UWjyEJUXkGqcoXfMA==}
+  '@next/swc-win32-x64-msvc@16.2.9':
+    resolution: {integrity: sha512-qr2VL3Ce5QrwgO2yh1ujSBawrimjVKX8FGF/cOynmdYKJY0BdHpGVNIRK1tqONB10Vkm25Ub1BD2bkjWs4+96w==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
 
-  '@next/third-parties@16.2.6':
-    resolution: {integrity: sha512-PDPIPVj1NX6Taxsl8OJteAUJ7iwR+QrokwWig68eh0cOmuNjC6MBL+ZzBjO8Bv0n/HOSqjGArZpM5KMSUxm+MQ==}
+  '@next/third-parties@16.2.9':
+    resolution: {integrity: sha512-JZPGQRN8eQs2WMfBXOf6Zjrma+JIN0KyA24MvmIa3bUI4BwTaJ1UlxmYVc5ri6l30LQ8fPv6Kmx20447hCltrg==}
     peerDependencies:
       next: ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0-beta.0
       react: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
@@ -3318,13 +3323,13 @@ packages:
   '@react-aria/interactions@3.25.5':
     resolution: {integrity: sha512-EweYHOEvMwef/wsiEqV73KurX/OqnmbzKQa2fLxdULbec5+yDj6wVGaRHIzM4NiijIDe+bldEl5DG05CAKOAHA==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
       react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
 
   '@react-aria/interactions@3.26.0':
     resolution: {integrity: sha512-AAEcHiltjfbmP1i9iaVw34Mb7kbkiHpYdqieWufldh4aplWgsF11YQZOfaCJW4QoR2ML4Zzoa9nfFwLXA52R7Q==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
       react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
 
   '@react-aria/label@3.7.21':
@@ -3436,13 +3441,13 @@ packages:
     resolution: {integrity: sha512-hvTm77Pf+pMBhuBm760Li0BVIO38jv1IBws1xFm1NoL26PU+fe+FMW5+VZWyANR6nYL65joaJKZqOdTQMkO9IQ==}
     engines: {node: '>= 12'}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   '@react-aria/ssr@3.9.4':
     resolution: {integrity: sha512-4jmAigVq409qcJvQyuorsmBR4+9r3+JEC60wC+Y0MZV0HCtTmm8D9guYXlJMdx0SSkgj0hHAyFm/HvPNFofCoQ==}
     engines: {node: '>= 12'}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   '@react-aria/switch@3.7.7':
     resolution: {integrity: sha512-auV3g1qh+d/AZk7Idw2BOcYeXfCD9iDaiGmlcLJb9Eaz4nkq8vOkQxIXQFrn9Xhb+PfQzmQYKkt5N6P2ZNsw/g==}
@@ -3513,18 +3518,18 @@ packages:
   '@react-aria/visually-hidden@3.8.12':
     resolution: {integrity: sha512-Bawm+2Cmw3Xrlr7ARzl2RLtKh0lNUdJ0eNqzWcyx4c0VHUAWtThmH5l+HRqFUGzzutFZVo89SAy40BAbd0gjVw==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   '@react-aria/visually-hidden@3.8.27':
     resolution: {integrity: sha512-hD1DbL3WnjPnCdlQjwe19bQVRAGJyN0Aaup+s7NNtvZUn7AjoEH78jo8TE+L8yM7z/OZUQF26laCfYqeIwWn4g==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
       react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
 
   '@react-aria/visually-hidden@3.8.29':
     resolution: {integrity: sha512-1joCP+MHBLd+YA6Gb08nMFfDBhOF0Kh1gR1SA8zoxEB5RMfQEEkufIB8k0GGwvHGSCK3gFyO8UAVsD0+rRYEyg==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
       react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
 
   '@react-stately/calendar@3.8.4':
@@ -4666,8 +4671,8 @@ packages:
     peerDependencies:
       '@types/react': ^19.2.0
 
-  '@types/react@19.2.8':
-    resolution: {integrity: sha512-3MbSL37jEchWZz2p2mjntRZtPt837ij10ApxKfgmXCTuHWagYg7iA5bqPw6C8BMPfwidlvfPI/fxOc42HLhcyg==}
+  '@types/react@19.2.17':
+    resolution: {integrity: sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==}
 
   '@types/set-cookie-parser@2.4.10':
     resolution: {integrity: sha512-GGmQVGpQWUe5qglJozEjZV/5dyxbOOZ0LHe/lqyWssB88Y4svNfst0uqBVscdDeIKl5Jy5+aPSvy7mI9tYRguw==}
@@ -4735,8 +4740,8 @@ packages:
     resolution: {integrity: sha512-ePFoH0g4ludssdRFqqDxQePCxU4WQyRa9+XVwjm7yLn0FKhMeoetC+qBEEI1Eyb1pGSDveTIT09Bvw2WhlGayg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/types@8.60.0':
-    resolution: {integrity: sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA==}
+  '@typescript-eslint/types@8.61.1':
+    resolution: {integrity: sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
   '@typescript-eslint/typescript-estree@8.59.3':
@@ -4905,8 +4910,8 @@ packages:
   '@upsetjs/venn.js@2.0.0':
     resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==}
 
-  '@vercel/oidc@3.0.5':
-    resolution: {integrity: sha512-fnYhv671l+eTTp48gB4zEsTW/YtRgRPnkI2nT7x6qw5rkI1Lq2hTmQIpHPgyThI0znLK+vX2n9XxKdXZ7BUbbw==}
+  '@vercel/oidc@3.2.0':
+    resolution: {integrity: sha512-UycprH3T6n3jH0k44NHMa7pnFHGu/N05MjojYr+Mc6I7obkoLIJujSWwin1pCvdy/eOxrI/l3uDLQsmcrOb4ug==}
     engines: {node: '>= 20'}
 
   '@vitejs/plugin-react@5.1.2':
@@ -4915,54 +4920,54 @@ packages:
     peerDependencies:
       vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@vitest/browser-playwright@4.0.18':
-    resolution: {integrity: sha512-gfajTHVCiwpxRj1qh0Sh/5bbGLG4F/ZH/V9xvFVoFddpITfMta9YGow0W6ZpTTORv2vdJuz9TnrNSmjKvpOf4g==}
+  '@vitest/browser-playwright@4.1.8':
+    resolution: {integrity: sha512-SR7FqgegaexEg73xvf3ArtygXegagMdXnL0EZMpxrWvvhQxvicD/E8p0ib0J91riPRtQUViyh67Xjw3NqvyhVg==}
     peerDependencies:
       playwright: '*'
-      vitest: 4.0.18
+      vitest: 4.1.8
 
-  '@vitest/browser@4.0.18':
-    resolution: {integrity: sha512-gVQqh7paBz3gC+ZdcCmNSWJMk70IUjDeVqi+5m5vYpEHsIwRgw3Y545jljtajhkekIpIp5Gg8oK7bctgY0E2Ng==}
+  '@vitest/browser@4.1.8':
+    resolution: {integrity: sha512-u21VzX07HzlJYpFgkxmjEXar/tG2UqWGgyGG/46SrrPc7rSdCTPw5vuowopO9CIqF8UCUQzDFdbVnNpw6N0BfQ==}
     peerDependencies:
-      vitest: 4.0.18
+      vitest: 4.1.8
 
-  '@vitest/coverage-v8@4.0.18':
-    resolution: {integrity: sha512-7i+N2i0+ME+2JFZhfuz7Tg/FqKtilHjGyGvoHYQ6iLV0zahbsJ9sljC9OcFcPDbhYKCet+sG8SsVqlyGvPflZg==}
+  '@vitest/coverage-v8@4.1.8':
+    resolution: {integrity: sha512-lt3kovsyHwYe00wq4D1ti0Z974fWj4NLp6siqiyEufUpyFwK9Yhi7rBhac9JL5aA0zoMrJqc4vYPZRUnI7l7nw==}
     peerDependencies:
-      '@vitest/browser': 4.0.18
-      vitest: 4.0.18
+      '@vitest/browser': 4.1.8
+      vitest: 4.1.8
     peerDependenciesMeta:
       '@vitest/browser':
         optional: true
 
-  '@vitest/expect@4.0.18':
-    resolution: {integrity: sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ==}
+  '@vitest/expect@4.1.8':
+    resolution: {integrity: sha512-h3nDO677RDLEGlBxyQ5CW8RlMThSKSRLUePLOx09gNIWRL40edgA1GCZSZgf1W55MFAG6/Sw14KeaAnqv0NKdQ==}
 
-  '@vitest/mocker@4.0.18':
-    resolution: {integrity: sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ==}
+  '@vitest/mocker@4.1.8':
+    resolution: {integrity: sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw==}
     peerDependencies:
       msw: ^2.4.9
-      vite: ^6.0.0 || ^7.0.0-0
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
     peerDependenciesMeta:
       msw:
         optional: true
       vite:
         optional: true
 
-  '@vitest/pretty-format@4.0.18':
-    resolution: {integrity: sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw==}
+  '@vitest/pretty-format@4.1.8':
+    resolution: {integrity: sha512-9GasEBxpZ1VYIpqHf/0+YGg121uSNwCKOJqIrTwWP/TB7DmFCiaBpNl3aPZzoLWfWkuqhbH8vJIVobZkvdo2cA==}
 
-  '@vitest/runner@4.0.18':
-    resolution: {integrity: sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw==}
+  '@vitest/runner@4.1.8':
+    resolution: {integrity: sha512-EmVxeBAfMJvycdjd6Hm+RbFBbA9fKvo0Kx37hNpBYoYeavH3RNsBXWDooR1mgD52dCrxIIuP7UotpfiwOikvcg==}
 
-  '@vitest/snapshot@4.0.18':
-    resolution: {integrity: sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA==}
+  '@vitest/snapshot@4.1.8':
+    resolution: {integrity: sha512-acfZboRmAIf05DEKcBQy33VXojFJjtUdLyo7oOmV9kebb2xdU01UknNiPuPZoJZQyO7DF0gZdTGTpeAzET9QPQ==}
 
-  '@vitest/spy@4.0.18':
-    resolution: {integrity: sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw==}
+  '@vitest/spy@4.1.8':
+    resolution: {integrity: sha512-6EevtBp6OZOPF7bmz36HrGMeP3txgVSrgebWxHOafDXGkhIzfXK14f8KF6MuFfgXXUeHxmpD3BQxkV00/3s5mA==}
 
-  '@vitest/utils@4.0.18':
-    resolution: {integrity: sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA==}
+  '@vitest/utils@4.1.8':
+    resolution: {integrity: sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg==}
 
   '@webassemblyjs/ast@1.14.1':
     resolution: {integrity: sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ==}
@@ -5062,8 +5067,8 @@ packages:
     resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
     engines: {node: '>= 14'}
 
-  ai@5.0.109:
-    resolution: {integrity: sha512-tW8K4Z0bcYH9PzP7gMmPilgBwgpylEL25bRtWruUnrTS45S6ryNJ6YSEh6mZajlIEDS6bcur7srdXVGERxjVXQ==}
+  ai@6.0.203:
+    resolution: {integrity: sha512-2Qi1ZPGF/FnlvnRqntVgRbUYGeA5ZKFYwTtgu8rcUzMmddArM/nLsvCW69Ip99B1cop6XHRHl+GCKk9t9B+GDA==}
     engines: {node: '>=18'}
     peerDependencies:
       zod: ^3.25.76 || ^4.1.8
@@ -5168,8 +5173,8 @@ packages:
   ast-types-flow@0.0.8:
     resolution: {integrity: sha512-OH/2E5Fg20h2aPrbe+QL8JZQFko0YZaF+j4mnQ7BGhfavO7OpSLa8a0y9sBwomHdSbkhTS8TQNayBfnW5DwbvQ==}
 
-  ast-v8-to-istanbul@0.3.12:
-    resolution: {integrity: sha512-BRRC8VRZY2R4Z4lFIL35MwNXmwVqBityvOIwETtsCSwvjl0IdgFsy9NhdaA6j74nUdtJJlIypeRhpDam19Wq3g==}
+  ast-v8-to-istanbul@1.0.3:
+    resolution: {integrity: sha512-jCMQ6ZylLPudp0CDfBmQBZUsrh1/8psbmu9ibeVWKuHWD0YrH9YABwlKu5kVEFoT0GCQQW9Z/SxfuEbbkGQCRg==}
 
   async-function@1.0.0:
     resolution: {integrity: sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
@@ -5713,8 +5718,8 @@ packages:
   dom-helpers@5.2.1:
     resolution: {integrity: sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==}
 
-  dompurify@3.4.2:
-    resolution: {integrity: sha512-lHeS9SA/IKeIFFyYciHBr2n0v1VMPlSj843HdLOwjb2OxNwdq9Xykxqhk+FE42MzAdHvInbAolSE4mhahPpjXA==}
+  dompurify@3.4.10:
+    resolution: {integrity: sha512-0xzNv0e7oYC6yyuOGZIABPM4qtg3QxLFniDNPP4ZP90wR8Yq3zgwpRbrNiT4N3IKqDbbYFEJLV+JWEs19aZ//w==}
 
   dotenv-expand@12.0.3:
     resolution: {integrity: sha512-uc47g4b+4k/M/SeaW1y4OApx+mtLWl92l5LMPP0GNXctZqELk+YGgOPIIC5elYmUH4OuoK3JLhuRUYegeySiFA==}
@@ -5724,6 +5729,9 @@ packages:
     resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
     engines: {node: '>=12'}
 
+  driver.js@1.4.0:
+    resolution: {integrity: sha512-Gm64jm6PmcU+si21sQhBrTAM1JvUrR0QhNmjkprNLxohOBzul9+pNHXgQaT9lW84gwg9GMLB3NZGuGolsz5uew==}
+
   dunder-proto@1.0.1:
     resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
     engines: {node: '>= 0.4'}
@@ -5774,9 +5782,6 @@ packages:
     resolution: {integrity: sha512-BrUQ0cPTB/IwXj23HtwHjS9n7O4h9FX94b4xc5zlTHxeLgTAdzYUDyy6KdExAl9lbN5rtfe44xpjpmj9grxs5w==}
     engines: {node: '>= 0.4'}
 
-  es-module-lexer@1.7.0:
-    resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
-
   es-module-lexer@2.1.0:
     resolution: {integrity: sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==}
 
@@ -5799,8 +5804,8 @@ packages:
   es-toolkit@1.46.1:
     resolution: {integrity: sha512-5eNtXOs3tbfxXOj04tjjseeWkRWaoCjdEI+96DgwzZoe6c9juL49pXlzAFTI72aWC9Y8p7168g6XIKjh7k6pyQ==}
 
-  esbuild@0.27.7:
-    resolution: {integrity: sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==}
+  esbuild@0.28.1:
+    resolution: {integrity: sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -5963,6 +5968,10 @@ packages:
     resolution: {integrity: sha512-Vo1ab+QXPzZ4tCa8SwIHJFaSzy4R6SHf7BY79rFBDf0idraZWAkYrDjDj8uWaSm3S2TK+hJ7/t1CEmZ7jXw+pg==}
     engines: {node: '>=18.0.0'}
 
+  eventsource-parser@3.1.0:
+    resolution: {integrity: sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==}
+    engines: {node: '>=18.0.0'}
+
   eventsource@3.0.7:
     resolution: {integrity: sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==}
     engines: {node: '>=18.0.0'}
@@ -6289,8 +6298,8 @@ packages:
   hoist-non-react-statics@3.3.2:
     resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==}
 
-  hono@4.12.18:
-    resolution: {integrity: sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ==}
+  hono@4.12.21:
+    resolution: {integrity: sha512-uV63apnb0kyPtAUwoWgaGh9HyIFcv8lgmzPZSiTBQAFOFGIzka5EZ1dZocmGnn0XdX0+XTqJ6Tqv7selMuGLRQ==}
     engines: {node: '>=16.9.0'}
 
   html-encoding-sniffer@6.0.0:
@@ -7169,8 +7178,8 @@ packages:
       react: '*'
       react-dom: '*'
 
-  next@16.2.6:
-    resolution: {integrity: sha512-qOVgKJg1+At15NpeUP+eJgCHvTCgXsogweq87Ri/Ix7PkqQHg4sdaXmSFqKlgaIXE4kW0g25LE68W87UANlHtw==}
+  next@16.2.9:
+    resolution: {integrity: sha512-MEOJiq/UvuezAdqVSceHbqDgZt1kDw2tpGVOlsdIoJsQdbN2JY2hpVG4xnXGkbdJUOEWhnRfiu/O4Hpc9Juwww==}
     engines: {node: '>=20.9.0'}
     hasBin: true
     peerDependencies:
@@ -7394,10 +7403,6 @@ packages:
     resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
     engines: {node: '>=12'}
 
-  pixelmatch@7.1.0:
-    resolution: {integrity: sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==}
-    hasBin: true
-
   pkce-challenge@5.0.1:
     resolution: {integrity: sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==}
     engines: {node: '>=16.20.0'}
@@ -7433,10 +7438,6 @@ packages:
     resolution: {integrity: sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==}
     engines: {node: '>=4'}
 
-  postcss@8.4.31:
-    resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
-    engines: {node: ^10 || ^12 || >=14}
-
   postcss@8.5.14:
     resolution: {integrity: sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==}
     engines: {node: ^10 || ^12 || >=14}
@@ -7568,8 +7569,8 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
-  qs@6.14.2:
-    resolution: {integrity: sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==}
+  qs@6.15.2:
+    resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==}
     engines: {node: '>=0.6'}
 
   queue-microtask@1.2.3:
@@ -7589,10 +7590,10 @@ packages:
     peerDependencies:
       react: '>=16.8.0'
 
-  react-dom@19.2.6:
-    resolution: {integrity: sha512-0prMI+hvBbPjsWnxDLxlCGyM8PN6UuWjEUCYmZhO67xIV9Xasa/r/vDnq+Xyq4Lo27g8QSbO5YzARu0D1Sps3g==}
+  react-dom@19.2.7:
+    resolution: {integrity: sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==}
     peerDependencies:
-      react: ^19.2.6
+      react: ^19.2.7
 
   react-hook-form@7.62.0:
     resolution: {integrity: sha512-7KWFejc98xqG/F4bAxpL41NB3o1nnvQO1RWZT3TqRZYL8RryQETGfEdVnJN2fy1crCiBLLjkRBVK05j24FxJGA==}
@@ -7667,8 +7668,8 @@ packages:
       react: '>=16.6.0'
       react-dom: '>=16.6.0'
 
-  react@19.2.6:
-    resolution: {integrity: sha512-sfWGGfavi0xr8Pg0sVsyHMAOziVYKgPLNrS7ig+ivMNb3wbCBw3KxtflsGBAwD3gYQlE/AEZsTLgToRrSCjb0Q==}
+  react@19.2.7:
+    resolution: {integrity: sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==}
     engines: {node: '>=0.10.0'}
 
   readdirp@3.6.0:
@@ -7978,8 +7979,8 @@ packages:
     resolution: {integrity: sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==}
     engines: {node: '>= 0.8'}
 
-  std-env@3.10.0:
-    resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==}
+  std-env@4.1.0:
+    resolution: {integrity: sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==}
 
   stop-iteration-iterator@1.1.0:
     resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
@@ -8498,20 +8499,23 @@ packages:
       '@types/react-dom':
         optional: true
 
-  vitest@4.0.18:
-    resolution: {integrity: sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ==}
+  vitest@4.1.8:
+    resolution: {integrity: sha512-flY6ScbCIt9HThs+C5HS7jvGOB560DJtk/Z15IQROTA6zEy49Nh8T/dofWTQL+n3vswqn87sbJNiuqw1SDp5Ig==}
     engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
       '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.0.18
-      '@vitest/browser-preview': 4.0.18
-      '@vitest/browser-webdriverio': 4.0.18
-      '@vitest/ui': 4.0.18
+      '@vitest/browser-playwright': 4.1.8
+      '@vitest/browser-preview': 4.1.8
+      '@vitest/browser-webdriverio': 4.1.8
+      '@vitest/coverage-istanbul': 4.1.8
+      '@vitest/coverage-v8': 4.1.8
+      '@vitest/ui': 4.1.8
       happy-dom: '*'
       jsdom: '*'
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
     peerDependenciesMeta:
       '@edge-runtime/vm':
         optional: true
@@ -8525,6 +8529,10 @@ packages:
         optional: true
       '@vitest/browser-webdriverio':
         optional: true
+      '@vitest/coverage-istanbul':
+        optional: true
+      '@vitest/coverage-v8':
+        optional: true
       '@vitest/ui':
         optional: true
       happy-dom:
@@ -8756,33 +8764,33 @@ snapshots:
 
   '@adobe/css-tools@4.4.4': {}
 
-  '@ai-sdk/gateway@2.0.18(zod@4.4.3)':
+  '@ai-sdk/gateway@3.0.129(zod@4.4.3)':
     dependencies:
-      '@ai-sdk/provider': 2.0.0
-      '@ai-sdk/provider-utils': 3.0.18(zod@4.4.3)
-      '@vercel/oidc': 3.0.5
+      '@ai-sdk/provider': 3.0.10
+      '@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
+      '@vercel/oidc': 3.2.0
       zod: 4.4.3
 
-  '@ai-sdk/provider-utils@3.0.18(zod@4.4.3)':
+  '@ai-sdk/provider-utils@4.0.29(zod@4.4.3)':
     dependencies:
-      '@ai-sdk/provider': 2.0.0
+      '@ai-sdk/provider': 3.0.10
       '@standard-schema/spec': 1.1.0
-      eventsource-parser: 3.0.6
+      eventsource-parser: 3.1.0
       zod: 4.4.3
 
-  '@ai-sdk/provider@2.0.0':
+  '@ai-sdk/provider@3.0.10':
     dependencies:
       json-schema: 0.4.0
 
-  '@ai-sdk/react@2.0.111(react@19.2.6)(zod@4.4.3)':
+  '@ai-sdk/react@3.0.205(react@19.2.7)(zod@4.4.3)':
     dependencies:
-      '@ai-sdk/provider-utils': 3.0.18(zod@4.4.3)
-      ai: 5.0.109(zod@4.4.3)
-      react: 19.2.6
-      swr: 2.3.8(react@19.2.6)
+      '@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
+      ai: 6.0.203(zod@4.4.3)
+      react: 19.2.7
+      swr: 2.3.8(react@19.2.7)
       throttleit: 2.1.0
-    optionalDependencies:
-      zod: 4.4.3
+    transitivePeerDependencies:
+      - zod
 
   '@alloc/quick-lru@5.2.0': {}
 
@@ -9470,6 +9478,8 @@ snapshots:
 
   '@bcoe/v8-coverage@1.0.2': {}
 
+  '@blazediff/core@1.9.1': {}
+
   '@braintree/sanitize-url@7.1.1': {}
 
   '@cfworker/json-schema@4.1.1': {}
@@ -9580,82 +9590,82 @@ snapshots:
       tslib: 2.8.1
     optional: true
 
-  '@esbuild/aix-ppc64@0.27.7':
+  '@esbuild/aix-ppc64@0.28.1':
     optional: true
 
-  '@esbuild/android-arm64@0.27.7':
+  '@esbuild/android-arm64@0.28.1':
     optional: true
 
-  '@esbuild/android-arm@0.27.7':
+  '@esbuild/android-arm@0.28.1':
     optional: true
 
-  '@esbuild/android-x64@0.27.7':
+  '@esbuild/android-x64@0.28.1':
     optional: true
 
-  '@esbuild/darwin-arm64@0.27.7':
+  '@esbuild/darwin-arm64@0.28.1':
     optional: true
 
-  '@esbuild/darwin-x64@0.27.7':
+  '@esbuild/darwin-x64@0.28.1':
     optional: true
 
-  '@esbuild/freebsd-arm64@0.27.7':
+  '@esbuild/freebsd-arm64@0.28.1':
     optional: true
 
-  '@esbuild/freebsd-x64@0.27.7':
+  '@esbuild/freebsd-x64@0.28.1':
     optional: true
 
-  '@esbuild/linux-arm64@0.27.7':
+  '@esbuild/linux-arm64@0.28.1':
     optional: true
 
-  '@esbuild/linux-arm@0.27.7':
+  '@esbuild/linux-arm@0.28.1':
     optional: true
 
-  '@esbuild/linux-ia32@0.27.7':
+  '@esbuild/linux-ia32@0.28.1':
     optional: true
 
-  '@esbuild/linux-loong64@0.27.7':
+  '@esbuild/linux-loong64@0.28.1':
     optional: true
 
-  '@esbuild/linux-mips64el@0.27.7':
+  '@esbuild/linux-mips64el@0.28.1':
     optional: true
 
-  '@esbuild/linux-ppc64@0.27.7':
+  '@esbuild/linux-ppc64@0.28.1':
     optional: true
 
-  '@esbuild/linux-riscv64@0.27.7':
+  '@esbuild/linux-riscv64@0.28.1':
     optional: true
 
-  '@esbuild/linux-s390x@0.27.7':
+  '@esbuild/linux-s390x@0.28.1':
     optional: true
 
-  '@esbuild/linux-x64@0.27.7':
+  '@esbuild/linux-x64@0.28.1':
     optional: true
 
-  '@esbuild/netbsd-arm64@0.27.7':
+  '@esbuild/netbsd-arm64@0.28.1':
     optional: true
 
-  '@esbuild/netbsd-x64@0.27.7':
+  '@esbuild/netbsd-x64@0.28.1':
     optional: true
 
-  '@esbuild/openbsd-arm64@0.27.7':
+  '@esbuild/openbsd-arm64@0.28.1':
     optional: true
 
-  '@esbuild/openbsd-x64@0.27.7':
+  '@esbuild/openbsd-x64@0.28.1':
     optional: true
 
-  '@esbuild/openharmony-arm64@0.27.7':
+  '@esbuild/openharmony-arm64@0.28.1':
     optional: true
 
-  '@esbuild/sunos-x64@0.27.7':
+  '@esbuild/sunos-x64@0.28.1':
     optional: true
 
-  '@esbuild/win32-arm64@0.27.7':
+  '@esbuild/win32-arm64@0.28.1':
     optional: true
 
-  '@esbuild/win32-ia32@0.27.7':
+  '@esbuild/win32-ia32@0.28.1':
     optional: true
 
-  '@esbuild/win32-x64@0.27.7':
+  '@esbuild/win32-x64@0.28.1':
     optional: true
 
   '@eslint-community/eslint-utils@4.9.1(eslint@9.39.2(jiti@2.7.0))':
@@ -9724,11 +9734,11 @@ snapshots:
       '@floating-ui/core': 1.7.3
       '@floating-ui/utils': 0.2.10
 
-  '@floating-ui/react-dom@2.1.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@floating-ui/react-dom@2.1.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@floating-ui/dom': 1.7.4
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   '@floating-ui/utils@0.2.10': {}
 
@@ -9758,814 +9768,814 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@heroui/accordion@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/accordion@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-accordion': 2.2.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tree': 3.9.2(react@19.2.6)
-      '@react-types/accordion': 3.0.0-alpha.26(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-accordion': 2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tree': 3.9.2(react@19.2.7)
+      '@react-types/accordion': 3.0.0-alpha.26(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/alert@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/alert@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/aria-utils@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/aria-utils@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.7(react@19.2.6)
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.7(react@19.2.7)
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@heroui/theme'
       - framer-motion
 
-  '@heroui/autocomplete@2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/autocomplete@2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/combobox': 3.13.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/combobox': 3.11.1(react@19.2.6)
-      '@react-types/combobox': 3.13.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/combobox': 3.13.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/combobox': 3.11.1(react@19.2.7)
+      '@react-types/combobox': 3.13.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
 
-  '@heroui/avatar@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/avatar@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-image': 2.1.12(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-image': 2.1.12(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/badge@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/badge@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/breadcrumbs@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/breadcrumbs@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/breadcrumbs': 3.5.28(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/breadcrumbs': 3.7.16(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/breadcrumbs': 3.5.28(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/breadcrumbs': 3.7.16(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/button@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/button@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/calendar@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/calendar@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@internationalized/date': 3.10.0
-      '@react-aria/calendar': 3.9.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/calendar': 3.8.4(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/calendar': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/calendar': 3.9.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/calendar': 3.8.4(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/calendar': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
       scroll-into-view-if-needed: 3.0.10
 
-  '@heroui/card@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/card@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/checkbox@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/checkbox@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-callback-ref': 2.1.8(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/checkbox': 3.16.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/checkbox': 3.7.1(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-types/checkbox': 3.10.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-callback-ref': 2.1.8(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/checkbox': 3.16.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/checkbox': 3.7.1(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-types/checkbox': 3.10.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/chip@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/chip@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/code@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/code@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/date-input@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/date-input@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
       '@internationalized/date': 3.10.0
-      '@react-aria/datepicker': 3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/datepicker': 3.15.1(react@19.2.6)
-      '@react-types/datepicker': 3.13.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/datepicker': 3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/datepicker': 3.15.1(react@19.2.7)
+      '@react-types/datepicker': 3.13.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/date-picker@2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/date-picker@2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
       '@internationalized/date': 3.10.0
-      '@react-aria/datepicker': 3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/datepicker': 3.15.1(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/datepicker': 3.13.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/datepicker': 3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/datepicker': 3.15.1(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/datepicker': 3.13.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/divider@2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/divider@2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-rsc-utils': 2.1.9(react@19.2.6)
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/react-rsc-utils': 2.1.9(react@19.2.7)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/dom-animation@2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))':
+  '@heroui/dom-animation@2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))':
     dependencies:
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
 
-  '@heroui/drawer@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/drawer@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/dropdown@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/dropdown@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/menu': 3.19.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/menu': 3.9.7(react@19.2.6)
-      '@react-types/menu': 3.10.4(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/menu': 3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/menu': 3.9.7(react@19.2.7)
+      '@react-types/menu': 3.10.4(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/form@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/form@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-stately/form': 3.2.1(react@19.2.6)
-      '@react-types/form': 3.7.15(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-stately/form': 3.2.1(react@19.2.7)
+      '@react-types/form': 3.7.15(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/framer-utils@2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/framer-utils@2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-measure': 2.1.8(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-measure': 2.1.8(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@heroui/theme'
 
-  '@heroui/image@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/image@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-image': 2.1.12(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-image': 2.1.12(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/input-otp@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/input-otp@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-form-reset': 2.0.1(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/form': 3.1.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.1(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/textfield': 3.12.5(react@19.2.6)
-      input-otp: 1.4.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-form-reset': 2.0.1(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/form': 3.1.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.1(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/textfield': 3.12.5(react@19.2.7)
+      input-otp: 1.4.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/input@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/input@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/textfield': 3.18.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/textfield': 3.12.5(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-textarea-autosize: 8.5.9(@types/react@19.2.8)(react@19.2.6)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/textfield': 3.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/textfield': 3.12.5(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-textarea-autosize: 8.5.9(@types/react@19.2.17)(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
 
-  '@heroui/kbd@2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/kbd@2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/link@2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/link@2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-link': 2.2.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/link': 3.6.4(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-link': 2.2.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/link': 3.6.4(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/listbox@2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/listbox@2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mobile': 2.2.12(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/listbox': 3.14.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/list': 3.13.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@tanstack/react-virtual': 3.11.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mobile': 2.2.12(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/listbox': 3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/list': 3.13.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@tanstack/react-virtual': 3.11.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/menu@2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/menu@2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mobile': 2.2.12(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/menu': 3.19.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tree': 3.9.2(react@19.2.6)
-      '@react-types/menu': 3.10.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mobile': 2.2.12(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/menu': 3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tree': 3.9.2(react@19.2.7)
+      '@react-types/menu': 3.10.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/modal@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/modal@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-aria-modal-overlay': 2.2.18(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-disclosure': 2.2.16(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-draggable': 2.1.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-viewport-size': 2.0.1(react@19.2.6)
-      '@react-aria/dialog': 3.5.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.19(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-aria-modal-overlay': 2.2.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-disclosure': 2.2.16(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-draggable': 2.1.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-viewport-size': 2.0.1(react@19.2.7)
+      '@react-aria/dialog': 3.5.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.19(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/navbar@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/navbar@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-resize': 2.1.8(react@19.2.6)
-      '@heroui/use-scroll-position': 2.1.8(react@19.2.6)
-      '@react-aria/button': 3.14.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-resize': 2.1.8(react@19.2.7)
+      '@heroui/use-scroll-position': 2.1.8(react@19.2.7)
+      '@react-aria/button': 3.14.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/number-input@2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/number-input@2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/numberfield': 3.12.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/numberfield': 3.10.1(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/numberfield': 3.8.14(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/numberfield': 3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/numberfield': 3.10.1(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/numberfield': 3.8.14(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/pagination@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/pagination@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-intersection-observer': 2.2.14(react@19.2.6)
-      '@heroui/use-pagination': 2.2.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-intersection-observer': 2.2.14(react@19.2.7)
+      '@heroui/use-pagination': 2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
       scroll-into-view-if-needed: 3.0.10
 
-  '@heroui/popover@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/popover@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/dialog': 3.5.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.19(react@19.2.6)
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/dialog': 3.5.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.19(react@19.2.7)
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/progress@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/progress@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mounted': 2.1.8(react@19.2.6)
-      '@react-aria/progress': 3.4.26(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/progress': 3.5.15(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mounted': 2.1.8(react@19.2.7)
+      '@react-aria/progress': 3.4.26(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/progress': 3.5.15(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/radio@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/radio@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/radio': 3.12.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/radio': 3.11.1(react@19.2.6)
-      '@react-types/radio': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/radio': 3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/radio': 3.11.1(react@19.2.7)
+      '@react-types/radio': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/react-rsc-utils@2.1.9(react@19.2.6)':
+  '@heroui/react-rsc-utils@2.1.9(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/react-utils@2.1.13(react@19.2.6)':
+  '@heroui/react-utils@2.1.13(react@19.2.7)':
     dependencies:
-      '@heroui/react-rsc-utils': 2.1.9(react@19.2.6)
+      '@heroui/react-rsc-utils': 2.1.9(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/react@2.8.4(@types/react@19.2.8)(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(tailwindcss@4.1.18)':
+  '@heroui/react@2.8.4(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tailwindcss@4.1.18)':
     dependencies:
-      '@heroui/accordion': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/alert': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/autocomplete': 2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/badge': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/breadcrumbs': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/card': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/chip': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/code': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/date-picker': 2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/drawer': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dropdown': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/image': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/input-otp': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/kbd': 2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/link': 2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/navbar': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/number-input': 2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/pagination': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/progress': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/radio': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/select': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/skeleton': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/slider': 2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/snippet': 2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/switch': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/table': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/tabs': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/accordion': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/alert': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/autocomplete': 2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/badge': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/breadcrumbs': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/card': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/chip': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/code': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/date-picker': 2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/drawer': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dropdown': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/image': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/input-otp': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/kbd': 2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/link': 2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/navbar': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/number-input': 2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/pagination': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/progress': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/radio': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/select': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/skeleton': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/slider': 2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/snippet': 2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/switch': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/table': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/tabs': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/toast': 2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/user': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/toast': 2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/user': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
       - tailwindcss
 
-  '@heroui/ripple@2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/ripple@2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/scroll-shadow@2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/scroll-shadow@2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-data-scroll-overflow': 2.2.12(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-data-scroll-overflow': 2.2.12(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/select@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/select@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-aria-multiselect': 2.4.18(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-form-reset': 2.0.1(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/form': 3.1.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-aria-multiselect': 2.4.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-form-reset': 2.0.1(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/form': 3.1.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/shared-icons@2.1.10(react@19.2.6)':
+  '@heroui/shared-icons@2.1.10(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   '@heroui/shared-utils@2.1.11': {}
 
-  '@heroui/skeleton@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/skeleton@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/slider@2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/slider@2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/slider': 3.8.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/slider': 3.7.1(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/slider': 3.8.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/slider': 3.7.1(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/snippet@2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/snippet@2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-clipboard': 2.1.9(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-clipboard': 2.1.9(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/spacer@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/spacer@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/spinner@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/spinner@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/switch@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/switch@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/switch': 3.7.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/switch': 3.7.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/system-rsc@2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)':
+  '@heroui/system-rsc@2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)':
     dependencies:
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       clsx: 1.2.1
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@heroui/theme'
 
-  '@heroui/table@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/table@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/table': 3.17.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/table': 3.15.0(react@19.2.6)
-      '@react-stately/virtualizer': 4.4.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/grid': 3.3.5(react@19.2.6)
-      '@react-types/table': 3.13.3(react@19.2.6)
-      '@tanstack/react-virtual': 3.11.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/table': 3.17.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/table': 3.15.0(react@19.2.7)
+      '@react-stately/virtualizer': 4.4.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/grid': 3.3.5(react@19.2.7)
+      '@react-types/table': 3.13.3(react@19.2.7)
+      '@tanstack/react-virtual': 3.11.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/tabs@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/tabs@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mounted': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/tabs': 3.10.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tabs': 3.8.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mounted': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/tabs': 3.10.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tabs': 3.8.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
       scroll-into-view-if-needed: 3.0.10
 
   '@heroui/theme@2.4.22(tailwindcss@4.1.18)':
@@ -10580,212 +10590,212 @@ snapshots:
       tailwind-variants: 3.1.1(tailwind-merge@3.3.1)(tailwindcss@4.1.18)
       tailwindcss: 4.1.18
 
-  '@heroui/toast@2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/toast@2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mobile': 2.2.12(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/toast': 3.0.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toast': 3.1.2(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mobile': 2.2.12(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/toast': 3.0.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toast': 3.1.2(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/tooltip@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/tooltip@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/tooltip': 3.8.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tooltip': 3.5.7(react@19.2.6)
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      '@react-types/tooltip': 3.4.20(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/tooltip': 3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tooltip': 3.5.7(react@19.2.7)
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      '@react-types/tooltip': 3.4.20(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/use-aria-accordion@2.2.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-accordion@2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/button': 3.14.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.25.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tree': 3.9.2(react@19.2.6)
-      '@react-types/accordion': 3.0.0-alpha.26(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/button': 3.14.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.25.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tree': 3.9.2(react@19.2.7)
+      '@react-types/accordion': 3.0.0-alpha.26(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-aria-button@2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-button@2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-aria-link@2.2.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-link@2.2.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/link': 3.6.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/link': 3.6.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-aria-modal-overlay@2.2.18(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-modal-overlay@2.2.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.19(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.19(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/use-aria-multiselect@2.4.18(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-multiselect@2.4.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.21(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/listbox': 3.14.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/menu': 3.19.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.25.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.1(react@19.2.6)
-      '@react-stately/list': 3.13.0(react@19.2.6)
-      '@react-stately/menu': 3.9.7(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.21(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/listbox': 3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/menu': 3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.25.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.1(react@19.2.7)
+      '@react-stately/list': 3.13.0(react@19.2.7)
+      '@react-stately/menu': 3.9.7(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/use-aria-overlay@2.0.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-overlay@2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/use-callback-ref@2.1.8(react@19.2.6)':
+  '@heroui/use-callback-ref@2.1.8(react@19.2.7)':
     dependencies:
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      react: 19.2.6
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      react: 19.2.7
 
-  '@heroui/use-clipboard@2.1.9(react@19.2.6)':
+  '@heroui/use-clipboard@2.1.9(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-data-scroll-overflow@2.2.12(react@19.2.6)':
+  '@heroui/use-data-scroll-overflow@2.2.12(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-disclosure@2.2.16(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-disclosure@2.2.16(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/use-callback-ref': 2.1.8(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      react: 19.2.6
+      '@heroui/use-callback-ref': 2.1.8(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-draggable@2.1.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-draggable@2.1.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-form-reset@2.0.1(react@19.2.6)':
+  '@heroui/use-form-reset@2.0.1(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-image@2.1.12(react@19.2.6)':
+  '@heroui/use-image@2.1.12(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      react: 19.2.6
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      react: 19.2.7
 
-  '@heroui/use-intersection-observer@2.2.14(react@19.2.6)':
+  '@heroui/use-intersection-observer@2.2.14(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-is-mobile@2.2.12(react@19.2.6)':
+  '@heroui/use-is-mobile@2.2.12(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      react: 19.2.7
 
-  '@heroui/use-is-mounted@2.1.8(react@19.2.6)':
+  '@heroui/use-is-mounted@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-measure@2.1.8(react@19.2.6)':
+  '@heroui/use-measure@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-pagination@2.2.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-pagination@2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-resize@2.1.8(react@19.2.6)':
+  '@heroui/use-resize@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-safe-layout-effect@2.1.8(react@19.2.6)':
+  '@heroui/use-safe-layout-effect@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-scroll-position@2.1.8(react@19.2.6)':
+  '@heroui/use-scroll-position@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-viewport-size@2.0.1(react@19.2.6)':
+  '@heroui/use-viewport-size@2.0.1(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/user@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/user@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@hono/node-server@1.19.14(hono@4.12.18)':
+  '@hono/node-server@1.19.14(hono@4.12.21)':
     dependencies:
-      hono: 4.12.18
+      hono: 4.12.21
 
-  '@hookform/resolvers@5.2.2(react-hook-form@7.62.0(react@19.2.6))':
+  '@hookform/resolvers@5.2.2(react-hook-form@7.62.0(react@19.2.7))':
     dependencies:
       '@standard-schema/utils': 0.3.0
-      react-hook-form: 7.62.0(react@19.2.6)
+      react-hook-form: 7.62.0(react@19.2.7)
 
   '@humanfs/core@0.19.1': {}
 
@@ -10798,10 +10808,10 @@ snapshots:
 
   '@humanwhocodes/retry@0.4.3': {}
 
-  '@iconify/react@5.2.1(react@19.2.6)':
+  '@iconify/react@5.2.1(react@19.2.7)':
     dependencies:
       '@iconify/types': 2.0.0
-      react: 19.2.6
+      react: 19.2.7
 
   '@iconify/types@2.0.0': {}
 
@@ -11094,7 +11104,7 @@ snapshots:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       uuid: 11.1.1
 
-  '@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)':
+  '@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)':
     dependencies:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       '@langchain/protocol': 0.0.15
@@ -11103,8 +11113,8 @@ snapshots:
       p-retry: 7.1.1
       uuid: 11.1.1
     optionalDependencies:
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@opentelemetry/api'
       - '@opentelemetry/exporter-trace-otlp-proto'
@@ -11112,11 +11122,11 @@ snapshots:
       - openai
       - ws
 
-  '@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)':
+  '@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)':
     dependencies:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))
-      '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)
+      '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)
       '@langchain/protocol': 0.0.15
       '@standard-schema/spec': 1.1.0
       uuid: 11.1.1
@@ -11134,10 +11144,10 @@ snapshots:
       - vue
       - ws
 
-  '@langchain/mcp-adapters@1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))':
+  '@langchain/mcp-adapters@1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))':
     dependencies:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
-      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
+      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
       '@modelcontextprotocol/sdk': 1.26.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)
       debug: 4.4.3
       zod: 4.4.3
@@ -11178,7 +11188,7 @@ snapshots:
 
   '@modelcontextprotocol/sdk@1.26.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)':
     dependencies:
-      '@hono/node-server': 1.19.14(hono@4.12.18)
+      '@hono/node-server': 1.19.14(hono@4.12.21)
       ajv: 8.18.0
       ajv-formats: 3.0.1(ajv@8.18.0)
       content-type: 1.0.5
@@ -11188,7 +11198,7 @@ snapshots:
       eventsource-parser: 3.0.6
       express: 5.2.1
       express-rate-limit: 8.5.1(express@5.2.1)
-      hono: 4.12.18
+      hono: 4.12.21
       jose: 6.1.3
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
@@ -11218,40 +11228,40 @@ snapshots:
 
   '@ndaidong/bellajs@12.0.1': {}
 
-  '@next/env@16.2.6': {}
+  '@next/env@16.2.9': {}
 
-  '@next/eslint-plugin-next@16.2.6':
+  '@next/eslint-plugin-next@16.2.9':
     dependencies:
       fast-glob: 3.3.1
 
-  '@next/swc-darwin-arm64@16.2.6':
+  '@next/swc-darwin-arm64@16.2.9':
     optional: true
 
-  '@next/swc-darwin-x64@16.2.6':
+  '@next/swc-darwin-x64@16.2.9':
     optional: true
 
-  '@next/swc-linux-arm64-gnu@16.2.6':
+  '@next/swc-linux-arm64-gnu@16.2.9':
     optional: true
 
-  '@next/swc-linux-arm64-musl@16.2.6':
+  '@next/swc-linux-arm64-musl@16.2.9':
     optional: true
 
-  '@next/swc-linux-x64-gnu@16.2.6':
+  '@next/swc-linux-x64-gnu@16.2.9':
     optional: true
 
-  '@next/swc-linux-x64-musl@16.2.6':
+  '@next/swc-linux-x64-musl@16.2.9':
     optional: true
 
-  '@next/swc-win32-arm64-msvc@16.2.6':
+  '@next/swc-win32-arm64-msvc@16.2.9':
     optional: true
 
-  '@next/swc-win32-x64-msvc@16.2.6':
+  '@next/swc-win32-x64-msvc@16.2.9':
     optional: true
 
-  '@next/third-parties@16.2.6(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)':
+  '@next/third-parties@16.2.9(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)':
     dependencies:
-      next: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
+      next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
       third-party-capital: 1.0.20
 
   '@nodable/entities@2.1.0': {}
@@ -11673,1678 +11683,1678 @@ snapshots:
 
   '@radix-ui/primitive@1.1.3': {}
 
-  '@radix-ui/react-alert-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-alert-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-avatar@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-avatar@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-context': 1.1.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-context': 1.1.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-checkbox@1.3.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-checkbox@1.3.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-context@1.1.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-context@1.1.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-context@1.1.3(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-context@1.1.3(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
       aria-hidden: 1.2.6
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-direction@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-direction@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-dismissable-layer@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dismissable-layer@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-dropdown-menu@2.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dropdown-menu@2.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-menu': 2.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-menu': 2.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-focus-guards@1.1.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-focus-guards@1.1.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-icons@1.3.2(react@19.2.6)':
+  '@radix-ui/react-icons@1.3.2(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@radix-ui/react-id@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-id@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-label@2.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-label@2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-menu@2.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-menu@2.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-popper': 1.2.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-roving-focus': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-popper': 1.2.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-roving-focus': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
       aria-hidden: 1.2.6
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
       aria-hidden: 1.2.6
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-popper@1.2.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-popper@1.2.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.8)(react@19.2.6)
+      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
       '@radix-ui/rect': 1.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.8)(react@19.2.6)
+      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
       '@radix-ui/rect': 1.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-presence@1.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-presence@1.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-primitive@2.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-primitive@2.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.4(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-slot': 1.2.4(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-progress@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-progress@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-roving-focus@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-roving-focus@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-select@2.2.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-select@2.2.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-popper': 1.2.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-popper': 1.2.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       aria-hidden: 1.2.6
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-slot@1.2.3(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-slot@1.2.3(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-slot@1.2.4(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-slot@1.2.4(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-toast@1.2.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-toast@1.2.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      react: 19.2.7
+      use-sync-external-store: 1.6.0(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
       '@radix-ui/rect': 1.1.1
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
   '@radix-ui/rect@1.1.1': {}
 
-  '@react-aria/breadcrumbs@3.5.28(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/breadcrumbs@3.5.28(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/link': 3.8.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/breadcrumbs': 3.7.16(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/link': 3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/breadcrumbs': 3.7.16(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/button@3.14.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/button@3.14.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/toolbar': 3.0.0-beta.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/toolbar': 3.0.0-beta.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/calendar@3.9.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/calendar@3.9.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/calendar': 3.8.4(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/calendar': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/calendar': 3.8.4(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/calendar': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/checkbox@3.16.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/checkbox@3.16.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/toggle': 3.12.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/checkbox': 3.7.1(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-types/checkbox': 3.10.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/toggle': 3.12.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/checkbox': 3.7.1(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-types/checkbox': 3.10.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/combobox@3.13.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/combobox@3.13.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/listbox': 3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/listbox': 3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/menu': 3.19.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.31.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/textfield': 3.18.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/combobox': 3.11.1(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/combobox': 3.13.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/menu': 3.19.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/textfield': 3.18.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/combobox': 3.11.1(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/combobox': 3.13.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/datepicker@3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/datepicker@3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/number': 3.6.5
       '@internationalized/string': 3.2.7
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/spinbutton': 3.7.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/datepicker': 3.15.1(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/calendar': 3.8.1(react@19.2.6)
-      '@react-types/datepicker': 3.13.2(react@19.2.6)
-      '@react-types/dialog': 3.5.22(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/spinbutton': 3.7.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/datepicker': 3.15.1(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/calendar': 3.8.1(react@19.2.7)
+      '@react-types/datepicker': 3.13.2(react@19.2.7)
+      '@react-types/dialog': 3.5.22(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/dialog@3.5.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/dialog@3.5.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/dialog': 3.5.22(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/dialog': 3.5.22(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/focus@3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/focus@3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
       clsx: 2.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/focus@3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/focus@3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
       clsx: 2.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/form@3.1.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/form@3.1.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/form@3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/form@3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/grid@3.14.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/grid@3.14.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/grid': 3.11.7(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/grid': 3.3.6(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/grid': 3.11.7(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/grid': 3.3.6(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/i18n@3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/i18n@3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/message': 3.1.8
       '@internationalized/number': 3.6.5
       '@internationalized/string': 3.2.7
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/i18n@3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/i18n@3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/message': 3.1.8
       '@internationalized/number': 3.6.5
       '@internationalized/string': 3.2.7
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/i18n@3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/i18n@3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/message': 3.1.8
       '@internationalized/number': 3.6.5
       '@internationalized/string': 3.2.7
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/interactions@3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/interactions@3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/interactions@3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/interactions@3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.18
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/label@3.7.21(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/label@3.7.21(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/label@3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/label@3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/landmark@3.0.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/landmark@3.0.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      use-sync-external-store: 1.6.0(react@19.2.7)
 
-  '@react-aria/link@3.8.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/link@3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/link': 3.6.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/link': 3.6.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/listbox@3.14.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/listbox@3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/list': 3.13.0(react@19.2.6)
-      '@react-types/listbox': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/list': 3.13.0(react@19.2.7)
+      '@react-types/listbox': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/listbox@3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/listbox@3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/list': 3.13.2(react@19.2.6)
-      '@react-types/listbox': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/list': 3.13.2(react@19.2.7)
+      '@react-types/listbox': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   '@react-aria/live-announcer@3.4.4':
     dependencies:
       '@swc/helpers': 0.5.21
 
-  '@react-aria/menu@3.19.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/menu@3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.31.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/menu': 3.9.9(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/tree': 3.9.2(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/menu': 3.10.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/menu': 3.9.9(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/tree': 3.9.2(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/menu': 3.10.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/menu@3.19.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/menu@3.19.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.31.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/menu': 3.9.9(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/tree': 3.9.4(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/menu': 3.10.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/menu': 3.9.9(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/tree': 3.9.4(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/menu': 3.10.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/numberfield@3.12.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/numberfield@3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/spinbutton': 3.7.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/textfield': 3.18.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/numberfield': 3.10.1(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/numberfield': 3.8.14(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/spinbutton': 3.7.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/textfield': 3.18.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/numberfield': 3.10.1(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/numberfield': 3.8.14(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/overlays@3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/overlays@3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.19(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.19(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/overlays@3.31.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/overlays@3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/progress@3.4.26(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/progress@3.4.26(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/progress': 3.5.15(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/progress': 3.5.15(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/radio@3.12.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/radio@3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/radio': 3.11.1(react@19.2.6)
-      '@react-types/radio': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/radio': 3.11.1(react@19.2.7)
+      '@react-types/radio': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/selection@3.25.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/selection@3.25.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/selection@3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/selection@3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/slider@3.8.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/slider@3.8.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/slider': 3.7.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/slider': 3.8.2(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/slider': 3.7.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/slider': 3.8.2(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/spinbutton@3.7.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/spinbutton@3.7.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/ssr@3.9.10(react@19.2.6)':
+  '@react-aria/ssr@3.9.10(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-aria/ssr@3.9.4(react@19.2.6)':
+  '@react-aria/ssr@3.9.4(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-aria/switch@3.7.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/switch@3.7.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/toggle': 3.12.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/switch': 3.5.15(react@19.2.6)
+      '@react-aria/toggle': 3.12.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/switch': 3.5.15(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/table@3.17.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/table@3.17.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/grid': 3.14.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/grid': 3.14.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-stately/table': 3.15.0(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/grid': 3.3.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/table': 3.13.3(react@19.2.6)
+      '@react-stately/table': 3.15.0(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/grid': 3.3.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/table': 3.13.3(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/tabs@3.10.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/tabs@3.10.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tabs': 3.8.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/tabs': 3.3.20(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tabs': 3.8.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/tabs': 3.3.20(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/textfield@3.18.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/textfield@3.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/textfield': 3.12.5(react@19.2.6)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/textfield': 3.12.5(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/textfield@3.18.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/textfield@3.18.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/textfield': 3.12.6(react@19.2.6)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/textfield': 3.12.6(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/toast@3.0.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/toast@3.0.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/landmark': 3.0.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toast': 3.1.2(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/landmark': 3.0.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toast': 3.1.2(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/toggle@3.12.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/toggle@3.12.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.3(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.3(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/toolbar@3.0.0-beta.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/toolbar@3.0.0-beta.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/tooltip@3.8.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/tooltip@3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tooltip': 3.5.7(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/tooltip': 3.4.20(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tooltip': 3.5.7(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/tooltip': 3.4.20(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/utils@3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/utils@3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
       clsx: 2.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/utils@3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/utils@3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.18
       clsx: 2.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/visually-hidden@3.8.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/visually-hidden@3.8.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@react-aria/visually-hidden@3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/visually-hidden@3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.18
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/visually-hidden@3.8.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/visually-hidden@3.8.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-stately/calendar@3.8.4(react@19.2.6)':
+  '@react-stately/calendar@3.8.4(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/calendar': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/calendar': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/checkbox@3.7.1(react@19.2.6)':
+  '@react-stately/checkbox@3.7.1(react@19.2.7)':
     dependencies:
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/checkbox': 3.10.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/checkbox': 3.10.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/collections@3.12.7(react@19.2.6)':
+  '@react-stately/collections@3.12.7(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/collections@3.12.8(react@19.2.6)':
+  '@react-stately/collections@3.12.8(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/combobox@3.11.1(react@19.2.6)':
+  '@react-stately/combobox@3.11.1(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/list': 3.13.2(react@19.2.6)
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-stately/select': 3.9.0(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/combobox': 3.13.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/list': 3.13.2(react@19.2.7)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-stately/select': 3.9.0(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/combobox': 3.13.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/datepicker@3.15.1(react@19.2.6)':
+  '@react-stately/datepicker@3.15.1(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/string': 3.2.7
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/datepicker': 3.13.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/datepicker': 3.13.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
   '@react-stately/flags@3.1.2':
     dependencies:
       '@swc/helpers': 0.5.18
 
-  '@react-stately/form@3.2.1(react@19.2.6)':
+  '@react-stately/form@3.2.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/form@3.2.2(react@19.2.6)':
+  '@react-stately/form@3.2.2(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/grid@3.11.7(react@19.2.6)':
+  '@react-stately/grid@3.11.7(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-types/grid': 3.3.6(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-types/grid': 3.3.6(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/list@3.13.0(react@19.2.6)':
+  '@react-stately/list@3.13.0(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/list@3.13.2(react@19.2.6)':
+  '@react-stately/list@3.13.2(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/menu@3.9.7(react@19.2.6)':
+  '@react-stately/menu@3.9.7(react@19.2.7)':
     dependencies:
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-types/menu': 3.10.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-types/menu': 3.10.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/menu@3.9.9(react@19.2.6)':
+  '@react-stately/menu@3.9.9(react@19.2.7)':
     dependencies:
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-types/menu': 3.10.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-types/menu': 3.10.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/numberfield@3.10.1(react@19.2.6)':
+  '@react-stately/numberfield@3.10.1(react@19.2.7)':
     dependencies:
       '@internationalized/number': 3.6.5
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/numberfield': 3.8.14(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/numberfield': 3.8.14(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/overlays@3.6.19(react@19.2.6)':
+  '@react-stately/overlays@3.6.19(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/overlays@3.6.21(react@19.2.6)':
+  '@react-stately/overlays@3.6.21(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/radio@3.11.1(react@19.2.6)':
+  '@react-stately/radio@3.11.1(react@19.2.7)':
     dependencies:
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/radio': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/radio': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/select@3.9.0(react@19.2.6)':
+  '@react-stately/select@3.9.0(react@19.2.7)':
     dependencies:
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/list': 3.13.2(react@19.2.6)
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/select': 3.12.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/list': 3.13.2(react@19.2.7)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/select': 3.12.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/selection@3.20.7(react@19.2.6)':
+  '@react-stately/selection@3.20.7(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/slider@3.7.1(react@19.2.6)':
+  '@react-stately/slider@3.7.1(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/slider': 3.8.2(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/slider': 3.8.2(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/table@3.15.0(react@19.2.6)':
+  '@react-stately/table@3.15.0(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-stately/grid': 3.11.7(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/grid': 3.3.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/table': 3.13.3(react@19.2.6)
+      '@react-stately/grid': 3.11.7(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/grid': 3.3.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/table': 3.13.3(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/tabs@3.8.5(react@19.2.6)':
+  '@react-stately/tabs@3.8.5(react@19.2.7)':
     dependencies:
-      '@react-stately/list': 3.13.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/tabs': 3.3.20(react@19.2.6)
+      '@react-stately/list': 3.13.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/tabs': 3.3.20(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/toast@3.1.2(react@19.2.6)':
+  '@react-stately/toast@3.1.2(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      react: 19.2.7
+      use-sync-external-store: 1.6.0(react@19.2.7)
 
-  '@react-stately/toggle@3.9.1(react@19.2.6)':
+  '@react-stately/toggle@3.9.1(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/toggle@3.9.3(react@19.2.6)':
+  '@react-stately/toggle@3.9.3(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/tooltip@3.5.7(react@19.2.6)':
+  '@react-stately/tooltip@3.5.7(react@19.2.7)':
     dependencies:
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-types/tooltip': 3.4.20(react@19.2.6)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-types/tooltip': 3.4.20(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/tree@3.9.2(react@19.2.6)':
+  '@react-stately/tree@3.9.2(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/tree@3.9.4(react@19.2.6)':
+  '@react-stately/tree@3.9.4(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/utils@3.10.8(react@19.2.6)':
+  '@react-stately/utils@3.10.8(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/utils@3.11.0(react@19.2.6)':
+  '@react-stately/utils@3.11.0(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/virtualizer@4.4.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-stately/virtualizer@4.4.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-types/accordion@3.0.0-alpha.26(react@19.2.6)':
+  '@react-types/accordion@3.0.0-alpha.26(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/breadcrumbs@3.7.16(react@19.2.6)':
+  '@react-types/breadcrumbs@3.7.16(react@19.2.7)':
     dependencies:
-      '@react-types/link': 3.6.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/link': 3.6.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/button@3.14.0(react@19.2.6)':
+  '@react-types/button@3.14.0(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/button@3.14.1(react@19.2.6)':
+  '@react-types/button@3.14.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/calendar@3.7.4(react@19.2.6)':
+  '@react-types/calendar@3.7.4(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/calendar@3.8.1(react@19.2.6)':
+  '@react-types/calendar@3.8.1(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/checkbox@3.10.1(react@19.2.6)':
+  '@react-types/checkbox@3.10.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/checkbox@3.10.2(react@19.2.6)':
+  '@react-types/checkbox@3.10.2(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/combobox@3.13.8(react@19.2.6)':
+  '@react-types/combobox@3.13.8(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/datepicker@3.13.1(react@19.2.6)':
+  '@react-types/datepicker@3.13.1(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-types/calendar': 3.8.1(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/calendar': 3.8.1(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/datepicker@3.13.2(react@19.2.6)':
+  '@react-types/datepicker@3.13.2(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-types/calendar': 3.8.1(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/calendar': 3.8.1(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/dialog@3.5.22(react@19.2.6)':
+  '@react-types/dialog@3.5.22(react@19.2.7)':
     dependencies:
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/form@3.7.15(react@19.2.6)':
+  '@react-types/form@3.7.15(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/grid@3.3.5(react@19.2.6)':
+  '@react-types/grid@3.3.5(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/grid@3.3.6(react@19.2.6)':
+  '@react-types/grid@3.3.6(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/link@3.6.4(react@19.2.6)':
+  '@react-types/link@3.6.4(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/link@3.6.5(react@19.2.6)':
+  '@react-types/link@3.6.5(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/listbox@3.7.4(react@19.2.6)':
+  '@react-types/listbox@3.7.4(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/menu@3.10.4(react@19.2.6)':
+  '@react-types/menu@3.10.4(react@19.2.7)':
     dependencies:
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/menu@3.10.5(react@19.2.6)':
+  '@react-types/menu@3.10.5(react@19.2.7)':
     dependencies:
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/numberfield@3.8.14(react@19.2.6)':
+  '@react-types/numberfield@3.8.14(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/overlays@3.9.1(react@19.2.6)':
+  '@react-types/overlays@3.9.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/overlays@3.9.2(react@19.2.6)':
+  '@react-types/overlays@3.9.2(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/progress@3.5.15(react@19.2.6)':
+  '@react-types/progress@3.5.15(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/radio@3.9.1(react@19.2.6)':
+  '@react-types/radio@3.9.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/select@3.12.0(react@19.2.6)':
+  '@react-types/select@3.12.0(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/shared@3.26.0(react@19.2.6)':
+  '@react-types/shared@3.26.0(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-types/slider@3.8.2(react@19.2.6)':
+  '@react-types/slider@3.8.2(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/switch@3.5.15(react@19.2.6)':
+  '@react-types/switch@3.5.15(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/table@3.13.3(react@19.2.6)':
+  '@react-types/table@3.13.3(react@19.2.7)':
     dependencies:
-      '@react-types/grid': 3.3.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/grid': 3.3.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/tabs@3.3.20(react@19.2.6)':
+  '@react-types/tabs@3.3.20(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/textfield@3.12.5(react@19.2.6)':
+  '@react-types/textfield@3.12.5(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/textfield@3.12.6(react@19.2.6)':
+  '@react-types/textfield@3.12.6(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/tooltip@3.4.20(react@19.2.6)':
+  '@react-types/tooltip@3.4.20(react@19.2.7)':
     dependencies:
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
   '@rolldown/pluginutils@1.0.0-beta.53': {}
 
@@ -13531,7 +13541,7 @@ snapshots:
 
   '@sentry/core@10.27.0': {}
 
-  '@sentry/nextjs@10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))':
+  '@sentry/nextjs@10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))':
     dependencies:
       '@opentelemetry/api': 1.9.0
       '@opentelemetry/semantic-conventions': 1.39.0
@@ -13541,10 +13551,10 @@ snapshots:
       '@sentry/core': 10.27.0
       '@sentry/node': 10.27.0
       '@sentry/opentelemetry': 10.27.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.39.0)
-      '@sentry/react': 10.27.0(react@19.2.6)
+      '@sentry/react': 10.27.0(react@19.2.7)
       '@sentry/vercel-edge': 10.27.0
       '@sentry/webpack-plugin': 4.7.0(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
-      next: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       resolve: 1.22.8
       rollup: 4.59.0
       stacktrace-parser: 0.1.11
@@ -13622,12 +13632,12 @@ snapshots:
       '@opentelemetry/semantic-conventions': 1.39.0
       '@sentry/core': 10.27.0
 
-  '@sentry/react@10.27.0(react@19.2.6)':
+  '@sentry/react@10.27.0(react@19.2.7)':
     dependencies:
       '@sentry/browser': 10.27.0
       '@sentry/core': 10.27.0
       hoist-non-react-statics: 3.3.2
-      react: 19.2.6
+      react: 19.2.7
 
   '@sentry/vercel-edge@10.27.0':
     dependencies:
@@ -13975,17 +13985,17 @@ snapshots:
       postcss-selector-parser: 6.0.10
       tailwindcss: 4.1.18
 
-  '@tanstack/react-table@8.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@tanstack/react-table@8.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@tanstack/table-core': 8.21.3
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@tanstack/react-virtual@3.11.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@tanstack/react-virtual@3.11.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@tanstack/virtual-core': 3.11.3
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   '@tanstack/table-core@8.21.3': {}
 
@@ -14011,15 +14021,15 @@ snapshots:
       picocolors: 1.1.1
       redent: 3.0.0
 
-  '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@babel/runtime': 7.28.6
       '@testing-library/dom': 10.4.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
   '@testing-library/user-event@14.6.1(@testing-library/dom@10.4.1)':
     dependencies:
@@ -14239,11 +14249,11 @@ snapshots:
       pg-protocol: 1.11.0
       pg-types: 2.2.0
 
-  '@types/react-dom@19.2.3(@types/react@19.2.8)':
+  '@types/react-dom@19.2.3(@types/react@19.2.17)':
     dependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@types/react@19.2.8':
+  '@types/react@19.2.17':
     dependencies:
       csstype: 3.2.3
 
@@ -14333,7 +14343,7 @@ snapshots:
 
   '@typescript-eslint/types@8.59.3': {}
 
-  '@typescript-eslint/types@8.60.0': {}
+  '@typescript-eslint/types@8.61.1': {}
 
   '@typescript-eslint/typescript-estree@8.59.3(typescript@5.5.4)':
     dependencies:
@@ -14376,7 +14386,7 @@ snapshots:
       '@codemirror/state': 6.6.0
       '@codemirror/view': 6.40.0
 
-  '@uiw/react-codemirror@4.25.8(@babel/runtime@7.28.6)(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.40.0)(codemirror@6.0.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@uiw/react-codemirror@4.25.8(@babel/runtime@7.28.6)(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.40.0)(codemirror@6.0.2)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@babel/runtime': 7.28.6
       '@codemirror/commands': 6.10.3
@@ -14385,8 +14395,8 @@ snapshots:
       '@codemirror/view': 6.40.0
       '@uiw/codemirror-extensions-basic-setup': 4.25.8(@codemirror/autocomplete@6.20.1)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/view@6.40.0)
       codemirror: 6.0.2
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@codemirror/autocomplete'
       - '@codemirror/language'
@@ -14470,7 +14480,7 @@ snapshots:
       d3-selection: 3.0.0
       d3-transition: 3.0.1(d3-selection@3.0.0)
 
-  '@vercel/oidc@3.0.5': {}
+  '@vercel/oidc@3.2.0': {}
 
   '@vitejs/plugin-react@5.1.2(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))':
     dependencies:
@@ -14484,29 +14494,29 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/browser-playwright@4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.0.18)':
+  '@vitest/browser-playwright@4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)':
     dependencies:
-      '@vitest/browser': 4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.0.18)
-      '@vitest/mocker': 4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+      '@vitest/browser': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
+      '@vitest/mocker': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
       playwright: 1.56.1
       tinyrainbow: 3.1.0
-      vitest: 4.0.18(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.0.18)(jiti@2.7.0)(jsdom@27.4.0)(lightningcss@1.30.2)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(terser@5.47.1)(yaml@2.9.0)
+      vitest: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
     transitivePeerDependencies:
       - bufferutil
       - msw
       - utf-8-validate
       - vite
 
-  '@vitest/browser@4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.0.18)':
+  '@vitest/browser@4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)':
     dependencies:
-      '@vitest/mocker': 4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
-      '@vitest/utils': 4.0.18
+      '@blazediff/core': 1.9.1
+      '@vitest/mocker': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+      '@vitest/utils': 4.1.8
       magic-string: 0.30.21
-      pixelmatch: 7.1.0
       pngjs: 7.0.0
       sirv: 3.0.2
       tinyrainbow: 3.1.0
-      vitest: 4.0.18(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.0.18)(jiti@2.7.0)(jsdom@27.4.0)(lightningcss@1.30.2)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(terser@5.47.1)(yaml@2.9.0)
+      vitest: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
       ws: 8.20.1
     transitivePeerDependencies:
       - bufferutil
@@ -14514,60 +14524,62 @@ snapshots:
       - utf-8-validate
       - vite
 
-  '@vitest/coverage-v8@4.0.18(@vitest/browser@4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.0.18))(vitest@4.0.18)':
+  '@vitest/coverage-v8@4.1.8(@vitest/browser@4.1.8)(vitest@4.1.8)':
     dependencies:
       '@bcoe/v8-coverage': 1.0.2
-      '@vitest/utils': 4.0.18
-      ast-v8-to-istanbul: 0.3.12
+      '@vitest/utils': 4.1.8
+      ast-v8-to-istanbul: 1.0.3
       istanbul-lib-coverage: 3.2.2
       istanbul-lib-report: 3.0.1
       istanbul-reports: 3.2.0
       magicast: 0.5.2
       obug: 2.1.1
-      std-env: 3.10.0
+      std-env: 4.1.0
       tinyrainbow: 3.1.0
-      vitest: 4.0.18(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.0.18)(jiti@2.7.0)(jsdom@27.4.0)(lightningcss@1.30.2)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(terser@5.47.1)(yaml@2.9.0)
+      vitest: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
     optionalDependencies:
-      '@vitest/browser': 4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.0.18)
+      '@vitest/browser': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
 
-  '@vitest/expect@4.0.18':
+  '@vitest/expect@4.1.8':
     dependencies:
       '@standard-schema/spec': 1.1.0
       '@types/chai': 5.2.3
-      '@vitest/spy': 4.0.18
-      '@vitest/utils': 4.0.18
+      '@vitest/spy': 4.1.8
+      '@vitest/utils': 4.1.8
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))':
+  '@vitest/mocker@4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))':
     dependencies:
-      '@vitest/spy': 4.0.18
+      '@vitest/spy': 4.1.8
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
       msw: 2.13.4(@types/node@24.10.8)(typescript@5.5.4)
       vite: 7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0)
 
-  '@vitest/pretty-format@4.0.18':
+  '@vitest/pretty-format@4.1.8':
     dependencies:
       tinyrainbow: 3.1.0
 
-  '@vitest/runner@4.0.18':
+  '@vitest/runner@4.1.8':
     dependencies:
-      '@vitest/utils': 4.0.18
+      '@vitest/utils': 4.1.8
       pathe: 2.0.3
 
-  '@vitest/snapshot@4.0.18':
+  '@vitest/snapshot@4.1.8':
     dependencies:
-      '@vitest/pretty-format': 4.0.18
+      '@vitest/pretty-format': 4.1.8
+      '@vitest/utils': 4.1.8
       magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@4.0.18': {}
+  '@vitest/spy@4.1.8': {}
 
-  '@vitest/utils@4.0.18':
+  '@vitest/utils@4.1.8':
     dependencies:
-      '@vitest/pretty-format': 4.0.18
+      '@vitest/pretty-format': 4.1.8
+      convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
   '@webassemblyjs/ast@1.14.1':
@@ -14650,13 +14662,13 @@ snapshots:
 
   '@xtuc/long@4.2.2': {}
 
-  '@xyflow/react@12.10.2(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@xyflow/react@12.10.2(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@xyflow/system': 0.0.76
       classcat: 5.0.5
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      zustand: 4.5.7(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      zustand: 4.5.7(@types/react@19.2.17)(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
       - immer
@@ -14702,11 +14714,11 @@ snapshots:
 
   agent-base@7.1.4: {}
 
-  ai@5.0.109(zod@4.4.3):
+  ai@6.0.203(zod@4.4.3):
     dependencies:
-      '@ai-sdk/gateway': 2.0.18(zod@4.4.3)
-      '@ai-sdk/provider': 2.0.0
-      '@ai-sdk/provider-utils': 3.0.18(zod@4.4.3)
+      '@ai-sdk/gateway': 3.0.129(zod@4.4.3)
+      '@ai-sdk/provider': 3.0.10
+      '@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
       '@opentelemetry/api': 1.9.0
       zod: 4.4.3
 
@@ -14827,7 +14839,7 @@ snapshots:
 
   ast-types-flow@0.0.8: {}
 
-  ast-v8-to-istanbul@0.3.12:
+  ast-v8-to-istanbul@1.0.3:
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       estree-walker: 3.0.3
@@ -14871,7 +14883,7 @@ snapshots:
       http-errors: 2.0.1
       iconv-lite: 0.7.2
       on-finished: 2.4.1
-      qs: 6.14.2
+      qs: 6.15.2
       raw-body: 3.0.2
       type-is: 2.0.1
     transitivePeerDependencies:
@@ -14988,14 +15000,14 @@ snapshots:
 
   clsx@2.1.1: {}
 
-  cmdk@1.1.1(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  cmdk@1.1.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -15381,7 +15393,7 @@ snapshots:
       '@babel/runtime': 7.28.6
       csstype: 3.2.3
 
-  dompurify@3.4.2:
+  dompurify@3.4.10:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -15391,6 +15403,8 @@ snapshots:
 
   dotenv@16.6.1: {}
 
+  driver.js@1.4.0: {}
+
   dunder-proto@1.0.1:
     dependencies:
       call-bind-apply-helpers: 1.0.2
@@ -15498,8 +15512,6 @@ snapshots:
       iterator.prototype: 1.1.5
       safe-array-concat: 1.1.3
 
-  es-module-lexer@1.7.0: {}
-
   es-module-lexer@2.1.0: {}
 
   es-object-atoms@1.1.1:
@@ -15525,34 +15537,34 @@ snapshots:
 
   es-toolkit@1.46.1: {}
 
-  esbuild@0.27.7:
+  esbuild@0.28.1:
     optionalDependencies:
-      '@esbuild/aix-ppc64': 0.27.7
-      '@esbuild/android-arm': 0.27.7
-      '@esbuild/android-arm64': 0.27.7
-      '@esbuild/android-x64': 0.27.7
-      '@esbuild/darwin-arm64': 0.27.7
-      '@esbuild/darwin-x64': 0.27.7
-      '@esbuild/freebsd-arm64': 0.27.7
-      '@esbuild/freebsd-x64': 0.27.7
-      '@esbuild/linux-arm': 0.27.7
-      '@esbuild/linux-arm64': 0.27.7
-      '@esbuild/linux-ia32': 0.27.7
-      '@esbuild/linux-loong64': 0.27.7
-      '@esbuild/linux-mips64el': 0.27.7
-      '@esbuild/linux-ppc64': 0.27.7
-      '@esbuild/linux-riscv64': 0.27.7
-      '@esbuild/linux-s390x': 0.27.7
-      '@esbuild/linux-x64': 0.27.7
-      '@esbuild/netbsd-arm64': 0.27.7
-      '@esbuild/netbsd-x64': 0.27.7
-      '@esbuild/openbsd-arm64': 0.27.7
-      '@esbuild/openbsd-x64': 0.27.7
-      '@esbuild/openharmony-arm64': 0.27.7
-      '@esbuild/sunos-x64': 0.27.7
-      '@esbuild/win32-arm64': 0.27.7
-      '@esbuild/win32-ia32': 0.27.7
-      '@esbuild/win32-x64': 0.27.7
+      '@esbuild/aix-ppc64': 0.28.1
+      '@esbuild/android-arm': 0.28.1
+      '@esbuild/android-arm64': 0.28.1
+      '@esbuild/android-x64': 0.28.1
+      '@esbuild/darwin-arm64': 0.28.1
+      '@esbuild/darwin-x64': 0.28.1
+      '@esbuild/freebsd-arm64': 0.28.1
+      '@esbuild/freebsd-x64': 0.28.1
+      '@esbuild/linux-arm': 0.28.1
+      '@esbuild/linux-arm64': 0.28.1
+      '@esbuild/linux-ia32': 0.28.1
+      '@esbuild/linux-loong64': 0.28.1
+      '@esbuild/linux-mips64el': 0.28.1
+      '@esbuild/linux-ppc64': 0.28.1
+      '@esbuild/linux-riscv64': 0.28.1
+      '@esbuild/linux-s390x': 0.28.1
+      '@esbuild/linux-x64': 0.28.1
+      '@esbuild/netbsd-arm64': 0.28.1
+      '@esbuild/netbsd-x64': 0.28.1
+      '@esbuild/openbsd-arm64': 0.28.1
+      '@esbuild/openbsd-x64': 0.28.1
+      '@esbuild/openharmony-arm64': 0.28.1
+      '@esbuild/sunos-x64': 0.28.1
+      '@esbuild/win32-arm64': 0.28.1
+      '@esbuild/win32-ia32': 0.28.1
+      '@esbuild/win32-x64': 0.28.1
 
   escalade@3.2.0: {}
 
@@ -15591,7 +15603,7 @@ snapshots:
   eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.59.3(eslint@9.39.2(jiti@2.7.0))(typescript@5.5.4))(eslint@9.39.2(jiti@2.7.0)):
     dependencies:
       '@package-json/types': 0.0.12
-      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/types': 8.61.1
       comment-parser: 1.4.7
       debug: 4.4.3
       eslint: 9.39.2(jiti@2.7.0)
@@ -15757,9 +15769,11 @@ snapshots:
 
   eventsource-parser@3.0.6: {}
 
+  eventsource-parser@3.1.0: {}
+
   eventsource@3.0.7:
     dependencies:
-      eventsource-parser: 3.0.6
+      eventsource-parser: 3.1.0
 
   expect-type@1.3.0: {}
 
@@ -15790,7 +15804,7 @@ snapshots:
       once: 1.4.0
       parseurl: 1.3.3
       proxy-addr: 2.0.7
-      qs: 6.14.2
+      qs: 6.15.2
       range-parser: 1.2.1
       router: 2.2.0
       send: 1.2.1
@@ -15917,14 +15931,14 @@ snapshots:
 
   forwarded@0.2.0: {}
 
-  framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       motion-dom: 11.18.1
       motion-utils: 11.18.1
       tslib: 2.8.1
     optionalDependencies:
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   fresh@2.0.0: {}
 
@@ -16182,7 +16196,7 @@ snapshots:
     dependencies:
       react-is: 16.13.1
 
-  hono@4.12.18: {}
+  hono@4.12.21: {}
 
   html-encoding-sniffer@6.0.0:
     dependencies:
@@ -16259,10 +16273,10 @@ snapshots:
 
   inline-style-parser@0.2.7: {}
 
-  input-otp@1.4.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  input-otp@1.4.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   internal-slot@1.1.0:
     dependencies:
@@ -16572,10 +16586,10 @@ snapshots:
       - '@emnapi/core'
       - '@emnapi/runtime'
 
-  langchain@1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3)):
+  langchain@1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3)):
     dependencies:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
-      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
+      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
       '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))
       langsmith: 0.6.3(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       zod: 4.4.3
@@ -16694,13 +16708,13 @@ snapshots:
     dependencies:
       yallist: 3.1.1
 
-  lucide-react@0.542.0(react@19.2.6):
+  lucide-react@0.542.0(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  lucide-react@0.543.0(react@19.2.6):
+  lucide-react@0.543.0(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   lz-string@1.5.0: {}
 
@@ -16919,7 +16933,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.19
-      dompurify: 3.4.2
+      dompurify: 3.4.10
       es-toolkit: 1.46.1
       katex: 0.16.27
       khroma: 2.1.0
@@ -17259,37 +17273,37 @@ snapshots:
 
   neo-async@2.6.2: {}
 
-  next-auth@5.0.0-beta.30(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6):
+  next-auth@5.0.0-beta.30(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7):
     dependencies:
       '@auth/core': 0.41.0
-      next: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
+      next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
 
-  next-themes@0.2.1(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  next-themes@0.2.1(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      next: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      '@next/env': 16.2.6
+      '@next/env': 16.2.9
       '@swc/helpers': 0.5.15
       baseline-browser-mapping: 2.10.29
       caniuse-lite: 1.0.30001792
-      postcss: 8.4.31
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      styled-jsx: 5.1.6(@babel/core@7.28.6)(react@19.2.6)
+      postcss: 8.5.14
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      styled-jsx: 5.1.6(@babel/core@7.28.6)(react@19.2.7)
     optionalDependencies:
-      '@next/swc-darwin-arm64': 16.2.6
-      '@next/swc-darwin-x64': 16.2.6
-      '@next/swc-linux-arm64-gnu': 16.2.6
-      '@next/swc-linux-arm64-musl': 16.2.6
-      '@next/swc-linux-x64-gnu': 16.2.6
-      '@next/swc-linux-x64-musl': 16.2.6
-      '@next/swc-win32-arm64-msvc': 16.2.6
-      '@next/swc-win32-x64-msvc': 16.2.6
+      '@next/swc-darwin-arm64': 16.2.9
+      '@next/swc-darwin-x64': 16.2.9
+      '@next/swc-linux-arm64-gnu': 16.2.9
+      '@next/swc-linux-arm64-musl': 16.2.9
+      '@next/swc-linux-x64-gnu': 16.2.9
+      '@next/swc-linux-x64-musl': 16.2.9
+      '@next/swc-win32-arm64-msvc': 16.2.9
+      '@next/swc-win32-x64-msvc': 16.2.9
       '@opentelemetry/api': 1.9.0
       '@playwright/test': 1.56.1
       babel-plugin-react-compiler: 1.0.0
@@ -17537,10 +17551,6 @@ snapshots:
 
   picomatch@4.0.4: {}
 
-  pixelmatch@7.1.0:
-    dependencies:
-      pngjs: 7.0.0
-
   pkce-challenge@5.0.1: {}
 
   pkg-types@1.3.1:
@@ -17573,12 +17583,6 @@ snapshots:
       cssesc: 3.0.0
       util-deprecate: 1.0.2
 
-  postcss@8.4.31:
-    dependencies:
-      nanoid: 3.3.12
-      picocolors: 1.1.1
-      source-map-js: 1.2.1
-
   postcss@8.5.14:
     dependencies:
       nanoid: 3.3.12
@@ -17640,7 +17644,7 @@ snapshots:
 
   punycode@2.3.1: {}
 
-  qs@6.14.2:
+  qs@6.15.2:
     dependencies:
       side-channel: 1.1.0
 
@@ -17655,21 +17659,21 @@ snapshots:
       iconv-lite: 0.7.2
       unpipe: 1.0.0
 
-  react-day-picker@9.13.0(react@19.2.6):
+  react-day-picker@9.13.0(react@19.2.7):
     dependencies:
       '@date-fns/tz': 1.4.1
       date-fns: 4.1.0
       date-fns-jalali: 4.1.0-0
-      react: 19.2.6
+      react: 19.2.7
 
-  react-dom@19.2.6(react@19.2.6):
+  react-dom@19.2.7(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
       scheduler: 0.27.0
 
-  react-hook-form@7.62.0(react@19.2.6):
+  react-hook-form@7.62.0(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   react-is@16.13.1: {}
 
@@ -17677,16 +17681,16 @@ snapshots:
 
   react-is@18.3.1: {}
 
-  react-markdown@10.1.0(@types/react@19.2.8)(react@19.2.6):
+  react-markdown@10.1.0(@types/react@19.2.17)(react@19.2.7):
     dependencies:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
       devlop: 1.1.0
       hast-util-to-jsx-runtime: 2.3.6
       html-url-attributes: 3.0.1
       mdast-util-to-hast: 13.2.1
-      react: 19.2.6
+      react: 19.2.7
       remark-parse: 11.0.0
       remark-rehype: 11.1.2
       unified: 11.0.5
@@ -17697,60 +17701,60 @@ snapshots:
 
   react-refresh@0.18.0: {}
 
-  react-remove-scroll-bar@2.3.8(@types/react@19.2.8)(react@19.2.6):
+  react-remove-scroll-bar@2.3.8(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
-      react-style-singleton: 2.2.3(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.7)
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  react-remove-scroll@2.7.2(@types/react@19.2.8)(react@19.2.6):
+  react-remove-scroll@2.7.2(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
-      react-remove-scroll-bar: 2.3.8(@types/react@19.2.8)(react@19.2.6)
-      react-style-singleton: 2.2.3(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-remove-scroll-bar: 2.3.8(@types/react@19.2.17)(react@19.2.7)
+      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.7)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.2.8)(react@19.2.6)
-      use-sidecar: 1.1.3(@types/react@19.2.8)(react@19.2.6)
+      use-callback-ref: 1.3.3(@types/react@19.2.17)(react@19.2.7)
+      use-sidecar: 1.1.3(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  react-smooth@4.0.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  react-smooth@4.0.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       fast-equals: 5.4.0
       prop-types: 15.8.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-transition-group: 4.4.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-transition-group: 4.4.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
 
-  react-style-singleton@2.2.3(@types/react@19.2.8)(react@19.2.6):
+  react-style-singleton@2.2.3(@types/react@19.2.17)(react@19.2.7):
     dependencies:
       get-nonce: 1.0.1
-      react: 19.2.6
+      react: 19.2.7
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  react-textarea-autosize@8.5.9(@types/react@19.2.8)(react@19.2.6):
+  react-textarea-autosize@8.5.9(@types/react@19.2.17)(react@19.2.7):
     dependencies:
       '@babel/runtime': 7.28.6
-      react: 19.2.6
-      use-composed-ref: 1.4.0(@types/react@19.2.8)(react@19.2.6)
-      use-latest: 1.3.0(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      use-composed-ref: 1.4.0(@types/react@19.2.17)(react@19.2.7)
+      use-latest: 1.3.0(@types/react@19.2.17)(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
 
-  react-transition-group@4.4.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  react-transition-group@4.4.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       '@babel/runtime': 7.28.6
       dom-helpers: 5.2.1
       loose-envify: 1.4.0
       prop-types: 15.8.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  react@19.2.6: {}
+  react@19.2.7: {}
 
   readdirp@3.6.0:
     dependencies:
@@ -17760,15 +17764,15 @@ snapshots:
     dependencies:
       decimal.js-light: 2.5.1
 
-  recharts@2.15.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  recharts@2.15.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       clsx: 2.1.1
       eventemitter3: 4.0.7
       lodash: 4.18.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
       react-is: 18.3.1
-      react-smooth: 4.0.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      react-smooth: 4.0.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       recharts-scale: 0.4.5
       tiny-invariant: 1.3.3
       victory-vendor: 36.9.2
@@ -18235,24 +18239,24 @@ snapshots:
 
   statuses@2.0.2: {}
 
-  std-env@3.10.0: {}
+  std-env@4.1.0: {}
 
   stop-iteration-iterator@1.1.0:
     dependencies:
       es-errors: 1.3.0
       internal-slot: 1.1.0
 
-  streamdown@1.6.10(@types/mdast@4.0.4)(micromark-util-types@2.0.2)(micromark@4.0.2)(react@19.2.6):
+  streamdown@1.6.10(@types/mdast@4.0.4)(micromark-util-types@2.0.2)(micromark@4.0.2)(react@19.2.7):
     dependencies:
       clsx: 2.1.1
       hast: 1.0.0
       hast-util-to-jsx-runtime: 2.3.6
       html-url-attributes: 3.0.1
       katex: 0.16.27
-      lucide-react: 0.542.0(react@19.2.6)
+      lucide-react: 0.542.0(react@19.2.7)
       marked: 16.4.2
       mermaid: 11.15.0
-      react: 19.2.6
+      react: 19.2.7
       rehype-harden: 1.1.7
       rehype-katex: 7.0.1
       rehype-raw: 7.0.0
@@ -18370,10 +18374,10 @@ snapshots:
     dependencies:
       inline-style-parser: 0.2.7
 
-  styled-jsx@5.1.6(@babel/core@7.28.6)(react@19.2.6):
+  styled-jsx@5.1.6(@babel/core@7.28.6)(react@19.2.7):
     dependencies:
       client-only: 0.0.1
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
       '@babel/core': 7.28.6
 
@@ -18389,11 +18393,11 @@ snapshots:
 
   supports-preserve-symlinks-flag@1.0.0: {}
 
-  swr@2.3.8(react@19.2.6):
+  swr@2.3.8(react@19.2.7):
     dependencies:
       dequal: 2.0.3
-      react: 19.2.6
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      react: 19.2.7
+      use-sync-external-store: 1.6.0(react@19.2.7)
 
   symbol-tree@3.2.4: {}
 
@@ -18666,47 +18670,47 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
-  use-callback-ref@1.3.3(@types/react@19.2.8)(react@19.2.6):
+  use-callback-ref@1.3.3(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-composed-ref@1.4.0(@types/react@19.2.8)(react@19.2.6):
+  use-composed-ref@1.4.0(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-isomorphic-layout-effect@1.2.1(@types/react@19.2.8)(react@19.2.6):
+  use-isomorphic-layout-effect@1.2.1(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-latest@1.3.0(@types/react@19.2.8)(react@19.2.6):
+  use-latest@1.3.0(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
-      use-isomorphic-layout-effect: 1.2.1(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      use-isomorphic-layout-effect: 1.2.1(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-sidecar@1.1.3(@types/react@19.2.8)(react@19.2.6):
+  use-sidecar@1.1.3(@types/react@19.2.17)(react@19.2.7):
     dependencies:
       detect-node-es: 1.1.0
-      react: 19.2.6
+      react: 19.2.7
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-stick-to-bottom@1.1.1(react@19.2.6):
+  use-stick-to-bottom@1.1.1(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  use-sync-external-store@1.6.0(react@19.2.6):
+  use-sync-external-store@1.6.0(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   util-deprecate@1.0.2: {}
 
@@ -18714,11 +18718,11 @@ snapshots:
 
   vary@1.1.2: {}
 
-  vaul@1.1.2(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  vaul@1.1.2(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -18757,7 +18761,7 @@ snapshots:
 
   vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0):
     dependencies:
-      esbuild: 0.27.7
+      esbuild: 0.28.1
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
       postcss: 8.5.14
@@ -18771,31 +18775,31 @@ snapshots:
       terser: 5.47.1
       yaml: 2.9.0
 
-  vitest-browser-react@2.0.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(vitest@4.0.18):
+  vitest-browser-react@2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.8):
     dependencies:
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      vitest: 4.0.18(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.0.18)(jiti@2.7.0)(jsdom@27.4.0)(lightningcss@1.30.2)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(terser@5.47.1)(yaml@2.9.0)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      vitest: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  vitest@4.0.18(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.0.18)(jiti@2.7.0)(jsdom@27.4.0)(lightningcss@1.30.2)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(terser@5.47.1)(yaml@2.9.0):
+  vitest@4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0)):
     dependencies:
-      '@vitest/expect': 4.0.18
-      '@vitest/mocker': 4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
-      '@vitest/pretty-format': 4.0.18
-      '@vitest/runner': 4.0.18
-      '@vitest/snapshot': 4.0.18
-      '@vitest/spy': 4.0.18
-      '@vitest/utils': 4.0.18
-      es-module-lexer: 1.7.0
+      '@vitest/expect': 4.1.8
+      '@vitest/mocker': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
+      '@vitest/pretty-format': 4.1.8
+      '@vitest/runner': 4.1.8
+      '@vitest/snapshot': 4.1.8
+      '@vitest/spy': 4.1.8
+      '@vitest/utils': 4.1.8
+      es-module-lexer: 2.1.0
       expect-type: 1.3.0
       magic-string: 0.30.21
       obug: 2.1.1
       pathe: 2.0.3
       picomatch: 4.0.4
-      std-env: 3.10.0
+      std-env: 4.1.0
       tinybench: 2.9.0
       tinyexec: 1.1.2
       tinyglobby: 0.2.16
@@ -18805,20 +18809,11 @@ snapshots:
     optionalDependencies:
       '@opentelemetry/api': 1.9.0
       '@types/node': 24.10.8
-      '@vitest/browser-playwright': 4.0.18(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.0.18)
+      '@vitest/browser-playwright': 4.1.8(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(playwright@1.56.1)(vite@7.3.2(@types/node@24.10.8)(jiti@2.7.0)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))(vitest@4.1.8)
+      '@vitest/coverage-v8': 4.1.8(@vitest/browser@4.1.8)(vitest@4.1.8)
       jsdom: 27.4.0
     transitivePeerDependencies:
-      - jiti
-      - less
-      - lightningcss
       - msw
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - terser
-      - tsx
-      - yaml
 
   w3c-keyname@2.2.8: {}
 
@@ -19010,17 +19005,17 @@ snapshots:
 
   zod@4.4.3: {}
 
-  zustand@4.5.7(@types/react@19.2.8)(react@19.2.6):
+  zustand@4.5.7(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      use-sync-external-store: 1.6.0(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      react: 19.2.6
+      '@types/react': 19.2.17
+      react: 19.2.7
 
-  zustand@5.0.8(@types/react@19.2.8)(react@19.2.6)(use-sync-external-store@1.6.0(react@19.2.6)):
+  zustand@5.0.8(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7)):
     optionalDependencies:
-      '@types/react': 19.2.8
-      react: 19.2.6
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      '@types/react': 19.2.17
+      react: 19.2.7
+      use-sync-external-store: 1.6.0(react@19.2.7)
 
   zwitch@2.0.4: {}
diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml
index e4ce0ceaf9..3db3cc19e3 100644
--- a/ui/pnpm-workspace.yaml
+++ b/ui/pnpm-workspace.yaml
@@ -17,24 +17,26 @@ saveExact: true
 overrides:
   "@react-types/shared": "3.26.0"
   "@internationalized/date": "3.10.0"
-  "@react-aria/ssr>react": "19.2.6"
-  "@react-aria/ssr>react-dom": "19.2.6"
-  "@react-aria/visually-hidden>react": "19.2.6"
-  "@react-aria/interactions>react": "19.2.6"
+  "@react-aria/ssr>react": "19.2.7"
+  "@react-aria/ssr>react-dom": "19.2.7"
+  "@react-aria/visually-hidden>react": "19.2.7"
+  "@react-aria/interactions>react": "19.2.7"
   "lodash": "4.18.1"
   "lodash-es": "4.18.1"
-  "hono": "4.12.18"
+  "hono": "4.12.21"
   "@hono/node-server": "1.19.14"
   "@isaacs/brace-expansion": "5.0.1"
   "fast-xml-parser": "5.8.0"
   "serialize-javascript": "7.0.5"
+  "postcss": "8.5.14"
+  "esbuild": "0.28.1"
   "rollup@>=4": "4.59.0"
   "minimatch@<4": "3.1.4"
   "minimatch@>=9 <10": "9.0.7"
   "minimatch@>=10": "10.2.3"
   "ajv@<7": "6.14.0"
   "ajv@>=8": "8.18.0"
-  "qs": "6.14.2"
+  "qs": "6.15.2"
   # 8.2.2 dropped provenance attestation; 8.3.1+ restored it. Pinned to skip 8.2.2
   # under `trustPolicy: no-downgrade`.
   "express-rate-limit": "8.5.1"
@@ -43,6 +45,10 @@ overrides:
   # use the random v4 generator only, so the bug isn't reachable in practice,
   # but the override unifies the tree on a patched version.
   "uuid": "11.1.1"
+  # GHSA-vxr8-fq34-vvx9 (+ several related XSS sanitization bypasses): DOMPurify < 3.4.9,
+  # pulled in transitively via streamdown > mermaid (which wants ^3.3.1). Pinned to 3.4.10
+  # (fixes all open advisories; 3.4.11 is < 24h old and blocked by minimumReleaseAge).
+  "dompurify": "3.4.10"
 
 # --- Level 1: Minimum Release Age ---
 # Packages must be published for at least 1 day before they can be installed.
diff --git a/ui/scripts/check-tour-alignment.mjs b/ui/scripts/check-tour-alignment.mjs
new file mode 100644
index 0000000000..12863fd303
--- /dev/null
+++ b/ui/scripts/check-tour-alignment.mjs
@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+// Tour alignment check (syntactic). Extracts `data-tour-id` values from every
+// `ui/lib/tours/*.tour.ts` and verifies a matching attribute exists under `ui/`,
+// in either the JSX form (`data-tour-id="..."`) or the object-property form
+// (`"data-tour-id": "..."`) used for dynamically-spread anchors. Two directions:
+//   - Tour → DOM: fails on any tour `target` with no matching attribute.
+//   - DOM → tour: warns on any `data-tour-id` not referenced by any tour
+//     (does not fail — staged anchors during multi-PR rollouts are OK).
+// Complements the semantic `prowler-tour` skill for CI/local runs without
+// invoking Claude Code.
+import { readFile, readdir } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { join, dirname, relative, resolve } from "node:path";
+
+const UI_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const TOURS_DIR = join(UI_DIR, "lib", "tours");
+const TOUR_FILE_SUFFIX = ".tour.ts";
+
+const EXCLUDED_DIRS = new Set([
+  "node_modules",
+  ".next",
+  "dist",
+  "build",
+  "coverage",
+]);
+
+async function readDirEntries(dir) {
+  try {
+    return await readdir(dir, { withFileTypes: true });
+  } catch (err) {
+    if (err && err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+
+async function findTourFiles(dir) {
+  const entries = await readDirEntries(dir);
+  return entries
+    .filter((entry) => entry.isFile() && entry.name.endsWith(TOUR_FILE_SUFFIX))
+    .map((entry) => join(dir, entry.name));
+}
+
+const TOUR_ID_PATTERN = /\bid\s*:\s*["']([a-z0-9-]+)["']/m;
+const TARGET_PATTERN = /\btarget\s*:\s*["']([a-z0-9-]+)["']/g;
+
+async function parseTour(filePath) {
+  const source = await readFile(filePath, "utf8");
+  const idMatch = source.match(TOUR_ID_PATTERN);
+  if (!idMatch) {
+    throw new Error(
+      `${relative(UI_DIR, filePath)}: cannot find tour 'id' — expected a literal like \`id: "attack-paths"\``,
+    );
+  }
+  const tourId = idMatch[1];
+
+  const targets = [];
+  for (const match of source.matchAll(TARGET_PATTERN)) {
+    targets.push(match[1]);
+  }
+
+  return {
+    file: relative(UI_DIR, filePath),
+    tourId,
+    selectors: targets.map((target) => `${tourId}-${target}`),
+  };
+}
+
+async function* walk(dir) {
+  const entries = await readDirEntries(dir);
+  for (const entry of entries) {
+    if (EXCLUDED_DIRS.has(entry.name)) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      yield* walk(full);
+    } else if (entry.isFile()) {
+      yield full;
+    }
+  }
+}
+
+const ATTRIBUTE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
+
+async function collectAttributeValues() {
+  const values = new Map();
+  for await (const file of walk(UI_DIR)) {
+    if (!ATTRIBUTE_EXTENSIONS.some((ext) => file.endsWith(ext))) continue;
+    if (file.endsWith(TOUR_FILE_SUFFIX)) continue;
+    const source = await readFile(file, "utf8");
+    // Match both the JSX attribute form (`data-tour-id="x"`) and the
+    // object-property form (`"data-tour-id": "x"`) used when an anchor is spread
+    // dynamically — e.g. a table's per-row getRowAttributes returning the id.
+    const pattern = /["']?data-tour-id["']?\s*[=:]\s*["']([a-z0-9-]+)["']/g;
+    for (const match of source.matchAll(pattern)) {
+      const value = match[1];
+      const existing = values.get(value);
+      if (existing) {
+        existing.push(file);
+      } else {
+        values.set(value, [file]);
+      }
+    }
+  }
+  return values;
+}
+
+async function main() {
+  const tourFiles = await findTourFiles(TOURS_DIR);
+  if (tourFiles.length === 0) {
+    console.log("No tour files under ui/lib/tours/ — nothing to check.");
+    return;
+  }
+
+  const tours = await Promise.all(tourFiles.map(parseTour));
+  const attrValues = await collectAttributeValues();
+
+  const tourOrphans = [];
+  for (const tour of tours) {
+    for (const selector of tour.selectors) {
+      if (!attrValues.has(selector)) {
+        tourOrphans.push({ tour: tour.file, selector });
+      }
+    }
+  }
+
+  const referencedSelectors = new Set(tours.flatMap((t) => t.selectors));
+  const domOrphans = [];
+  for (const [value, files] of attrValues) {
+    if (referencedSelectors.has(value)) continue;
+    domOrphans.push({
+      value,
+      files: [...files].sort((a, b) => a.localeCompare(b)),
+    });
+  }
+  domOrphans.sort((a, b) => a.value.localeCompare(b.value));
+  tourOrphans.sort(
+    (a, b) =>
+      a.tour.localeCompare(b.tour) || a.selector.localeCompare(b.selector),
+  );
+
+  if (domOrphans.length > 0) {
+    console.warn(
+      `⚠ ${domOrphans.length} data-tour-id attribute(s) not referenced by any tour:`,
+    );
+    for (const orphan of domOrphans) {
+      const locations = orphan.files
+        .map((file) => relative(UI_DIR, file))
+        .join(", ");
+      console.warn(`  data-tour-id="${orphan.value}" — ${locations}`);
+    }
+    console.warn(
+      "  Wire it into a tour step or remove the attribute (warning only, does not fail).\n",
+    );
+  }
+
+  if (tourOrphans.length === 0) {
+    const referenced = tours.reduce((sum, t) => sum + t.selectors.length, 0);
+    console.log(
+      `✓ Tour alignment OK — ${tours.length} tour(s), ${referenced} anchored step(s).`,
+    );
+    return;
+  }
+
+  console.error("✗ Tour alignment failed.\n");
+  for (const orphan of tourOrphans) {
+    console.error(
+      `  ${orphan.tour} references data-tour-id="${orphan.selector}" but no element carries that attribute.`,
+    );
+  }
+  console.error(
+    "\nFix the drift before merging: add the attribute, fix the tour's `target`, or remove the orphan step.",
+  );
+  process.exit(1);
+}
+
+main().catch((err) => {
+  console.error(err.stack || err.message);
+  process.exit(1);
+});
diff --git a/ui/sentry/README.md b/ui/sentry/README.md
index f33f9f2a8f..babaf1b7fb 100644
--- a/ui/sentry/README.md
+++ b/ui/sentry/README.md
@@ -11,7 +11,11 @@ This folder contains all Sentry-related configuration and utilities for the Prow
 
 ## Client Configuration
 
-The client-side configuration is located in `app/instrumentation.client.ts` following Next.js conventions.
+The client-side configuration lives in the Next.js convention file
+`instrumentation-client.ts` (repo root). It runs before hydration and reads the
+DSN/environment from the runtime data island injected into `<head>` (see
+`lib/runtime-config.ts`), so the browser SDK is configured per deployment from
+the container environment rather than from build-time `NEXT_PUBLIC_*` vars.
 
 ## Usage
 
@@ -30,16 +34,21 @@ Sentry.captureException(error, {
 
 ## Environment Variables
 
-Required environment variables (add to `.env`):
+Runtime environment variables (supplied to the running container; a single
+`UI_SENTRY_DSN` / `UI_SENTRY_ENVIRONMENT` now serves both server and
+browser):
+
+```env
+UI_SENTRY_DSN=https://YOUR_KEY@o0.ingest.sentry.io/0
+UI_SENTRY_ENVIRONMENT=production
+```
+
+Build-time only (for source-map upload via `withSentryConfig`):
 
 ```env
-SENTRY_DSN=https://YOUR_KEY@o0.ingest.sentry.io/0
-NEXT_PUBLIC_SENTRY_DSN=https://YOUR_KEY@o0.ingest.sentry.io/0
 SENTRY_ORG=your-org-slug
 SENTRY_PROJECT=your-project-slug
 SENTRY_AUTH_TOKEN=sntrys_YOUR_AUTH_TOKEN
-SENTRY_ENVIRONMENT=development
-NEXT_PUBLIC_SENTRY_ENVIRONMENT=development
 ```
 
 ## Ignored Errors
diff --git a/ui/sentry/sentry.edge.config.test.ts b/ui/sentry/sentry.edge.config.test.ts
new file mode 100644
index 0000000000..918e686eb0
--- /dev/null
+++ b/ui/sentry/sentry.edge.config.test.ts
@@ -0,0 +1,60 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// Stable mock that survives resetModules (which clears the module registry).
+const { initMock } = vi.hoisted(() => ({ initMock: vi.fn() }));
+
+vi.mock("@sentry/nextjs", () => ({
+  init: initMock,
+}));
+
+describe("sentry.edge.config", () => {
+  beforeEach(() => {
+    // Re-evaluate the module per case so its top-level init guard re-runs.
+    vi.resetModules();
+    initMock.mockClear();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("should initialize with the resolved environment and reduced edge sampling", async () => {
+    // Given
+    vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+    vi.stubEnv("UI_SENTRY_ENVIRONMENT", "pro");
+
+    // When
+    await import("./sentry.edge.config");
+
+    // Then
+    expect(initMock).toHaveBeenCalledTimes(1);
+    expect(initMock.mock.calls[0][0]).toMatchObject({
+      dsn: "https://key@o0.ingest.sentry.io/1",
+      environment: "pro",
+      tracesSampleRate: 0.25,
+    });
+  });
+
+  it("should not initialize when the DSN is absent", async () => {
+    // Given no DSN
+
+    // When
+    await import("./sentry.edge.config");
+
+    // Then
+    expect(initMock).not.toHaveBeenCalled();
+  });
+
+  it("should default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT does not enable dev sampling", async () => {
+    // Given - DSN set but environment unset
+    vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+
+    // When
+    await import("./sentry.edge.config");
+
+    // Then
+    const options = initMock.mock.calls[0][0];
+    expect(options.environment).toBe("production");
+    expect(options.tracesSampleRate).toBe(0.25);
+  });
+});
diff --git a/ui/sentry/sentry.edge.config.ts b/ui/sentry/sentry.edge.config.ts
index 0666d6b856..933c97822a 100644
--- a/ui/sentry/sentry.edge.config.ts
+++ b/ui/sentry/sentry.edge.config.ts
@@ -1,10 +1,20 @@
 import * as Sentry from "@sentry/nextjs";
 
-const SENTRY_DSN = process.env.SENTRY_DSN;
+import { readEnv } from "@/lib/runtime-env";
+
+const sentryDsn = readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN");
+const sentryEnvironment = readEnv(
+  "UI_SENTRY_ENVIRONMENT",
+  "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+);
 
 // Only initialize Sentry if DSN is configured
-if (SENTRY_DSN) {
-  const isProduction = process.env.SENTRY_ENVIRONMENT === "pro";
+if (sentryDsn) {
+  // Default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT never
+  // runs in dev mode; only an explicit "local" enables it. Mirrors the browser
+  // SDK (instrumentation-client.ts) so all runtimes resolve the env identically.
+  const environment = sentryEnvironment ?? "production";
+  const isDevelopment = environment === "local";
 
   /**
    * Edge runtime Sentry configuration
@@ -17,17 +27,17 @@ if (SENTRY_DSN) {
    */
   Sentry.init({
     // 📍 DSN - Data Source Name (identifies your Sentry project)
-    dsn: SENTRY_DSN,
+    dsn: sentryDsn,
 
     // 🌍 Environment configuration
-    environment: process.env.SENTRY_ENVIRONMENT || "local",
+    environment,
 
     // 📦 Release tracking
     release: process.env.SENTRY_RELEASE,
 
     // 📊 Sample Rates - Reduced for edge runtime constraints
     // 50% in dev, 25% in production (edge has lower overhead limits than server)
-    tracesSampleRate: isProduction ? 0.25 : 0.5,
+    tracesSampleRate: isDevelopment ? 0.5 : 0.25,
 
     // 🔌 Integrations - Edge runtime doesn't support all integrations
     integrations: [],
diff --git a/ui/sentry/sentry.server.config.test.ts b/ui/sentry/sentry.server.config.test.ts
new file mode 100644
index 0000000000..a3d75cc856
--- /dev/null
+++ b/ui/sentry/sentry.server.config.test.ts
@@ -0,0 +1,63 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// Stable mock that survives resetModules (which clears the module registry).
+const { initMock } = vi.hoisted(() => ({ initMock: vi.fn() }));
+
+vi.mock("@sentry/nextjs", () => ({
+  init: initMock,
+  extraErrorDataIntegration: vi.fn(() => ({})),
+}));
+
+describe("sentry.server.config", () => {
+  beforeEach(() => {
+    // Re-evaluate the module per case so its top-level init guard re-runs.
+    vi.resetModules();
+    initMock.mockClear();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("should initialize with the resolved environment and production sampling", async () => {
+    // Given
+    vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+    vi.stubEnv("UI_SENTRY_ENVIRONMENT", "pro");
+
+    // When
+    await import("./sentry.server.config");
+
+    // Then
+    expect(initMock).toHaveBeenCalledTimes(1);
+    expect(initMock.mock.calls[0][0]).toMatchObject({
+      dsn: "https://key@o0.ingest.sentry.io/1",
+      environment: "pro",
+      tracesSampleRate: 0.5,
+      profilesSampleRate: 0.5,
+    });
+  });
+
+  it("should not initialize when the DSN is absent", async () => {
+    // Given no DSN
+
+    // When
+    await import("./sentry.server.config");
+
+    // Then
+    expect(initMock).not.toHaveBeenCalled();
+  });
+
+  it("should default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT does not enable dev sampling", async () => {
+    // Given - DSN set but environment unset
+    vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+
+    // When
+    await import("./sentry.server.config");
+
+    // Then
+    const options = initMock.mock.calls[0][0];
+    expect(options.environment).toBe("production");
+    expect(options.tracesSampleRate).toBe(0.5);
+    expect(options.profilesSampleRate).toBe(0.5);
+  });
+});
diff --git a/ui/sentry/sentry.server.config.ts b/ui/sentry/sentry.server.config.ts
index 5922a8ae30..361365f2ec 100644
--- a/ui/sentry/sentry.server.config.ts
+++ b/ui/sentry/sentry.server.config.ts
@@ -1,10 +1,21 @@
 import * as Sentry from "@sentry/nextjs";
 
-const SENTRY_DSN = process.env.SENTRY_DSN;
+import { readEnv } from "@/lib/runtime-env";
+
+const sentryDsn = readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN");
+const sentryEnvironment = readEnv(
+  "UI_SENTRY_ENVIRONMENT",
+  "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+);
 
 // Only initialize Sentry if DSN is configured
-if (SENTRY_DSN) {
-  const isProduction = process.env.SENTRY_ENVIRONMENT === "pro";
+if (sentryDsn) {
+  // Default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT never
+  // runs in dev mode (100% sampling); only an explicit "local" enables it.
+  // Mirrors the browser SDK (instrumentation-client.ts) so all runtimes resolve
+  // the env identically.
+  const environment = sentryEnvironment ?? "production";
+  const isDevelopment = environment === "local";
 
   /**
    * Server-side Sentry configuration
@@ -16,18 +27,18 @@ if (SENTRY_DSN) {
    */
   Sentry.init({
     // 📍 DSN - Data Source Name (identifies your Sentry project)
-    dsn: SENTRY_DSN,
+    dsn: sentryDsn,
 
     // 🌍 Environment configuration
-    environment: process.env.SENTRY_ENVIRONMENT || "local",
+    environment,
 
     // 📦 Release tracking
     release: process.env.SENTRY_RELEASE,
 
     // 📊 Sample Rates - Performance monitoring
     // 100% in dev (test everything), 50% in production (balance visibility with costs)
-    tracesSampleRate: isProduction ? 0.5 : 1.0,
-    profilesSampleRate: isProduction ? 0.5 : 1.0,
+    tracesSampleRate: isDevelopment ? 1.0 : 0.5,
+    profilesSampleRate: isDevelopment ? 1.0 : 0.5,
 
     // 🔌 Integrations
     integrations: [
diff --git a/ui/store/__tests__/onboarding-checkpoint.test.ts b/ui/store/__tests__/onboarding-checkpoint.test.ts
new file mode 100644
index 0000000000..6ac0d4be85
--- /dev/null
+++ b/ui/store/__tests__/onboarding-checkpoint.test.ts
@@ -0,0 +1,85 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import {
+  CHECKPOINT_MARKER,
+  useOnboardingCheckpointStore,
+} from "../onboarding-checkpoint";
+
+describe("useOnboardingCheckpointStore", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    useOnboardingCheckpointStore.setState({ armed: false, open: false });
+  });
+
+  afterEach(() => {
+    window.localStorage.clear();
+  });
+
+  it("starts disarmed and closed", () => {
+    const state = useOnboardingCheckpointStore.getState();
+    expect(state.armed).toBe(false);
+    expect(state.open).toBe(false);
+  });
+
+  it("arm() sets armed without opening", () => {
+    useOnboardingCheckpointStore.getState().arm();
+
+    const state = useOnboardingCheckpointStore.getState();
+    expect(state.armed).toBe(true);
+    expect(state.open).toBe(false);
+  });
+
+  it("requestOpenOnWizardClose opens only when armed, a provider connected, and not handled", () => {
+    useOnboardingCheckpointStore.getState().arm();
+
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: true });
+
+    expect(useOnboardingCheckpointStore.getState().open).toBe(true);
+  });
+
+  it("does NOT open when not armed even if a provider connected", () => {
+    // Covers established users who skipped onboarding but later add a provider.
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: true });
+
+    expect(useOnboardingCheckpointStore.getState().open).toBe(false);
+  });
+
+  it("does NOT open when armed but no provider connected (wizard closed empty)", () => {
+    useOnboardingCheckpointStore.getState().arm();
+
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: false });
+
+    expect(useOnboardingCheckpointStore.getState().open).toBe(false);
+  });
+
+  it("does NOT open when the checkpoint was already handled in this browser", () => {
+    window.localStorage.setItem(CHECKPOINT_MARKER, "true");
+    useOnboardingCheckpointStore.getState().arm();
+
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: true });
+
+    expect(useOnboardingCheckpointStore.getState().open).toBe(false);
+  });
+
+  it("close() resets open and disarms", () => {
+    useOnboardingCheckpointStore.getState().arm();
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: true });
+    expect(useOnboardingCheckpointStore.getState().open).toBe(true);
+
+    useOnboardingCheckpointStore.getState().close();
+
+    const state = useOnboardingCheckpointStore.getState();
+    expect(state.open).toBe(false);
+    expect(state.armed).toBe(false);
+  });
+});
diff --git a/ui/store/__tests__/onboarding-replay.test.ts b/ui/store/__tests__/onboarding-replay.test.ts
new file mode 100644
index 0000000000..ef4c662797
--- /dev/null
+++ b/ui/store/__tests__/onboarding-replay.test.ts
@@ -0,0 +1,62 @@
+import { beforeEach, describe, expect, it } from "vitest";
+
+import { getOrderedFlows } from "@/lib/onboarding";
+
+import { useOnboardingReplayStore } from "../onboarding-replay";
+
+// Plain (no-persist) slice — setState is sufficient to isolate tests.
+function resetStore(): void {
+  useOnboardingReplayStore.setState({ flowId: null, token: 0 });
+}
+
+describe("useOnboardingReplayStore", () => {
+  beforeEach(() => {
+    resetStore();
+  });
+
+  describe("requestReplay", () => {
+    it("sets the flow id and bumps the token for a known flow", () => {
+      const target = getOrderedFlows()[0];
+
+      useOnboardingReplayStore.getState().requestReplay(target.id);
+
+      const state = useOnboardingReplayStore.getState();
+      expect(state.flowId).toBe(target.id);
+      expect(state.token).toBe(1);
+    });
+
+    it("bumps the token again when the same flow is requested twice", () => {
+      const target = getOrderedFlows()[0];
+
+      useOnboardingReplayStore.getState().requestReplay(target.id);
+      useOnboardingReplayStore.getState().consume();
+      useOnboardingReplayStore.getState().requestReplay(target.id);
+
+      const state = useOnboardingReplayStore.getState();
+      expect(state.flowId).toBe(target.id);
+      // Monotonic token guarantees a fresh signal so the runner re-mounts.
+      expect(state.token).toBe(2);
+    });
+
+    it("is a no-op for an unknown flow id", () => {
+      useOnboardingReplayStore.getState().requestReplay("does-not-exist");
+
+      const state = useOnboardingReplayStore.getState();
+      expect(state.flowId).toBeNull();
+      expect(state.token).toBe(0);
+    });
+  });
+
+  describe("consume", () => {
+    it("clears the flow id without resetting the token", () => {
+      const target = getOrderedFlows()[0];
+      useOnboardingReplayStore.getState().requestReplay(target.id);
+
+      useOnboardingReplayStore.getState().consume();
+
+      const state = useOnboardingReplayStore.getState();
+      expect(state.flowId).toBeNull();
+      expect(state.token).toBe(1);
+    });
+  });
+});
diff --git a/ui/store/__tests__/onboarding-sequence.test.ts b/ui/store/__tests__/onboarding-sequence.test.ts
new file mode 100644
index 0000000000..96a3a64589
--- /dev/null
+++ b/ui/store/__tests__/onboarding-sequence.test.ts
@@ -0,0 +1,132 @@
+import { beforeEach, describe, expect, it } from "vitest";
+
+import { getOrderedFlows } from "@/lib/onboarding";
+
+import { useOnboardingSequenceStore } from "../onboarding-sequence";
+
+// Plain (no-persist) slice — setState is sufficient to isolate tests.
+function resetStore(): void {
+  useOnboardingSequenceStore.setState({
+    active: false,
+    currentFlowId: null,
+    mode: null,
+  });
+}
+
+describe("useOnboardingSequenceStore", () => {
+  beforeEach(() => {
+    resetStore();
+  });
+
+  describe("startSequence", () => {
+    it("starts at the first ordered flow when called with no argument", () => {
+      useOnboardingSequenceStore.getState().startSequence();
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(getOrderedFlows()[0].id);
+      expect(state.mode).toBe("sequence");
+    });
+
+    it("starts at the requested flow when given an explicit id", () => {
+      const targetId = getOrderedFlows()[0].id;
+      useOnboardingSequenceStore.getState().startSequence(targetId);
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(targetId);
+      expect(state.mode).toBe("sequence");
+    });
+  });
+
+  describe("advance", () => {
+    it("moves to the next ordered flow when the current one is not last", () => {
+      const ordered = getOrderedFlows();
+      if (ordered.length < 2) {
+        // Skip until the registry has at least two flows.
+        return;
+      }
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: ordered[0].id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().advance();
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(ordered[1].id);
+      expect(state.mode).toBe("sequence");
+    });
+
+    it("resets to inactive when advancing past the last ordered flow", () => {
+      const ordered = getOrderedFlows();
+      const lastFlow = ordered[ordered.length - 1];
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: lastFlow.id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().advance();
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(false);
+      expect(state.currentFlowId).toBeNull();
+      expect(state.mode).toBeNull();
+    });
+  });
+
+  describe("goToFlow", () => {
+    it("re-points currentFlowId to a known flow while staying active in sequence mode", () => {
+      const ordered = getOrderedFlows();
+      const target = ordered[1];
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: ordered[2].id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().goToFlow(target.id);
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(target.id);
+      expect(state.mode).toBe("sequence");
+    });
+
+    it("is a no-op for an unknown flow id", () => {
+      const ordered = getOrderedFlows();
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: ordered[0].id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().goToFlow("does-not-exist");
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(ordered[0].id);
+      expect(state.mode).toBe("sequence");
+    });
+  });
+
+  describe("stop", () => {
+    it("resets every field to its inactive value", () => {
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: getOrderedFlows()[0].id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().stop();
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(false);
+      expect(state.currentFlowId).toBeNull();
+      expect(state.mode).toBeNull();
+    });
+  });
+});
diff --git a/ui/store/__tests__/page-ready.test.ts b/ui/store/__tests__/page-ready.test.ts
new file mode 100644
index 0000000000..6fc164a116
--- /dev/null
+++ b/ui/store/__tests__/page-ready.test.ts
@@ -0,0 +1,31 @@
+import { beforeEach, describe, expect, it } from "vitest";
+
+import { usePageReadyStore } from "../page-ready";
+
+const reset = () => usePageReadyStore.setState({ readyPath: null });
+
+describe("usePageReadyStore", () => {
+  beforeEach(reset);
+
+  it("marks a route ready", () => {
+    usePageReadyStore.getState().markReady("/compliance");
+    expect(usePageReadyStore.getState().readyPath).toBe("/compliance");
+  });
+
+  it("clears readiness only when the path still matches", () => {
+    const store = usePageReadyStore.getState();
+    store.markReady("/compliance");
+    store.clearReady("/compliance");
+    expect(usePageReadyStore.getState().readyPath).toBeNull();
+  });
+
+  it("ignores a stale clear once a newer route is ready", () => {
+    const store = usePageReadyStore.getState();
+    // Fast navigation: /findings mounts and marks itself ready before the old
+    // /compliance marker's cleanup runs. The stale clear must not wipe it.
+    store.markReady("/compliance");
+    store.markReady("/findings");
+    store.clearReady("/compliance");
+    expect(usePageReadyStore.getState().readyPath).toBe("/findings");
+  });
+});
diff --git a/ui/store/onboarding-checkpoint.ts b/ui/store/onboarding-checkpoint.ts
new file mode 100644
index 0000000000..7d47ba0d94
--- /dev/null
+++ b/ui/store/onboarding-checkpoint.ts
@@ -0,0 +1,46 @@
+import { create } from "zustand";
+
+// Persisted flag that prevents the checkpoint dialog from re-appearing after it has been handled.
+export const CHECKPOINT_MARKER = "prowler.onboarding.checkpoint";
+
+function isCheckpointHandled(): boolean {
+  if (typeof window === "undefined") return false;
+  try {
+    return window.localStorage.getItem(CHECKPOINT_MARKER) !== null;
+  } catch {
+    // Fail open: unreadable storage should not block the checkpoint.
+    return false;
+  }
+}
+
+interface OnboardingCheckpointState {
+  // armed: set by the gate's "Get started"; prevents established users from seeing the dialog.
+  armed: boolean;
+  open: boolean;
+
+  arm: () => void;
+  // Opens the checkpoint only when armed, a provider was connected, and the marker is unset.
+  requestOpenOnWizardClose: (input: { providerConnected: boolean }) => void;
+  // Resets ephemeral open/armed state; the durable marker is managed by the watcher.
+  close: () => void;
+}
+
+// Ephemeral, NOT persisted: durable "already saw this" memory stays in CHECKPOINT_MARKER.
+export const useOnboardingCheckpointStore = create<OnboardingCheckpointState>(
+  (set) => ({
+    armed: false,
+    open: false,
+
+    arm: () => set({ armed: true }),
+
+    requestOpenOnWizardClose: ({ providerConnected }) =>
+      set((state) => {
+        if (state.armed && providerConnected && !isCheckpointHandled()) {
+          return { open: true };
+        }
+        return {};
+      }),
+
+    close: () => set({ open: false, armed: false }),
+  }),
+);
diff --git a/ui/store/onboarding-replay.ts b/ui/store/onboarding-replay.ts
new file mode 100644
index 0000000000..8e43296f64
--- /dev/null
+++ b/ui/store/onboarding-replay.ts
@@ -0,0 +1,34 @@
+import { create } from "zustand";
+
+import { getFlowById } from "@/lib/onboarding";
+
+interface OnboardingReplayState {
+  // Flow whose replay was requested in-memory (navbar, same route), or null.
+  flowId: string | null;
+  // Monotonic counter bumped on every request so re-clicking the same flow
+  // produces a fresh signal and the OnboardingTrigger re-mounts its runner.
+  token: number;
+
+  // Requests a replay for the given flow. No-op for unknown ids.
+  requestReplay: (flowId: string) => void;
+  // Clears flowId once the runner has started. Keeps token so the next request
+  // still advances it.
+  consume: () => void;
+}
+
+// Ephemeral, NOT persisted: a replay request must never survive a refresh.
+// Same-route replays use this in-memory signal instead of a `?onboarding=` URL
+// param, which would force a Next.js RSC refetch of the whole page.
+export const useOnboardingReplayStore = create<OnboardingReplayState>(
+  (set) => ({
+    flowId: null,
+    token: 0,
+
+    requestReplay: (flowId) => {
+      if (!getFlowById(flowId)) return;
+      set((state) => ({ flowId, token: state.token + 1 }));
+    },
+
+    consume: () => set({ flowId: null }),
+  }),
+);
diff --git a/ui/store/onboarding-sequence.ts b/ui/store/onboarding-sequence.ts
new file mode 100644
index 0000000000..4d1b4c1b4a
--- /dev/null
+++ b/ui/store/onboarding-sequence.ts
@@ -0,0 +1,71 @@
+import { create } from "zustand";
+
+import { getFlowById, getOrderedFlows } from "@/lib/onboarding";
+
+// "sequence" = slice-driven; "replay" = single-flow replay from ?onboarding= param.
+export const ONBOARDING_SEQUENCE_MODES = {
+  SEQUENCE: "sequence",
+  REPLAY: "replay",
+} as const;
+
+export type OnboardingSequenceMode =
+  (typeof ONBOARDING_SEQUENCE_MODES)[keyof typeof ONBOARDING_SEQUENCE_MODES];
+
+interface OnboardingSequenceState {
+  active: boolean;
+  currentFlowId: string | null;
+  mode: OnboardingSequenceMode | null;
+
+  startSequence: (startFlowId?: string) => void;
+  // Advances to next flow; clears state when the current flow is last.
+  advance: () => void;
+  // Jumps to a known flow. No-op for unknown ids.
+  goToFlow: (flowId: string) => void;
+  stop: () => void;
+}
+
+// Ephemeral, NOT persisted: persisting would resurrect sequences after refresh.
+// Durable completion memory stays in the per-tour localStorage TourCompletionRecord.
+export const useOnboardingSequenceStore = create<OnboardingSequenceState>(
+  (set, get) => ({
+    active: false,
+    currentFlowId: null,
+    mode: null,
+
+    startSequence: (startFlowId) => {
+      const ordered = getOrderedFlows();
+      const start = startFlowId
+        ? (getFlowById(startFlowId) ?? ordered[0])
+        : ordered[0];
+      if (!start) return;
+      set({
+        active: true,
+        currentFlowId: start.id,
+        mode: ONBOARDING_SEQUENCE_MODES.SEQUENCE,
+      });
+    },
+
+    advance: () => {
+      const { currentFlowId } = get();
+      const ordered = getOrderedFlows();
+      const idx = ordered.findIndex((flow) => flow.id === currentFlowId);
+      const next = idx >= 0 ? ordered[idx + 1] : undefined;
+      if (!next) {
+        set({ active: false, currentFlowId: null, mode: null });
+        return;
+      }
+      set({ currentFlowId: next.id });
+    },
+
+    goToFlow: (flowId) => {
+      if (!getFlowById(flowId)) return;
+      set({
+        active: true,
+        currentFlowId: flowId,
+        mode: ONBOARDING_SEQUENCE_MODES.SEQUENCE,
+      });
+    },
+
+    stop: () => set({ active: false, currentFlowId: null, mode: null }),
+  }),
+);
diff --git a/ui/store/page-ready.ts b/ui/store/page-ready.ts
new file mode 100644
index 0000000000..51b4860d80
--- /dev/null
+++ b/ui/store/page-ready.ts
@@ -0,0 +1,24 @@
+import { create } from "zustand";
+
+interface PageReadyState {
+  // The pathname whose data-fetching content is currently mounted. The replay icon
+  // in the navbar is enabled only when this matches the active route, so it stays
+  // disabled while a page is still streaming its data.
+  readyPath: string | null;
+
+  // Marks the given route as loaded (called when a page's post-Suspense content mounts).
+  markReady: (path: string) => void;
+  // Clears readiness for the given route, but only if it is still the current one —
+  // a newer page may already have marked itself ready during a fast navigation.
+  clearReady: (path: string) => void;
+}
+
+// Ephemeral, NOT persisted: readiness is a per-render signal, never durable.
+export const usePageReadyStore = create<PageReadyState>((set) => ({
+  readyPath: null,
+
+  markReady: (path) => set({ readyPath: path }),
+
+  clearReady: (path) =>
+    set((state) => (state.readyPath === path ? { readyPath: null } : {})),
+}));
diff --git a/ui/styles/globals.css b/ui/styles/globals.css
index 32391a2099..56d8dc1d9e 100644
--- a/ui/styles/globals.css
+++ b/ui/styles/globals.css
@@ -1,4 +1,8 @@
 @import "tailwindcss";
+/* All @import rules must precede @config/@source — a late @import is invalid
+ * per the CSS spec and lightningcss (Tailwind v4) silently drops it. */
+@import "./tours.css";
+
 @config "../tailwind.config.js";
 @source "../node_modules/streamdown/dist/*.js";
 
diff --git a/ui/styles/tours.css b/ui/styles/tours.css
new file mode 100644
index 0000000000..3764e606b8
--- /dev/null
+++ b/ui/styles/tours.css
@@ -0,0 +1,78 @@
+.driver-active .driver-overlay,
+.driver-active * {
+  pointer-events: none;
+}
+
+.driver-active .driver-active-element,
+.driver-active .driver-active-element *,
+.driver-popover,
+.driver-popover * {
+  pointer-events: auto;
+}
+
+@keyframes driver-fade-in {
+  0% {
+    opacity: 0;
+  }
+
+  100% {
+    opacity: 1;
+  }
+}
+
+.driver-fade .driver-overlay,
+.driver-fade .driver-popover {
+  animation: driver-fade-in 0.2s ease-in-out;
+}
+
+/* Theme layer over driver.css: keep its positioning/stage, strip the default popover
+ * chrome (background, border, padding, shadow) so the React tour card is the only
+ * visible surface. Do NOT set position/top/right here — driver.js places the popover. */
+.driver-popover.prowler-theme {
+  box-sizing: border-box;
+  margin: 0;
+  padding: 0;
+  background: transparent;
+  border: 0;
+  border-radius: 0;
+  box-shadow: none;
+  min-width: min(250px, calc(100vw - 32px));
+  max-width: min(320px, calc(100vw - 32px));
+  font-family: inherit;
+  /* Reset driver.css's hard-coded #2d2d2d so the card text follows the app theme
+   * (the card title inherits this; descriptions set their own muted token). */
+  color: var(--color-text-neutral-primary);
+}
+
+.driver-popover.prowler-theme * {
+  box-sizing: border-box;
+  font-family: inherit;
+}
+
+/* The visible popover is our React card (mounted at [data-tour-popover-root]).
+ * Keep driver.js's native chrome in the DOM (tour-popover-render reads its text and
+ * progress) but force it hidden — driver.css sets display:block/flex on these, which
+ * would otherwise override the `hidden` attribute and duplicate the card content. */
+.driver-popover.prowler-theme .driver-popover-title,
+.driver-popover.prowler-theme .driver-popover-description,
+.driver-popover.prowler-theme .driver-popover-footer,
+.driver-popover.prowler-theme .driver-popover-progress-text,
+.driver-popover.prowler-theme .driver-popover-close-btn,
+.driver-popover.prowler-theme .driver-popover-arrow {
+  display: none !important;
+}
+
+:not(body):has(> .driver-active-element) {
+  overflow: hidden !important;
+}
+
+.driver-no-interaction,
+.driver-no-interaction * {
+  pointer-events: none !important;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .driver-popover.prowler-theme {
+    transition: none !important;
+  }
+}
diff --git a/ui/tests/helpers.ts b/ui/tests/helpers.ts
index 2bbbdeaeec..67d647448f 100644
--- a/ui/tests/helpers.ts
+++ b/ui/tests/helpers.ts
@@ -5,7 +5,6 @@ import {
   AWS_CREDENTIAL_OPTIONS,
   ProvidersPage,
 } from "./providers/providers-page";
-import { ScansPage } from "./scans/scans-page";
 
 export const ERROR_MESSAGES = {
   INVALID_CREDENTIALS: "Invalid email or password",
@@ -123,13 +122,28 @@ export async function addAWSProvider(
   await providersPage.fillStaticCredentials(staticCredentials);
   await providersPage.clickNext();
 
-  // Launch scan
-  await providersPage.verifyLaunchScanPageLoaded();
-  await providersPage.clickNext();
+  // Scans specs launch their own scan. The setup helper should only leave a
+  // connected provider behind so the suite does not spend CI capacity on a
+  // duplicate preparatory scan.
+  await providersPage.completeProviderConnectionWithoutLaunchingScan(accountId);
+}
 
-  // Wait for redirect to provider page
-  const scansPage = new ScansPage(page);
-  await scansPage.verifyPageLoaded();
+/**
+ * Waits for the providers page to settle and reports whether the data table is
+ * present. With zero providers the page renders a full-page empty state
+ * ("No Providers Configured") instead of the table, so callers must not assume
+ * the table is always there.
+ */
+async function providersTableVisibleOrEmptyState(
+  page: ProvidersPage,
+): Promise<boolean> {
+  const emptyState = page.page.getByRole("region", {
+    name: /no providers configured/i,
+  });
+  await expect(page.providersTable.or(emptyState)).toBeVisible({
+    timeout: 10000,
+  });
+  return page.providersTable.isVisible().catch(() => false);
 }
 
 export async function deleteProviderIfExists(
@@ -140,7 +154,11 @@ export async function deleteProviderIfExists(
 
   // Navigate to providers page
   await page.goto();
-  await expect(page.providersTable).toBeVisible({ timeout: 10000 });
+  // With zero providers the page shows the empty state, not the table, so there
+  // is nothing to delete.
+  if (!(await providersTableVisibleOrEmptyState(page))) {
+    return;
+  }
 
   const allRows = page.providersTable.locator("tbody tr");
 
@@ -180,7 +198,7 @@ export async function deleteProviderIfExists(
     // Provider not found, nothing to delete
     // Navigate back to providers page to ensure clean state
     await page.goto();
-    await expect(page.providersTable).toBeVisible({ timeout: 10000 });
+    await providersTableVisibleOrEmptyState(page);
     return;
   }
 
@@ -201,9 +219,13 @@ export async function deleteProviderIfExists(
   await expect(deleteMenuItem).toBeVisible({ timeout: 5000 });
   await deleteMenuItem.click();
 
-  // Wait for confirmation modal to appear
+  // Wait for confirmation modal to appear. Exclude the Next.js dev error
+  // overlay, which is also role="dialog" and would otherwise be matched first,
+  // making the assertion wait on the wrong (hidden) element.
   const modal = page.page
-    .locator('[role="dialog"], .modal, [data-testid*="modal"]')
+    .locator(
+      '[role="dialog"]:not([data-nextjs-dialog="true"]), .modal, [data-testid*="modal"]',
+    )
     .first();
 
   await expect(modal).toBeVisible({ timeout: 10000 });
@@ -217,7 +239,8 @@ export async function deleteProviderIfExists(
   // Wait for modal to close (this indicates deletion was initiated)
   await expect(modal).not.toBeVisible({ timeout: 10000 });
 
-  // Navigate back to providers page to ensure clean state
+  // Navigate back to providers page to ensure clean state. Deleting the last
+  // provider reveals the empty state instead of an empty table.
   await page.goto();
-  await expect(page.providersTable).toBeVisible({ timeout: 10000 });
+  await providersTableVisibleOrEmptyState(page);
 }
diff --git a/ui/tests/providers/providers-page.ts b/ui/tests/providers/providers-page.ts
index 5b73269062..f618c59d97 100644
--- a/ui/tests/providers/providers-page.ts
+++ b/ui/tests/providers/providers-page.ts
@@ -81,6 +81,28 @@ export interface GoogleWorkspaceProviderCredential {
   delegatedUser: string;
 }
 
+// Okta provider data
+export interface OktaProviderData {
+  orgDomain: string;
+  alias?: string;
+}
+
+// Okta credential options
+export const OKTA_CREDENTIAL_OPTIONS = {
+  OKTA_PRIVATE_KEY_JWT: "private_key_jwt",
+} as const;
+
+// Okta credential type
+type OktaCredentialType =
+  (typeof OKTA_CREDENTIAL_OPTIONS)[keyof typeof OKTA_CREDENTIAL_OPTIONS];
+
+// Okta provider credential (OAuth 2.0 Private Key JWT)
+export interface OktaProviderCredential {
+  type: OktaCredentialType;
+  clientId: string;
+  privateKey: string;
+}
+
 // AWS credential options
 export const AWS_CREDENTIAL_OPTIONS = {
   AWS_ROLE_ARN: "role",
@@ -224,6 +246,27 @@ export interface AlibabaCloudProviderCredential {
   roleSessionName?: string;
 }
 
+// Vercel provider data
+export interface VercelProviderData {
+  teamId: string;
+  alias?: string;
+}
+
+// Vercel credential options
+export const VERCEL_CREDENTIAL_OPTIONS = {
+  VERCEL_API_TOKEN: "api_token",
+} as const;
+
+// Vercel credential type
+type VercelCredentialType =
+  (typeof VERCEL_CREDENTIAL_OPTIONS)[keyof typeof VERCEL_CREDENTIAL_OPTIONS];
+
+// Vercel provider credential
+export interface VercelProviderCredential {
+  type: VercelCredentialType;
+  apiToken: string;
+}
+
 // Providers page
 export class ProvidersPage extends BasePage {
   readonly wizardModal: Locator;
@@ -246,12 +289,23 @@ export class ProvidersPage extends BasePage {
   readonly ociProviderRadio: Locator;
   readonly alibabacloudProviderRadio: Locator;
   readonly googleworkspaceProviderRadio: Locator;
+  readonly oktaProviderRadio: Locator;
 
   // Google Workspace provider form elements
   readonly googleworkspaceCustomerIdInput: Locator;
   readonly googleworkspaceServiceAccountJsonInput: Locator;
   readonly googleworkspaceDelegatedUserInput: Locator;
 
+  // Okta provider form elements
+  readonly oktaOrgDomainInput: Locator;
+  readonly oktaClientIdInput: Locator;
+  readonly oktaPrivateKeyInput: Locator;
+
+  // Vercel provider form elements
+  readonly vercelProviderRadio: Locator;
+  readonly vercelTeamIdInput: Locator;
+  readonly vercelApiTokenInput: Locator;
+
   // AWS provider form elements
   readonly accountIdInput: Locator;
   readonly nextButton: Locator;
@@ -341,7 +395,10 @@ export class ProvidersPage extends BasePage {
       name: /Adding A Provider|Update Provider Credentials/i,
     });
 
-    // Button to add a new provider
+    // Button to add a new provider. When providers exist this is the filter-bar
+    // "Add Provider" control; with zero providers the page renders the empty
+    // state whose CTA is labelled "Open Add Provider modal" (button on
+    // /providers, link on /scans). Only one of these is ever in the DOM at once.
     this.addProviderButton = page
       .getByRole("button", {
         name: "Add Provider",
@@ -352,7 +409,9 @@ export class ProvidersPage extends BasePage {
           name: "Add Provider",
           exact: true,
         }),
-      );
+      )
+      .or(page.getByRole("button", { name: "Open Add Provider modal" }))
+      .or(page.getByRole("link", { name: "Open Add Provider modal" }));
 
     // Table displaying existing providers
     this.providersTable = page.getByRole("table");
@@ -491,6 +550,26 @@ export class ProvidersPage extends BasePage {
       name: /Delegated User Email/i,
     });
 
+    // Okta
+    this.oktaProviderRadio = page.getByRole("option", {
+      name: /Okta/i,
+    });
+    this.oktaOrgDomainInput = page.getByRole("textbox", {
+      name: "Org Domain",
+    });
+    this.oktaClientIdInput = page.getByRole("textbox", { name: "Client ID" });
+    this.oktaPrivateKeyInput = page.getByRole("textbox", {
+      name: "Private Key",
+    });
+
+    // Vercel
+    this.vercelProviderRadio = page.getByRole("option", {
+      name: /Vercel/i,
+    });
+    this.vercelTeamIdInput = page.getByRole("textbox", { name: "Team ID" });
+    // API Token is a type="password" field (no textbox role); target by label.
+    this.vercelApiTokenInput = page.getByLabel(/API Token/i);
+
     // Alias input
     this.aliasInput = page.getByRole("textbox", {
       name: "Provider alias (optional)",
@@ -801,7 +880,9 @@ export class ProvidersPage extends BasePage {
         if (actionName === "Check connection") {
           await this.handleCheckConnectionCompletion();
         }
-        if (actionName === "Launch scan") {
+        // "Save" is the wizard's final action (saves the scan schedule) and
+        // "Launch scan" its legacy/manual counterpart; both close the modal.
+        if (actionName === "Launch scan" || actionName === "Save") {
           await this.handleLaunchScanCompletion();
         }
         return;
@@ -814,6 +895,12 @@ export class ProvidersPage extends BasePage {
   }
 
   private async handleCheckConnectionCompletion(): Promise<void> {
+    // A successful connection advances to the schedule step ("Save"); older
+    // flows surfaced a "Launch scan" action instead.
+    const saveScheduleButton = this.page.getByRole("button", {
+      name: "Save",
+      exact: true,
+    });
     const launchScanButton = this.page.getByRole("button", {
       name: "Launch scan",
       exact: true,
@@ -824,6 +911,7 @@ export class ProvidersPage extends BasePage {
 
     try {
       await Promise.race([
+        saveScheduleButton.waitFor({ state: "visible", timeout: 30000 }),
         launchScanButton.waitFor({ state: "visible", timeout: 30000 }),
         this.wizardModal.waitFor({ state: "hidden", timeout: 30000 }),
         connectionError.waitFor({ state: "visible", timeout: 30000 }),
@@ -839,18 +927,103 @@ export class ProvidersPage extends BasePage {
       );
     }
 
-    if (await launchScanButton.isVisible().catch(() => false)) {
+    if (await saveScheduleButton.isVisible().catch(() => false)) {
+      await saveScheduleButton.click();
+      await this.handleLaunchScanCompletion();
+    } else if (await launchScanButton.isVisible().catch(() => false)) {
       await launchScanButton.click();
       await this.handleLaunchScanCompletion();
     }
   }
 
+  private async waitForProviderLaunchChoice(): Promise<void> {
+    const launchAction = this.page
+      .getByRole("button", { name: "Save", exact: true })
+      .or(this.page.getByRole("button", { name: "Launch scan", exact: true }));
+    const connectionError = this.page.locator(
+      "div.border-border-error p.text-text-error-primary",
+    );
+
+    try {
+      await Promise.race([
+        launchAction.waitFor({ state: "visible", timeout: 30000 }),
+        connectionError.waitFor({ state: "visible", timeout: 30000 }),
+      ]);
+    } catch {
+      // Continue and inspect visible state below.
+    }
+
+    if (await connectionError.isVisible().catch(() => false)) {
+      const errorText = await connectionError.textContent();
+      throw new Error(
+        `Test connection failed with error: ${errorText?.trim() || "Unknown error"}`,
+      );
+    }
+
+    await expect(launchAction).toBeVisible();
+  }
+
+  async completeProviderConnectionWithoutLaunchingScan(
+    providerUID: string,
+  ): Promise<void> {
+    await this.verifyWizardModalOpen();
+
+    const checkConnectionButton = this.page.getByRole("button", {
+      name: "Check connection",
+      exact: true,
+    });
+    const launchAction = this.page
+      .getByRole("button", { name: "Save", exact: true })
+      .or(this.page.getByRole("button", { name: "Launch scan", exact: true }));
+    const connectionError = this.page.locator(
+      "div.border-border-error p.text-text-error-primary",
+    );
+
+    // The test-connection step renders its footer action only after an async
+    // load (canSubmit gate). Wait for the footer to settle on an actionable
+    // state (or surface a connection error) instead of reading visibility on
+    // the first frame, which races the render and falls through.
+    await expect(
+      checkConnectionButton.or(launchAction).or(connectionError),
+    ).toBeVisible({ timeout: 30000 });
+
+    if (await connectionError.isVisible().catch(() => false)) {
+      const errorText = await connectionError.textContent();
+      throw new Error(
+        `Test connection failed with error: ${errorText?.trim() || "Unknown error"}`,
+      );
+    }
+
+    // Provider-add E2E validates credentials and provider persistence only.
+    // Launching one scan per provider made CI noisy and overloaded the backend;
+    // scan execution itself is covered by scans.spec.ts.
+    if (await checkConnectionButton.isVisible().catch(() => false)) {
+      await checkConnectionButton.click();
+      await this.waitForProviderLaunchChoice();
+    } else {
+      await expect(launchAction).toBeVisible();
+    }
+
+    await this.wizardModal
+      .getByRole("button", { name: "Close", exact: true })
+      .click();
+    await expect(this.wizardModal).not.toBeVisible({ timeout: 30000 });
+    await this.page.waitForURL(/\/providers/, { timeout: 30000 });
+    await this.verifyLoadProviderPageAfterNewProvider();
+
+    const providerExists =
+      await this.verifySingleRowForProviderUID(providerUID);
+    if (!providerExists) {
+      throw new Error(`Provider with UID ${providerUID} was not found.`);
+    }
+  }
+
   private async handleLaunchScanCompletion(): Promise<void> {
     const connectionError = this.page.locator(
       "div.border-border-error p.text-text-error-primary",
     );
     const launchErrorToast = this.page.getByRole("alert").filter({
-      hasText: /Unable to launch scan/i,
+      hasText: /Unable to (launch scan|save scan schedule)/i,
     });
 
     try {
@@ -1283,6 +1456,72 @@ export class ProvidersPage extends BasePage {
     await expect(this.googleworkspaceDelegatedUserInput).toBeVisible();
   }
 
+  async selectOktaProvider(): Promise<void> {
+    await this.selectProviderRadio(this.oktaProviderRadio);
+  }
+
+  async fillOktaProviderDetails(data: OktaProviderData): Promise<void> {
+    // Fill the Okta provider details (org domain is lowercased by the form)
+
+    await this.oktaOrgDomainInput.fill(data.orgDomain);
+
+    if (data.alias) {
+      await this.aliasInput.fill(data.alias);
+    }
+  }
+
+  async fillOktaCredentials(
+    credentials: OktaProviderCredential,
+  ): Promise<void> {
+    // Fill the Okta OAuth 2.0 Private Key JWT credentials form
+
+    if (credentials.clientId) {
+      await this.oktaClientIdInput.fill(credentials.clientId);
+    }
+    if (credentials.privateKey) {
+      await this.oktaPrivateKeyInput.fill(credentials.privateKey);
+    }
+  }
+
+  async verifyOktaCredentialsPageLoaded(): Promise<void> {
+    // Verify the Okta credentials page is loaded
+
+    await this.verifyPageHasProwlerTitle();
+    await expect(this.oktaClientIdInput).toBeVisible();
+    await expect(this.oktaPrivateKeyInput).toBeVisible();
+  }
+
+  async selectVercelProvider(): Promise<void> {
+    await this.selectProviderRadio(this.vercelProviderRadio);
+  }
+
+  async fillVercelProviderDetails(data: VercelProviderData): Promise<void> {
+    // Fill the Vercel provider details (Team ID is the provider UID)
+
+    await this.vercelTeamIdInput.fill(data.teamId);
+
+    if (data.alias) {
+      await this.aliasInput.fill(data.alias);
+    }
+  }
+
+  async fillVercelCredentials(
+    credentials: VercelProviderCredential,
+  ): Promise<void> {
+    // Fill the Vercel credentials form
+
+    if (credentials.apiToken) {
+      await this.vercelApiTokenInput.fill(credentials.apiToken);
+    }
+  }
+
+  async verifyVercelCredentialsPageLoaded(): Promise<void> {
+    // Verify the Vercel credentials page is loaded
+
+    await this.verifyPageHasProwlerTitle();
+    await expect(this.vercelApiTokenInput).toBeVisible();
+  }
+
   async verifyPageLoaded(): Promise<void> {
     // Verify the providers page is loaded
 
@@ -1304,6 +1543,8 @@ export class ProvidersPage extends BasePage {
     await expect(this.githubProviderRadio).toBeVisible();
     await expect(this.alibabacloudProviderRadio).toBeVisible();
     await expect(this.googleworkspaceProviderRadio).toBeVisible();
+    await expect(this.oktaProviderRadio).toBeVisible();
+    await expect(this.vercelProviderRadio).toBeVisible();
   }
 
   async verifyCredentialsPageLoaded(): Promise<void> {
@@ -1378,9 +1619,11 @@ export class ProvidersPage extends BasePage {
     await this.verifyPageHasProwlerTitle();
     await this.verifyWizardModalOpen();
 
-    // Some providers show "Check connection" before "Launch scan".
+    // The final step saves the scan schedule ("Save"); manual-only accounts
+    // show "Launch scan" and some providers show "Check connection" first.
     const launchAction = this.page
-      .getByRole("button", { name: "Launch scan", exact: true })
+      .getByRole("button", { name: "Save", exact: true })
+      .or(this.page.getByRole("button", { name: "Launch scan", exact: true }))
       .or(
         this.page.getByRole("button", {
           name: "Check connection",
@@ -1408,10 +1651,14 @@ export class ProvidersPage extends BasePage {
       hasText: providerUID,
     });
 
-    // Verify the number of matching rows is 1
-    const count = await matchingRows.count();
-    if (count !== 1) return false;
-    return true;
+    // Use an auto-retrying assertion (not an instant count()) so the check
+    // waits for the table refetch to render the newly added provider row.
+    try {
+      await expect(matchingRows).toHaveCount(1, { timeout: 15000 });
+      return true;
+    } catch {
+      return false;
+    }
   }
 
   async selectAuthenticationMethod(method: AWSCredentialType): Promise<void> {
diff --git a/ui/tests/providers/providers.md b/ui/tests/providers/providers.md
index 4d04adaeca..e8139b2b3d 100644
--- a/ui/tests/providers/providers.md
+++ b/ui/tests/providers/providers.md
@@ -32,26 +32,26 @@
 4. Fill provider details (account ID and alias)
 5. Select "credentials" authentication type
 6. Fill static credentials (access key and secret key)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AWS provider successfully added with static credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays AWS option
 - Credentials form accepts static credentials
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -88,26 +88,26 @@
 4. Fill provider details (account ID and alias)
 5. Select "role" authentication type
 6. Fill role credentials (access key, secret key, and role ARN)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AWS provider successfully added with role credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays AWS option
 - Role credentials form accepts all required fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -144,26 +144,26 @@
 3. Select Azure provider type
 4. Fill provider details (subscription ID and alias)
 5. Fill Azure credentials (client ID, client secret, tenant ID)
-6. Launch initial scan
-7. Verify redirect to Scans page
-8. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+6. Confirm provider connection without launching a scan
+7. Verify return to Providers page
+8. Verify provider exists in Providers table
 
 ### Expected Result
 
 - Azure provider successfully added with static credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays Azure option
 - Azure credentials form accepts all required fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by subscription ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by subscription ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -201,26 +201,26 @@
 4. Fill provider details (domain ID and alias)
 5. Select static credentials type
 6. Fill M365 credentials (client ID, client secret, tenant ID)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - M365 provider successfully added with static credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays M365 option
 - M365 credentials form accepts all required fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by domain ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by domain ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -258,26 +258,26 @@
 4. Fill provider details (domain ID and alias)
 5. Select certificate credentials type
 6. Fill M365 certificate credentials (client ID, tenant ID, certificate content)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - M365 provider successfully added with certificate credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays M365 option
 - Certificate credentials form accepts all required fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by domain ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by domain ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -316,16 +316,16 @@
 4. Fill provider details (context and alias)
 5. Verify credentials page is loaded
 6. Fill Kubernetes credentials (kubeconfig content)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - Kubernetes provider successfully added with kubeconfig content
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -334,10 +334,10 @@
 - Provider details form accepts context and alias
 - Credentials page loads with kubeconfig content field
 - Kubeconfig content is properly filled in the correct field
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by context)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by context)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -377,16 +377,16 @@
 4. Fill provider details (project ID and alias)
 5. Select service account credentials type
 6. Fill GCP service account key credentials
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - GCP provider successfully added with service account key
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -395,10 +395,10 @@
 - Provider details form accepts project ID and alias
 - Service account credentials page loads with service account key field
 - Service account key is properly filled in the correct field
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by project ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by project ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -439,16 +439,16 @@
 4. Fill provider details (username and alias)
 5. Select personal access token credentials type
 6. Fill GitHub personal access token credentials
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - GitHub provider successfully added with personal access token
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -457,10 +457,10 @@
 - Provider details form accepts username and alias
 - Personal access token credentials page loads with token field
 - Personal access token is properly filled in the correct field
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by username)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by username)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -499,16 +499,16 @@
 4. Fill provider details (username and alias)
 5. Select GitHub App credentials type
 6. Fill GitHub App credentials (App ID and private key)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - GitHub provider successfully added with GitHub App credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -517,10 +517,10 @@
 - Provider details form accepts username and alias
 - GitHub App credentials page loads with App ID and private key fields
 - GitHub App credentials are properly filled in the correct fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by username)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by username)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -560,16 +560,16 @@
 4. Fill provider details (organization name and alias)
 5. Select personal access token credentials type
 6. Fill GitHub organization personal access token credentials
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - GitHub provider successfully added with organization personal access token
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -578,10 +578,10 @@
 - Provider details form accepts organization name and alias
 - Personal access token credentials page loads with token field
 - Organization personal access token is properly filled in the correct field
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by organization name)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by organization name)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -621,16 +621,16 @@
 5. Select "role" authentication type
 6. Switch authentication method to "Use AWS SDK default credentials"
 7. Fill role ARN using AWS SDK credential inputs
-8. Launch initial scan
-9. Verify redirect to Scans page
-10. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+8. Confirm provider connection without launching a scan
+9. Verify return to Providers page
+10. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AWS provider successfully added using AWS SDK default credentials to assume the role
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -638,10 +638,10 @@
 - Connect account page displays AWS option
 - Credentials form exposes AWS SDK default authentication method
 - Role ARN field accepts provided value when SDK method is selected
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -679,16 +679,16 @@
 4. Fill provider details (tenancy ID and alias)
 5. Verify OCI credentials page is loaded
 6. Fill OCI credentials (user ID, fingerprint, key content, region)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - OCI provider successfully added with API Key credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -697,10 +697,10 @@
 - Provider details form accepts tenancy ID and alias
 - OCI credentials page loads
 - Credentials form accepts all required fields (user ID, fingerprint, key content, region)
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by tenancy ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by tenancy ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -798,16 +798,16 @@
 6. Select static credentials type
 7. Verify static credentials page is loaded
 8. Fill AlibabaCloud credentials (access key ID and access key secret)
-9. Launch initial scan
-10. Verify redirect to Scans page
-11. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+9. Confirm provider connection without launching a scan
+10. Verify return to Providers page
+11. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AlibabaCloud provider successfully added with static credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -817,10 +817,10 @@
 - Credentials page loads with credential type selection
 - Static credentials page loads with access key ID and access key secret fields
 - Static credentials are properly filled in the correct fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -860,16 +860,16 @@
 6. Select RAM Role credentials type
 7. Verify RAM Role credentials page is loaded
 8. Fill AlibabaCloud RAM Role credentials (access key ID, access key secret, and role ARN)
-9. Launch initial scan
-10. Verify redirect to Scans page
-11. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+9. Confirm provider connection without launching a scan
+10. Verify return to Providers page
+11. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AlibabaCloud provider successfully added with RAM Role credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -879,10 +879,10 @@
 - Credentials page loads with credential type selection
 - RAM Role credentials page loads with access key ID, access key secret, and role ARN fields
 - RAM Role credentials are properly filled in the correct fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -924,15 +924,15 @@
 6. Continue to authentication details and provide role ARN
 7. Confirm StackSet deployment checkbox and authenticate
 8. Confirm organization account selection step and continue
-9. Verify organization launch step, choose single scan schedule, and launch
-10. Verify redirect to Scans page
+9. Verify organization launch step, choose daily scan schedule, and save
+10. Verify return to Providers page
 
 ### Expected Result
 
 - AWS Organizations flow completes successfully
 - Accounts are connected and launch step is displayed
 - Scan scheduling selection is applied
-- User is redirected to Scans page after launch
+- User returns to Providers page after saving
 
 ### Key verification points
 
@@ -941,7 +941,7 @@
 - Authentication details step loads
 - Account selection step loads
 - Accounts connected launch step appears
-- Successful redirect to Scans page after launching
+- Successful return to Providers page after saving
 
 ### Notes
 
@@ -978,16 +978,16 @@
 4. Fill provider details (customer ID and alias)
 5. Verify Google Workspace credentials page is loaded
 6. Fill Google Workspace credentials (customer ID, service account JSON, delegated user email)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - Google Workspace provider successfully added with Service Account credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -998,10 +998,10 @@
 - Customer ID help text is visible with instructions on finding the Customer ID
 - Service account JSON field accepts multi-line formatted JSON
 - Delegated user email field validates email format
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by customer ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by customer ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -1012,3 +1012,122 @@
 - Provider cleanup performed before each test to ensure clean state
 - Requires valid Google Workspace account with Service Account having domain-wide delegation enabled
 - Service Account must have appropriate Google Workspace API scopes for security scanning
+
+---
+
+## Test Case: `PROVIDER-E2E-018` - Add Vercel Provider with API Token
+
+**Priority:** `critical`
+
+**Tags:**
+
+- type → @e2e, @serial
+- feature → @providers
+- provider → @vercel
+
+**Description/Objective:** Validates the complete flow of adding a new Vercel provider using API Token authentication, with a Team ID as the provider UID.
+
+**Preconditions:**
+
+- Admin user authentication required (admin.auth.setup setup)
+- Environment variables configured: E2E_VERCEL_TEAM_ID, E2E_VERCEL_API_TOKEN
+- Remove any existing provider with the same Team ID before starting the test
+- This test must be run serially and never in parallel with other tests, as it requires the Team ID not to be already registered beforehand.
+
+### Flow Steps
+
+1. Navigate to providers page
+2. Click "Add Provider" button
+3. Select Vercel provider type
+4. Fill provider details (team ID and alias)
+5. Verify Vercel credentials page is loaded
+6. Fill Vercel credentials (API token)
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
+
+### Expected Result
+
+- Vercel provider successfully added with API Token credentials
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
+
+### Key verification points
+
+- Provider page loads correctly
+- Connect account page displays Vercel option
+- Provider details form accepts team ID and alias
+- Credentials page loads with the API Token field
+- API Token is properly filled in the correct (masked) field
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by team ID)
+- Provider UID matches the expected value
+
+### Notes
+
+- Test uses environment variables for the Vercel Team ID and API Token
+- API Token is a masked (password) field; the only credential required for Vercel
+- Provider cleanup performed before each test to ensure clean state
+- Requires a valid Vercel API Token with read permissions to the resources to assess
+
+---
+
+## Test Case: `PROVIDER-E2E-019` - Add Okta Provider with OAuth 2.0 Private Key JWT Credentials
+
+**Priority:** `critical`
+
+**Tags:**
+
+- type → @e2e, @serial
+- feature → @providers
+- provider → @okta
+
+**Description/Objective:** Validates the complete flow of adding a new Okta provider using OAuth 2.0 Private Key JWT authentication (Client ID and PEM-encoded private key) tied to an Okta Org Domain.
+
+**Preconditions:**
+
+- Admin user authentication required (admin.auth.setup setup)
+- Environment variables configured: E2E_OKTA_DOMAIN, E2E_OKTA_CLIENT_ID, E2E_OKTA_BASE64_PRIVATE_KEY
+- Remove any existing provider with the same Org Domain before starting the test
+- This test must be run serially and never in parallel with other tests, as it requires the Org Domain not to be already registered beforehand.
+
+### Flow Steps
+
+1. Navigate to providers page
+2. Click "Add Provider" button
+3. Select Okta provider type
+4. Fill provider details (org domain and alias)
+5. Verify Okta credentials page is loaded
+6. Fill Okta credentials (client ID and PEM-encoded private key)
+7. Launch initial scan
+8. Verify redirect to Scans page
+9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+
+### Expected Result
+
+- Okta provider successfully added with OAuth 2.0 Private Key JWT credentials
+- Initial scan launched successfully
+- User redirected to Scans page
+- Scheduled scan appears in Scans table with correct provider and scan name
+
+### Key verification points
+
+- Provider page loads correctly
+- Connect account page displays Okta option
+- Provider details form accepts org domain (Okta-managed domain, e.g. acme.okta.com) and alias
+- Credentials page loads with Client ID input and Private Key textarea
+- Credentials are properly filled in the correct fields
+- Launch scan page appears
+- Successful redirect to Scans page after scan launch
+- Provider exists in Scans table (verified by org domain)
+- Scan name field contains "scheduled scan"
+
+### Notes
+
+- Test uses environment variables for Okta credentials
+- Org Domain is lowercased by the form; cleanup and scan verification use the normalized value
+- Private Key is provided as base64-encoded PEM content and decoded before use (multi-line content)
+- Provider cleanup performed before each test to ensure clean state
+- Requires a valid Okta API Services app with a registered public key (JWK) matching the provided private key
diff --git a/ui/tests/providers/providers.spec.ts b/ui/tests/providers/providers.spec.ts
index 7d2a5dd2a0..4dc8f010ed 100644
--- a/ui/tests/providers/providers.spec.ts
+++ b/ui/tests/providers/providers.spec.ts
@@ -30,8 +30,13 @@ import {
   GoogleWorkspaceProviderData,
   GoogleWorkspaceProviderCredential,
   GOOGLEWORKSPACE_CREDENTIAL_OPTIONS,
+  OktaProviderData,
+  OktaProviderCredential,
+  OKTA_CREDENTIAL_OPTIONS,
+  VercelProviderData,
+  VercelProviderCredential,
+  VERCEL_CREDENTIAL_OPTIONS,
 } from "./providers-page";
-import { ScansPage } from "../scans/scans-page";
 import fs from "fs";
 import { deleteProviderIfExists } from "../helpers";
 
@@ -39,7 +44,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add AWS Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
     // Test data from environment variables
     const accountId = process.env.E2E_AWS_PROVIDER_ACCOUNT_ID ?? "";
     const accessKey = process.env.E2E_AWS_PROVIDER_ACCESS_KEY ?? "";
@@ -117,16 +121,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillStaticCredentials(staticCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to provider page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
 
@@ -190,16 +188,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillRoleCredentials(roleCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to provider page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
 
@@ -265,16 +257,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillRoleCredentials(roleCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to provider page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
 
@@ -291,6 +277,14 @@ test.describe("Add Provider", () => {
         ],
       },
       async ({ page }) => {
+        // AWS Organizations (multi-account onboarding) is a Cloud-only feature,
+        // so this test must never run in the OSS CI. Gate explicitly on the
+        // Cloud env flag instead of relying on the org env vars being absent.
+        test.skip(
+          process.env.NEXT_PUBLIC_IS_CLOUD_ENV !== "true",
+          "AWS Organizations multi-account onboarding is a Cloud-only feature",
+        );
+
         if (!organizationId || !organizationRoleArn) {
           test.skip(
             true,
@@ -337,11 +331,10 @@ test.describe("Add Provider", () => {
         await providersPage.clickNext();
 
         await providersPage.verifyOrganizationsLaunchStepLoaded();
-        await providersPage.chooseOrganizationsScanSchedule("single");
+        await providersPage.chooseOrganizationsScanSchedule("daily");
         await providersPage.clickNext();
 
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
+        await providersPage.verifyLoadProviderPageAfterNewProvider();
       },
     );
   });
@@ -349,7 +342,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add AZURE Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const subscriptionId = process.env.E2E_AZURE_SUBSCRIPTION_ID ?? "";
@@ -416,16 +408,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillAZURECredentials(azureCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(subscriptionId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          subscriptionId,
+        );
       },
     );
   });
@@ -433,7 +419,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add M365 Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const domainId = process.env.E2E_M365_DOMAIN_ID ?? "";
@@ -513,16 +498,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillM365Credentials(m365Credentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(domainId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          domainId,
+        );
       },
     );
 
@@ -590,16 +569,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillM365CertificateCredentials(m365Credentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(domainId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          domainId,
+        );
       },
     );
   });
@@ -607,7 +580,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add Kubernetes Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const context = process.env.E2E_KUBERNETES_CONTEXT ?? "";
@@ -690,16 +662,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillKubernetesCredentials(kubernetesCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to provider page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(context);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          context,
+        );
       },
     );
   });
@@ -707,7 +673,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add GCP Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const projectId = process.env.E2E_GCP_PROJECT_ID ?? "";
@@ -796,16 +761,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillGCPServiceAccountKeyCredentials(gcpCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(projectId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          projectId,
+        );
       },
     );
   });
@@ -813,7 +772,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add GitHub Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     test.describe("Add GitHub provider with username", () => {
       const username = process.env.E2E_GITHUB_USERNAME ?? "";
@@ -893,16 +851,10 @@ test.describe("Add Provider", () => {
           );
           await providersPage.clickNext();
 
-          // Launch scan
-          await providersPage.verifyLaunchScanPageLoaded();
-          await providersPage.clickNext();
-
-          // Wait for redirect to scan page
-          scansPage = new ScansPage(page);
-          await scansPage.verifyPageLoaded();
-
-          // Verify scan status is "Scheduled scan"
-          await scansPage.verifyScheduledScanStatus(username);
+          // Confirm the provider connection without launching a scan
+          await providersPage.completeProviderConnectionWithoutLaunchingScan(
+            username,
+          );
         },
       );
       test(
@@ -975,16 +927,10 @@ test.describe("Add Provider", () => {
           await providersPage.fillGitHubAppCredentials(githubCredentials);
           await providersPage.clickNext();
 
-          // Launch scan
-          await providersPage.verifyLaunchScanPageLoaded();
-          await providersPage.clickNext();
-
-          // Wait for redirect to scan page
-          scansPage = new ScansPage(page);
-          await scansPage.verifyPageLoaded();
-
-          // Verify scan status is "Scheduled scan"
-          await scansPage.verifyScheduledScanStatus(username);
+          // Confirm the provider connection without launching a scan
+          await providersPage.completeProviderConnectionWithoutLaunchingScan(
+            username,
+          );
         },
       );
     });
@@ -1065,16 +1011,10 @@ test.describe("Add Provider", () => {
           );
           await providersPage.clickNext();
 
-          // Launch scan
-          await providersPage.verifyLaunchScanPageLoaded();
-          await providersPage.clickNext();
-
-          // Wait for redirect to scan page
-          scansPage = new ScansPage(page);
-          await scansPage.verifyPageLoaded();
-
-          // Verify scan status is "Scheduled scan"
-          await scansPage.verifyScheduledScanStatus(organization);
+          // Confirm the provider connection without launching a scan
+          await providersPage.completeProviderConnectionWithoutLaunchingScan(
+            organization,
+          );
         },
       );
     });
@@ -1083,7 +1023,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add OCI Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const tenancyId = process.env.E2E_OCI_TENANCY_ID ?? "";
@@ -1156,16 +1095,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillOCICredentials(ociCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(tenancyId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          tenancyId,
+        );
       },
     );
   });
@@ -1173,7 +1106,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add AlibabaCloud Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const accountId = process.env.E2E_ALIBABACLOUD_ACCOUNT_ID ?? "";
@@ -1259,16 +1191,10 @@ test.describe("Add Provider", () => {
         );
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
 
@@ -1338,23 +1264,16 @@ test.describe("Add Provider", () => {
         await providersPage.fillAlibabaCloudRoleCredentials(roleCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
   });
 
   test.describe.serial("Add Google Workspace Provider", () => {
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     const customerId = process.env.E2E_GOOGLEWORKSPACE_CUSTOMER_ID ?? "";
     const serviceAccountJson =
@@ -1422,16 +1341,167 @@ test.describe("Add Provider", () => {
         );
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          customerId,
+        );
+      },
+    );
+  });
+
+  test.describe.serial("Add Vercel Provider", () => {
+    let providersPage: ProvidersPage;
+
+    // Test data from environment variables
+    const teamId = process.env.E2E_VERCEL_TEAM_ID ?? "";
+    const apiToken = process.env.E2E_VERCEL_API_TOKEN ?? "";
+
+    // Setup before each test
+    test.beforeEach(async ({ page }) => {
+      test.skip(!teamId || !apiToken, "Vercel E2E env vars are not set");
+      providersPage = new ProvidersPage(page);
+      await deleteProviderIfExists(providersPage, teamId!);
+    });
+
+    // Use admin authentication for provider management
+    test.use({ storageState: "playwright/.auth/admin_user.json" });
+
+    test(
+      "should add a new Vercel provider with API token",
+      {
+        tag: [
+          "@critical",
+          "@e2e",
+          "@providers",
+          "@vercel",
+          "@serial",
+          "@PROVIDER-E2E-018",
+        ],
+      },
+      async ({ page }) => {
+        // Prepare test data for Vercel provider (Team ID is the provider UID)
+        const vercelProviderData: VercelProviderData = {
+          teamId: teamId,
+          alias: "Test E2E Vercel Account - API Token",
+        };
+
+        // Prepare API token credentials
+        const vercelCredentials: VercelProviderCredential = {
+          type: VERCEL_CREDENTIAL_OPTIONS.VERCEL_API_TOKEN,
+          apiToken: apiToken,
+        };
+
+        // Navigate to providers page
+        await providersPage.goto();
+        await providersPage.verifyPageLoaded();
+
+        // Start adding new provider
+        await providersPage.clickAddProvider();
+        await providersPage.verifyConnectAccountPageLoaded();
+
+        // Select Vercel provider
+        await providersPage.selectVercelProvider();
+
+        // Fill provider details (team ID and alias)
+        await providersPage.fillVercelProviderDetails(vercelProviderData);
         await providersPage.clickNext();
 
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
+        // Verify credentials page is loaded
+        await providersPage.verifyVercelCredentialsPageLoaded();
 
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(customerId);
+        // Fill credentials (API token)
+        await providersPage.fillVercelCredentials(vercelCredentials);
+        await providersPage.clickNext();
+
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          teamId,
+        );
+      },
+    );
+  });
+
+  test.describe.serial("Add Okta Provider", () => {
+    let providersPage: ProvidersPage;
+
+    // Test data from environment variables
+    // Org Domain is lowercased by the form, so normalize here to match the
+    // stored provider UID used for cleanup.
+    const orgDomain = (process.env.E2E_OKTA_DOMAIN ?? "").toLowerCase();
+    const clientId = process.env.E2E_OKTA_CLIENT_ID ?? "";
+    const privateKeyB64 = process.env.E2E_OKTA_BASE64_PRIVATE_KEY ?? "";
+
+    // Setup before each test
+    test.beforeEach(async ({ page }) => {
+      test.skip(
+        !orgDomain || !clientId || !privateKeyB64,
+        "Okta E2E env vars are not set",
+      );
+      providersPage = new ProvidersPage(page);
+      await deleteProviderIfExists(providersPage, orgDomain!);
+    });
+
+    // Use admin authentication for provider management
+    test.use({ storageState: "playwright/.auth/admin_user.json" });
+
+    test(
+      "should add a new Okta provider with OAuth 2.0 Private Key JWT credentials",
+      {
+        tag: [
+          "@critical",
+          "@e2e",
+          "@providers",
+          "@okta",
+          "@serial",
+          "@PROVIDER-E2E-019",
+        ],
+      },
+      async ({ page }) => {
+        // The Okta app private key is PEM-encoded (multi-line), so it is passed
+        // base64-encoded via the environment variable and decoded here.
+        const privateKey = Buffer.from(privateKeyB64, "base64").toString(
+          "utf8",
+        );
+
+        // Prepare test data for Okta provider
+        const oktaProviderData: OktaProviderData = {
+          orgDomain: orgDomain,
+          alias: "Test E2E Okta Account - Private Key JWT",
+        };
+
+        // Prepare OAuth 2.0 Private Key JWT credentials
+        const oktaCredentials: OktaProviderCredential = {
+          type: OKTA_CREDENTIAL_OPTIONS.OKTA_PRIVATE_KEY_JWT,
+          clientId: clientId,
+          privateKey: privateKey,
+        };
+
+        // Navigate to providers page
+        await providersPage.goto();
+        await providersPage.verifyPageLoaded();
+
+        // Start adding new provider
+        await providersPage.clickAddProvider();
+        await providersPage.verifyConnectAccountPageLoaded();
+
+        // Select Okta provider
+        await providersPage.selectOktaProvider();
+
+        // Fill provider details (org domain and alias)
+        await providersPage.fillOktaProviderDetails(oktaProviderData);
+        await providersPage.clickNext();
+
+        // Verify Okta credentials page is loaded
+        await providersPage.verifyOktaCredentialsPageLoaded();
+
+        // Fill OAuth 2.0 Private Key JWT credentials
+        await providersPage.fillOktaCredentials(oktaCredentials);
+        await providersPage.clickNext();
+
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          orgDomain,
+        );
       },
     );
   });
diff --git a/ui/tests/runtime-config/runtime-config-page.ts b/ui/tests/runtime-config/runtime-config-page.ts
new file mode 100644
index 0000000000..28c9ad6065
--- /dev/null
+++ b/ui/tests/runtime-config/runtime-config-page.ts
@@ -0,0 +1,124 @@
+import { expect, Locator, Page, Request } from "@playwright/test";
+
+import {
+  RUNTIME_CONFIG_SCRIPT_ID,
+  type RuntimePublicConfig,
+} from "@/lib/runtime-config.shared";
+
+import { BasePage } from "../base-page";
+
+export { RUNTIME_CONFIG_SCRIPT_ID };
+
+/** Keys the runtime data island is expected to expose (the allowlist). */
+export const RUNTIME_CONFIG_KEYS = [
+  "sentryDsn",
+  "sentryEnvironment",
+  "googleTagManagerId",
+  "apiBaseUrl",
+  "apiDocsUrl",
+  "posthogKey",
+  "posthogHost",
+  "reoDevClientId",
+] as const satisfies ReadonlyArray<keyof RuntimePublicConfig>;
+
+/**
+ * Page object for the runtime public-config data island. The island is rendered
+ * into `<head>` by both root layouts, so any unauthenticated route works; the
+ * sign-in page is used because it needs no session.
+ */
+export class RuntimeConfigPage extends BasePage {
+  readonly island: Locator;
+
+  constructor(page: Page) {
+    super(page);
+    this.island = page.locator(`script#${RUNTIME_CONFIG_SCRIPT_ID}`);
+  }
+
+  async goto(): Promise<void> {
+    await super.goto("/sign-in");
+  }
+
+  /** Parsed island JSON, or null when the island is missing/malformed. */
+  async readConfig(): Promise<Record<string, unknown> | null> {
+    return this.page.evaluate((id) => {
+      const el = document.getElementById(id);
+      if (!el?.textContent) return null;
+      try {
+        return JSON.parse(el.textContent) as Record<string, unknown>;
+      } catch {
+        return null;
+      }
+    }, RUNTIME_CONFIG_SCRIPT_ID);
+  }
+
+  /** DSN the browser Sentry client initialized with, or null if uninitialized. */
+  async sentryInitializedDsn(): Promise<string | null> {
+    return this.page.evaluate(() => {
+      const sentry = (window as unknown as { __SENTRY__?: unknown }).__SENTRY__;
+      if (!sentry || typeof sentry !== "object") return null;
+      const hub = sentry as {
+        getClient?: () => unknown;
+        hub?: { getClient?: () => unknown };
+      };
+      const client = (hub.getClient?.() ?? hub.hub?.getClient?.()) as
+        | { getOptions?: () => { dsn?: string } }
+        | undefined;
+      return client?.getOptions?.().dsn ?? null;
+    });
+  }
+
+  async verifyIslandInHead(): Promise<void> {
+    // type="application/json" ⇒ inert, not governed by CSP script-src.
+    await expect(this.island).toHaveAttribute("type", "application/json");
+    const parentTag = await this.island.evaluate(
+      (el) => el.parentElement?.tagName.toLowerCase() ?? "",
+    );
+    expect(parentTag).toBe("head");
+  }
+
+  /**
+   * The island must precede the first ordered (non-`async`) bundle
+   * `<script src>` — that bundle is the client entry calling
+   * getRuntimeConfigClient(), so the island must exist before it runs. Next.js's
+   * `async` chunk-preloads load out of order and don't read the config, so they
+   * are excluded.
+   */
+  async verifyIslandPrecedesClientBundle(): Promise<void> {
+    const precedes = await this.page.evaluate((id) => {
+      const scripts = Array.from(document.querySelectorAll("script"));
+      const islandIndex = scripts.findIndex((s) => s.id === id);
+      if (islandIndex === -1) return false;
+      const firstOrderedBundleIndex = scripts.findIndex(
+        (s) => s.src && !s.async,
+      );
+      return (
+        firstOrderedBundleIndex === -1 || islandIndex < firstOrderedBundleIndex
+      );
+    }, RUNTIME_CONFIG_SCRIPT_ID);
+    expect(precedes).toBe(true);
+  }
+
+  /**
+   * Reload the page while recording any request whose URL contains one of the
+   * given host fragments. Returns the matching URLs (empty ⇒ zero egress).
+   */
+  async thirdPartyRequestsOnReload(hostFragments: string[]): Promise<string[]> {
+    const hits: string[] = [];
+    const listener = (req: Request) => {
+      const url = req.url();
+      if (hostFragments.some((fragment) => url.includes(fragment))) {
+        hits.push(url);
+      }
+    };
+    this.page.on("request", listener);
+    await this.page.reload({ waitUntil: "load" });
+    this.page.off("request", listener);
+    return hits;
+  }
+
+  async verifyGoogleTagManagerNotRendered(): Promise<void> {
+    await expect(
+      this.page.locator('script[src*="googletagmanager.com"]'),
+    ).toHaveCount(0);
+  }
+}
diff --git a/ui/tests/runtime-config/runtime-config.md b/ui/tests/runtime-config/runtime-config.md
new file mode 100644
index 0000000000..18aedaa1b3
--- /dev/null
+++ b/ui/tests/runtime-config/runtime-config.md
@@ -0,0 +1,87 @@
+### E2E Tests: Runtime Public-Config Data Island
+
+**Suite ID:** `RUNTIME-CONFIG-E2E`
+**Feature:** Runtime resolution of public client config via an inert JSON data
+island injected into `<head>` (Sentry, GTM, API base/docs URL, reserved keys).
+
+---
+
+## Test Case: `RUNTIME-CONFIG-E2E-001` - Island rendered in `<head>` before the client bundle
+
+**Priority:** `critical`
+**Tags:** @e2e, @runtime-config
+
+**Preconditions:**
+
+- UI server running with `UI_API_BASE_URL` set (the playwright `webServer` provides it).
+
+### Flow Steps
+
+1. Navigate to `/sign-in` (unauthenticated; the island renders on every route).
+2. Locate `script#__PROWLER_RUNTIME_CONFIG__`.
+
+### Expected Result
+
+- The island exists, is `type="application/json"` (inert), and lives in `<head>`.
+- The island appears before the first ordered (non-`async`) bundle `<script src>` — Next.js's `async` chunk-preloads in `<head>` don't execute in order and are excluded.
+- It parses as JSON exposing exactly the allowlisted keys and a truthy `apiBaseUrl`.
+
+### Key Verification Points
+
+- In-`<head>`-before-bundle ordering guarantee (not provable in jsdom).
+- Only the allowlisted shape is exposed (no other env leaks).
+
+---
+
+## Test Case: `RUNTIME-CONFIG-E2E-002` - Browser Sentry init matches the island DSN
+
+**Priority:** `high`
+**Tags:** @e2e, @runtime-config
+
+**Preconditions:**
+
+- UI server running. `UI_SENTRY_DSN` may be set or unset.
+
+### Flow Steps
+
+1. Navigate to `/sign-in`.
+2. Read `sentryDsn` from the island.
+3. Read the DSN the browser Sentry client initialized with.
+
+### Expected Result
+
+- If the island carries a DSN, the browser Sentry client initialized with that
+  exact runtime DSN (proving the island feeds `Sentry.init` race-free).
+- If the island has no DSN, Sentry is not initialized (zero egress — the default).
+
+### Key Verification Points
+
+- The runtime DSN reaches module-load Sentry init via the island.
+- Unset DSN ⇒ no Sentry initialization (privacy guarantee).
+
+---
+
+## Test Case: `RUNTIME-CONFIG-E2E-003` - Zero third-party telemetry when Sentry and GTM are unset
+
+**Priority:** `critical`
+**Tags:** @e2e, @runtime-config
+
+**Preconditions:**
+
+- UI server running with `UI_SENTRY_DSN` and `UI_GOOGLE_TAG_MANAGER_ID` unset (the Enterprise default; the test skips when either is configured).
+
+### Flow Steps
+
+1. Navigate to `/sign-in` and read the island config.
+2. Reload while recording requests to `googletagmanager.com`, `google-analytics.com`, and `sentry.io`.
+3. Inspect the DOM for a Google Tag Manager script.
+
+### Expected Result
+
+- No request is sent to any Google or Sentry host.
+- The `GoogleTagManager` component is not rendered (no `gtm.js` script).
+
+### Key Verification Points
+
+- Enterprise default sends zero error/analytics telemetry to any third party.
+- Empty/unset GTM id ⇒ component not mounted (an empty id is NOT inert).
diff --git a/ui/tests/runtime-config/runtime-config.spec.ts b/ui/tests/runtime-config/runtime-config.spec.ts
new file mode 100644
index 0000000000..8e94e0527f
--- /dev/null
+++ b/ui/tests/runtime-config/runtime-config.spec.ts
@@ -0,0 +1,82 @@
+import { expect, test } from "@playwright/test";
+
+import { RUNTIME_CONFIG_KEYS, RuntimeConfigPage } from "./runtime-config-page";
+
+test.describe("Runtime public-config data island", () => {
+  let runtimeConfigPage: RuntimeConfigPage;
+
+  test.beforeEach(async ({ page }) => {
+    runtimeConfigPage = new RuntimeConfigPage(page);
+    await runtimeConfigPage.goto();
+  });
+
+  test(
+    "renders an inert JSON island in <head> before the client bundle",
+    {
+      tag: ["@critical", "@e2e", "@runtime-config", "@RUNTIME-CONFIG-E2E-001"],
+    },
+    async () => {
+      // The island exists, is inert (application/json), lives in <head>, and
+      // precedes the first ordered (non-async) bundle script (the ordering
+      // guarantee a jsdom unit test cannot prove).
+      await expect(runtimeConfigPage.island).toBeAttached();
+      await runtimeConfigPage.verifyIslandInHead();
+      await runtimeConfigPage.verifyIslandPrecedesClientBundle();
+
+      // It carries exactly the allowlisted shape and parses as JSON.
+      const config = await runtimeConfigPage.readConfig();
+      expect(config).not.toBeNull();
+      expect(Object.keys(config ?? {}).sort()).toEqual(
+        [...RUNTIME_CONFIG_KEYS].sort(),
+      );
+      // API base URL is the required runtime value supplied to the server.
+      expect(config?.apiBaseUrl).toBeTruthy();
+    },
+  );
+
+  test(
+    "browser Sentry init is consistent with the island DSN",
+    { tag: ["@high", "@e2e", "@runtime-config", "@RUNTIME-CONFIG-E2E-002"] },
+    async () => {
+      // The island feeds instrumentation-client's Sentry.init race-free. Assert
+      // the wiring regardless of whether this deployment configures a DSN:
+      //  - DSN set   ⇒ Sentry initialized with that exact runtime DSN
+      //  - DSN unset ⇒ Sentry not initialized (zero egress, the default)
+      const config = await runtimeConfigPage.readConfig();
+      const islandDsn = (config?.sentryDsn as string | null) ?? null;
+      const initializedDsn = await runtimeConfigPage.sentryInitializedDsn();
+
+      if (islandDsn) {
+        expect(initializedDsn).toBe(islandDsn);
+      } else {
+        expect(initializedDsn).toBeNull();
+      }
+    },
+  );
+
+  test(
+    "sends zero third-party telemetry when Sentry and GTM are unset",
+    {
+      tag: ["@critical", "@e2e", "@runtime-config", "@RUNTIME-CONFIG-E2E-003"],
+    },
+    async () => {
+      // The Enterprise default: with neither integration configured, the page
+      // must not contact Sentry or Google. Only meaningful when this deployment
+      // actually leaves them unset.
+      const config = await runtimeConfigPage.readConfig();
+      test.skip(
+        Boolean(config?.sentryDsn) || Boolean(config?.googleTagManagerId),
+        "Sentry or GTM is configured in this environment",
+      );
+
+      const hits = await runtimeConfigPage.thirdPartyRequestsOnReload([
+        "googletagmanager.com",
+        "google-analytics.com",
+        "sentry.io",
+      ]);
+
+      expect(hits).toEqual([]);
+      await runtimeConfigPage.verifyGoogleTagManagerNotRendered();
+    },
+  );
+});
diff --git a/ui/tests/scans/scans.md b/ui/tests/scans/scans.md
index 2dcd329be6..5baef3a42d 100644
--- a/ui/tests/scans/scans.md
+++ b/ui/tests/scans/scans.md
@@ -21,6 +21,7 @@
 - Admin user authentication required (admin.auth.setup setup)
 - Environment variables configured for : E2E_AWS_PROVIDER_ACCOUNT_ID,E2E_AWS_PROVIDER_ACCESS_KEY and E2E_AWS_PROVIDER_SECRET_KEY
 - Remove any existing AWS provider with the same Account ID before starting the test
+- Create a connected AWS provider without launching a preparatory scan
 - This test must be run serially and never in parallel with other tests, as it requires the Account ID Provider to be already registered.
 
 ### Flow Steps
@@ -55,5 +56,5 @@
 
 - The scans view is tabbed (In Progress / Completed / Scheduled) and `/scans` defaults to Completed. Each empty tab renders an empty-state card instead of a table, so page-loaded checks assert the tabs shell, not the table.
 - The table may take a short time to reflect the new scan; assertions look for a row containing the account ID.
-- Provider cleanup performed before each test to ensure clean state
+- Provider cleanup and provider connection setup are performed before each test to ensure clean state
 - Tests should run serially to avoid state conflicts.
diff --git a/ui/types/compliance.ts b/ui/types/compliance.ts
index 9ea851c2d4..3a46375a75 100644
--- a/ui/types/compliance.ts
+++ b/ui/types/compliance.ts
@@ -279,6 +279,12 @@ const isOneOf = <T extends string>(
 const isStringArray = (value: unknown): value is string[] =>
   Array.isArray(value) && value.every((item) => typeof item === "string");
 
+const isOptionalString = (value: unknown): value is string | undefined =>
+  value === undefined || typeof value === "string";
+
+const isOptionalStringArray = (value: unknown): value is string[] | undefined =>
+  value === undefined || isStringArray(value);
+
 const ASD_METADATA_STRING_FIELDS = [
   "Section",
   "Description",
@@ -327,6 +333,68 @@ export interface ASDEssentialEightRequirement extends Requirement {
   references: ASDEssentialEightAttributesMetadata["References"];
 }
 
+export interface OktaIDaaSStigAttributesMetadata {
+  Section: string;
+  Severity: string;
+  RuleID: string;
+  StigID: string;
+  CCI?: string[];
+  CheckText?: string;
+  FixText?: string;
+}
+
+const OKTA_IDAAS_STIG_REQUIRED_STRING_FIELDS = [
+  "Section",
+  "Severity",
+  "RuleID",
+  "StigID",
+] as const satisfies readonly (keyof OktaIDaaSStigAttributesMetadata)[];
+
+export const isOktaIDaaSStigAttributesMetadata = (
+  value: unknown,
+): value is OktaIDaaSStigAttributesMetadata =>
+  isRecord(value) &&
+  OKTA_IDAAS_STIG_REQUIRED_STRING_FIELDS.every(
+    (field) => typeof value[field] === "string",
+  ) &&
+  isOptionalStringArray(value.CCI) &&
+  isOptionalString(value.CheckText) &&
+  isOptionalString(value.FixText);
+
+export interface OktaIDaaSStigRequirement extends Requirement {
+  severity: OktaIDaaSStigAttributesMetadata["Severity"];
+  rule_id: OktaIDaaSStigAttributesMetadata["RuleID"];
+  stig_id: OktaIDaaSStigAttributesMetadata["StigID"];
+  cci: OktaIDaaSStigAttributesMetadata["CCI"];
+  check_text: OktaIDaaSStigAttributesMetadata["CheckText"];
+  fix_text: OktaIDaaSStigAttributesMetadata["FixText"];
+}
+
+// DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554).
+// Universal framework — flat attributes dict with Pillar/Article/ArticleTitle.
+// `Pillar` is the canonical grouping key for tables and PDF; the enum mirrors
+// the five DORA pillars declared in `prowler/compliance/dora_2022_2554.json`.
+export const DORA_PILLAR = {
+  ICT_RISK_MANAGEMENT: "ICT Risk Management",
+  INCIDENT_REPORTING: "ICT-Related Incident Reporting",
+  RESILIENCE_TESTING: "Digital Operational Resilience Testing",
+  THIRD_PARTY_RISK: "ICT Third-Party Risk Management",
+  INFORMATION_SHARING: "Information Sharing",
+} as const;
+export type DORAPillar = (typeof DORA_PILLAR)[keyof typeof DORA_PILLAR];
+
+export interface DORAAttributesMetadata {
+  Pillar: DORAPillar;
+  Article: string;
+  ArticleTitle: string;
+}
+
+export interface DORARequirement extends Requirement {
+  pillar: DORAAttributesMetadata["Pillar"];
+  article: DORAAttributesMetadata["Article"];
+  article_title: DORAAttributesMetadata["ArticleTitle"];
+}
+
 export interface AttributesItemData {
   type: "compliance-requirements-attributes";
   id: string;
@@ -349,6 +417,8 @@ export interface AttributesItemData {
         | CCCAttributesMetadata[]
         | CSAAttributesMetadata[]
         | ASDEssentialEightAttributesMetadata[]
+        | OktaIDaaSStigAttributesMetadata[]
+        | DORAAttributesMetadata[]
         | GenericAttributesMetadata[];
       check_ids: string[];
       // MITRE structure
diff --git a/ui/types/env.d.ts b/ui/types/env.d.ts
new file mode 100644
index 0000000000..bfb995d5d1
--- /dev/null
+++ b/ui/types/env.d.ts
@@ -0,0 +1,155 @@
+declare global {
+  namespace NodeJS {
+    interface ProcessEnv {
+      // Runtime (Node / Next.js)
+      NODE_ENV: "development" | "production" | "test";
+      NEXT_RUNTIME?: "nodejs" | "edge";
+
+      // UI prefix — runtime public config, read server-side per request and
+      // exposed to the browser via the runtime data island. Each var keeps its
+      // deprecated NEXT_PUBLIC_* name as a runtime fallback (see readEnv).
+      /** @deprecated use UI_API_BASE_URL */
+      NEXT_PUBLIC_API_BASE_URL?: string;
+      UI_API_BASE_URL: string;
+      /** @deprecated use UI_API_DOCS_URL */
+      NEXT_PUBLIC_API_DOCS_URL?: string;
+      UI_API_DOCS_URL?: string;
+
+      // GTM
+      /** @deprecated use UI_GOOGLE_TAG_MANAGER_ID */
+      NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID?: string;
+      UI_GOOGLE_TAG_MANAGER_ID?: string;
+
+      // SENTRY
+      /** @deprecated use UI_SENTRY_DSN */
+      NEXT_PUBLIC_SENTRY_DSN?: string;
+      UI_SENTRY_DSN?: string;
+      /** @deprecated use UI_SENTRY_ENVIRONMENT */
+      NEXT_PUBLIC_SENTRY_ENVIRONMENT?: string;
+      UI_SENTRY_ENVIRONMENT?: string;
+
+      // Build-time public config
+      NEXT_PUBLIC_IS_CLOUD_ENV?: "true" | "false";
+      NEXT_PUBLIC_PROWLER_RELEASE_VERSION?: string;
+
+      // Auth (NextAuth)
+      AUTH_URL: string;
+      AUTH_SECRET: string;
+      AUTH_TRUST_HOST?: "true" | "false";
+      NEXTAUTH_URL?: string;
+
+      // Sentry (server / build)
+      SENTRY_RELEASE?: string;
+      SENTRY_ORG?: string;
+      SENTRY_PROJECT?: string;
+      SENTRY_AUTH_TOKEN?: string;
+
+      // TODO Reserved runtime public config (registered now; no UI consumer yet)
+      POSTHOG_KEY?: string;
+      POSTHOG_HOST?: string;
+      REO_DEV_CLIENT_ID?: string;
+
+      // Social OAuth
+      SOCIAL_GOOGLE_OAUTH_CLIENT_ID?: string;
+      SOCIAL_GOOGLE_OAUTH_CLIENT_SECRET?: string;
+      SOCIAL_GOOGLE_OAUTH_CALLBACK_URL?: string;
+      SOCIAL_GITHUB_OAUTH_CLIENT_ID?: string;
+      SOCIAL_GITHUB_OAUTH_CLIENT_SECRET?: string;
+      SOCIAL_GITHUB_OAUTH_CALLBACK_URL?: string;
+
+      // Feature integrations
+      PROWLER_MCP_SERVER_URL?: string;
+      // JSON-encoded array, parsed in actions/feeds
+      RSS_FEED_SOURCES?: string;
+
+      // Environment detection
+      CI?: string;
+      DOCKER?: string;
+      KUBERNETES_SERVICE_HOST?: string;
+
+      // E2E test credentials (Playwright only)
+      E2E_ADMIN_USER?: string;
+      E2E_ADMIN_PASSWORD?: string;
+      E2E_NEW_USER_PASSWORD?: string;
+      E2E_MANAGE_CLOUD_PROVIDERS_USER?: string;
+      E2E_MANAGE_CLOUD_PROVIDERS_PASSWORD?: string;
+      E2E_INVITE_AND_MANAGE_USERS_USER?: string;
+      E2E_INVITE_AND_MANAGE_USERS_PASSWORD?: string;
+      E2E_UNLIMITED_VISIBILITY_USER?: string;
+      E2E_UNLIMITED_VISIBILITY_PASSWORD?: string;
+      E2E_MANAGE_INTEGRATIONS_USER?: string;
+      E2E_MANAGE_INTEGRATIONS_PASSWORD?: string;
+      E2E_MANAGE_ACCOUNT_USER?: string;
+      E2E_MANAGE_ACCOUNT_PASSWORD?: string;
+      E2E_MANAGE_SCANS_USER?: string;
+      E2E_MANAGE_SCANS_PASSWORD?: string;
+      E2E_ORGANIZATION_ID?: string;
+
+      // E2E AWS
+      E2E_AWS_PROVIDER_ACCOUNT_ID?: string;
+      E2E_AWS_PROVIDER_ACCESS_KEY?: string;
+      E2E_AWS_PROVIDER_SECRET_KEY?: string;
+      E2E_AWS_PROVIDER_ROLE_ARN?: string;
+      E2E_AWS_ORGANIZATION_ID?: string;
+      E2E_AWS_ORGANIZATION_ROLE_ARN?: string;
+
+      // E2E Azure
+      E2E_AZURE_SUBSCRIPTION_ID?: string;
+      E2E_AZURE_CLIENT_ID?: string;
+      E2E_AZURE_SECRET_ID?: string;
+      E2E_AZURE_TENANT_ID?: string;
+
+      // E2E Microsoft 365
+      E2E_M365_DOMAIN_ID?: string;
+      E2E_M365_CLIENT_ID?: string;
+      E2E_M365_TENANT_ID?: string;
+      E2E_M365_SECRET_ID?: string;
+      E2E_M365_CERTIFICATE_CONTENT?: string;
+
+      // E2E GCP
+      E2E_GCP_PROJECT_ID?: string;
+      E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY?: string;
+
+      // E2E Kubernetes
+      E2E_KUBERNETES_CONTEXT?: string;
+      E2E_KUBERNETES_KUBECONFIG_PATH?: string;
+
+      // E2E GitHub
+      E2E_GITHUB_USERNAME?: string;
+      E2E_GITHUB_PERSONAL_ACCESS_TOKEN?: string;
+      E2E_GITHUB_APP_ID?: string;
+      E2E_GITHUB_BASE64_APP_PRIVATE_KEY?: string;
+      E2E_GITHUB_ORGANIZATION?: string;
+      E2E_GITHUB_ORGANIZATION_ACCESS_TOKEN?: string;
+
+      // E2E Oracle Cloud
+      E2E_OCI_TENANCY_ID?: string;
+      E2E_OCI_USER_ID?: string;
+      E2E_OCI_FINGERPRINT?: string;
+      E2E_OCI_KEY_CONTENT?: string;
+      E2E_OCI_REGION?: string;
+
+      // E2E Alibaba Cloud
+      E2E_ALIBABACLOUD_ACCOUNT_ID?: string;
+      E2E_ALIBABACLOUD_ACCESS_KEY_ID?: string;
+      E2E_ALIBABACLOUD_ACCESS_KEY_SECRET?: string;
+      E2E_ALIBABACLOUD_ROLE_ARN?: string;
+
+      // E2E Google Workspace
+      E2E_GOOGLEWORKSPACE_CUSTOMER_ID?: string;
+      E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON?: string;
+      E2E_GOOGLEWORKSPACE_DELEGATED_USER?: string;
+
+      // E2E Okta
+      E2E_OKTA_DOMAIN?: string;
+      E2E_OKTA_CLIENT_ID?: string;
+      E2E_OKTA_BASE64_PRIVATE_KEY?: string;
+
+      // E2E Vercel
+      E2E_VERCEL_TEAM_ID?: string;
+      E2E_VERCEL_API_TOKEN?: string;
+    }
+  }
+}
+
+export {};
diff --git a/ui/types/index.ts b/ui/types/index.ts
index 69eb4032ac..7f7a035b47 100644
--- a/ui/types/index.ts
+++ b/ui/types/index.ts
@@ -10,5 +10,6 @@ export * from "./providers";
 export * from "./providers-table";
 export * from "./resources";
 export * from "./scans";
+export * from "./schedules";
 export * from "./tasks";
 export * from "./tree";
diff --git a/ui/types/providers-table.ts b/ui/types/providers-table.ts
index 553355b75b..21bfb1ab8c 100644
--- a/ui/types/providers-table.ts
+++ b/ui/types/providers-table.ts
@@ -5,6 +5,7 @@ import {
   OrganizationUnitResource,
 } from "./organizations";
 import { ProviderProps } from "./providers";
+import { ScanScheduleSummary } from "./scans";
 
 export const PROVIDERS_ROW_TYPE = {
   ORGANIZATION: "organization",
@@ -52,6 +53,8 @@ export interface ProvidersProviderRow
   relationships: ProviderTableRelationships;
   groupNames: string[];
   hasSchedule: boolean;
+  /** Cadence/next-run summary when the provider has a configured schedule. */
+  scheduleSummary?: ScanScheduleSummary;
   subRows?: ProvidersTableRow[];
 }
 
diff --git a/ui/types/scans.ts b/ui/types/scans.ts
index 1ebb40c408..14b1c45a41 100644
--- a/ui/types/scans.ts
+++ b/ui/types/scans.ts
@@ -83,12 +83,25 @@ export interface ScanProviderInfo {
   connected: boolean;
 }
 
+/** Cadence summary computed from `/schedules`, e.g. "Weekly on Monday @ 9:00am". */
+export interface ScanScheduleSummary {
+  summary: string;
+  /** e.g. "Weekly on Monday" */
+  cadence?: string;
+  nextScanAt?: string | null;
+  lastScanAt?: string | null;
+}
+
 export interface ScanProps {
   type: "scans";
   id: string;
   attributes: ScanAttributes;
   relationships: ScanRelationships;
   providerInfo?: ScanResultProviderInfo;
+  /** Only on synthetic Scheduled-tab rows for schedules that have not fired yet. */
+  pendingSchedule?: ScanScheduleSummary;
+  /** Current schedule cadence of the scan's provider, when configured. */
+  providerSchedule?: ScanScheduleSummary;
 }
 
 export interface ScanEntityProviderInfo {
diff --git a/ui/types/schedules.ts b/ui/types/schedules.ts
new file mode 100644
index 0000000000..5ac820eaca
--- /dev/null
+++ b/ui/types/schedules.ts
@@ -0,0 +1,97 @@
+import type { ProviderProps } from "./providers";
+
+export const SCHEDULE_FREQUENCY = {
+  DAILY: "DAILY",
+  INTERVAL: "INTERVAL",
+  WEEKLY: "WEEKLY",
+  MONTHLY: "MONTHLY",
+} as const;
+
+export type ScheduleFrequency =
+  (typeof SCHEDULE_FREQUENCY)[keyof typeof SCHEDULE_FREQUENCY];
+
+/** Weekday names indexed by cron convention (0=Sunday). */
+export const SCHEDULE_WEEKDAY_LABELS = [
+  "Sunday",
+  "Monday",
+  "Tuesday",
+  "Wednesday",
+  "Thursday",
+  "Friday",
+  "Saturday",
+] as const;
+
+/**
+ * Scan-schedule capability modes. In Prowler OSS this is resolved purely from
+ * the runtime environment (Cloud vs non-Cloud); the prowler-cloud overlay
+ * computes a billing-aware capability and injects it via the `capability` prop.
+ *
+ * - `ADVANCED`: full scheduling through the new `/schedules/{providerId}` API
+ *   (Prowler Cloud, subscribed/paid).
+ * - `DAILY_LEGACY`: Prowler OSS / non-Cloud. Only the legacy `Daily` schedule
+ *   (`/schedules/daily`) plus optional on-demand scans are allowed.
+ * - `MANUAL_ONLY`: Prowler Cloud trial/onboarding. No schedules at all, only a
+ *   manual on-demand scan subject to the account quota.
+ */
+export const SCAN_SCHEDULE_CAPABILITY = {
+  ADVANCED: "ADVANCED",
+  DAILY_LEGACY: "DAILY_LEGACY",
+  MANUAL_ONLY: "MANUAL_ONLY",
+} as const;
+
+export type ScanScheduleCapability =
+  (typeof SCAN_SCHEDULE_CAPABILITY)[keyof typeof SCAN_SCHEDULE_CAPABILITY];
+
+export interface ScheduleAttributes {
+  scan_enabled: boolean;
+  scan_frequency: ScheduleFrequency;
+  scan_hour: number | null;
+  scan_timezone: string;
+  scan_interval_hours: number | null;
+  scan_day_of_week: number | null;
+  scan_day_of_month: number | null;
+  /** Read-only, server-computed next fire time; null when paused/unconfigured. */
+  next_scan_at?: string | null;
+  /** Read-only, completed_at of the provider's last completed scan. */
+  last_scan_at?: string | null;
+}
+
+export interface ScheduleRelationships {
+  provider: {
+    data: {
+      type: "providers";
+      id: string;
+    };
+  };
+}
+
+export interface ScheduleProps {
+  type: "schedules";
+  id: string;
+  attributes: ScheduleAttributes;
+  relationships: ScheduleRelationships;
+}
+
+export interface ScheduleApiResponse {
+  data: ScheduleProps;
+  included?: ProviderProps[];
+}
+
+export interface ScheduleUpdatePayload {
+  scan_enabled: boolean;
+  scan_frequency: ScheduleFrequency;
+  scan_hour: number;
+  scan_timezone: string;
+  scan_interval_hours: number | null;
+  scan_day_of_week: number | null;
+  scan_day_of_month: number | null;
+}
+
+export interface ScheduleFormValues {
+  frequency: ScheduleFrequency;
+  hour: number;
+  dayOfWeek: number;
+  dayOfMonth: number;
+  intervalHours: number;
+  launchInitialScan: boolean;
+}
diff --git a/ui/vitest.config.ts b/ui/vitest.config.ts
index bb976e11b1..89d17ba692 100644
--- a/ui/vitest.config.ts
+++ b/ui/vitest.config.ts
@@ -5,8 +5,7 @@ import type { TestProjectConfiguration } from "vitest/config";
 import { defineConfig } from "vitest/config";
 
 export default defineConfig(() => {
-  const apiBaseUrl =
-    process.env.NEXT_PUBLIC_API_BASE_URL ?? "http://localhost/api/v1";
+  const apiBaseUrl = process.env.UI_API_BASE_URL ?? "http://localhost/api/v1";
 
   return {
     plugins: [react()],
@@ -75,7 +74,7 @@ export default defineConfig(() => {
       ] as TestProjectConfiguration[],
     },
     define: {
-      "process.env.NEXT_PUBLIC_API_BASE_URL": JSON.stringify(apiBaseUrl),
+      "process.env.UI_API_BASE_URL": JSON.stringify(apiBaseUrl),
       // `next/dist/server/web/spec-extension/user-agent.js` references
       // `__dirname` directly and is pulled in transitively via `next-auth`.
       // Vite serves it to the browser where that global doesn't exist, so we
diff --git a/util/prowler-bulk-provisioning/nuke_providers.py b/util/prowler-bulk-provisioning/nuke_providers.py
index 9759ac4626..8ddaa89f7b 100755
--- a/util/prowler-bulk-provisioning/nuke_providers.py
+++ b/util/prowler-bulk-provisioning/nuke_providers.py
@@ -414,8 +414,7 @@ def main():
     # Summary with nuclear explosion art if successful
     if successes > 0 and failures == 0:
         # Nuclear explosion ASCII art
-        print(
-            r"""
+        print(r"""
                 _.-^^---....,,--
             _--                  --_
             <                        >)
@@ -427,8 +426,7 @@ def main():
                 `-=#$%&%$#=-'
                     | ;  :|
             _____.,-#%&$@%#&#~,._____
-        """
-        )
+        """)
         print(f"\n{'=' * 60}")
         print("💥 NUCLEAR DELETION COMPLETE 💥")
         print(f"{'=' * 60}")
diff --git a/uv.lock b/uv.lock
index d385009f63..b221255e33 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,8 +1,9 @@
 version = 1
 revision = 3
-requires-python = ">=3.10, <3.13"
+requires-python = ">=3.10, <3.14"
 resolution-markers = [
-    "python_full_version >= '3.12'",
+    "python_full_version >= '3.13'",
+    "python_full_version == '3.12.*'",
     "python_full_version == '3.11.*'",
     "python_full_version < '3.11'",
 ]
@@ -13,7 +14,7 @@ constraints = [
     { name = "aenum", specifier = "==3.1.17" },
     { name = "aiofiles", specifier = "==24.1.0" },
     { name = "aiohappyeyeballs", specifier = "==2.6.1" },
-    { name = "aiohttp", specifier = "==3.13.5" },
+    { name = "aiohttp", specifier = "==3.14.0" },
     { name = "aiosignal", specifier = "==1.4.0" },
     { name = "alibabacloud-actiontrail20200706", specifier = "==2.4.1" },
     { name = "alibabacloud-credentials", specifier = "==1.0.3" },
@@ -56,7 +57,7 @@ constraints = [
     { name = "azure-core", specifier = "==1.41.0" },
     { name = "azure-mgmt-core", specifier = "==1.6.0" },
     { name = "bandit", specifier = "==1.8.3" },
-    { name = "black", specifier = "==25.1.0" },
+    { name = "black", specifier = "==26.3.1" },
     { name = "blinker", specifier = "==1.9.0" },
     { name = "certifi", specifier = "==2026.4.22" },
     { name = "cffi", specifier = "==2.0.0" },
@@ -118,12 +119,12 @@ constraints = [
     { name = "markupsafe", specifier = "==3.0.3" },
     { name = "mccabe", specifier = "==0.7.0" },
     { name = "mdurl", specifier = "==0.1.2" },
-    { name = "microsoft-kiota-authentication-azure", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-http", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-serialization-form", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-serialization-json", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-serialization-text", specifier = "==1.9.2" },
+    { name = "microsoft-kiota-authentication-azure", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-http", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-form", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-json", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-text", specifier = "==1.9.9" },
     { name = "mock", specifier = "==5.2.0" },
     { name = "moto", specifier = "==5.1.11" },
     { name = "mpmath", specifier = "==1.3.0" },
@@ -166,16 +167,17 @@ constraints = [
     { name = "pydash", specifier = "==8.0.6" },
     { name = "pyflakes", specifier = "==3.2.0" },
     { name = "pygments", specifier = "==2.20.0" },
-    { name = "pyjwt", specifier = "==2.12.1" },
+    { name = "pyjwt", specifier = "==2.13.0" },
     { name = "pylint", specifier = "==3.3.4" },
     { name = "pynacl", specifier = "==1.6.2" },
     { name = "pyopenssl", specifier = "==26.2.0" },
     { name = "pyparsing", specifier = "==3.3.2" },
-    { name = "pytest", specifier = "==8.3.5" },
+    { name = "pytest", specifier = "==9.0.3" },
     { name = "pytest-cov", specifier = "==6.0.0" },
     { name = "pytest-env", specifier = "==1.1.5" },
     { name = "pytest-randomly", specifier = "==3.16.0" },
     { name = "pytest-xdist", specifier = "==3.6.1" },
+    { name = "pytokens", specifier = "==0.4.1" },
     { name = "pywin32", specifier = "==311" },
     { name = "pyyaml", specifier = "==6.0.3" },
     { name = "referencing", specifier = "==0.36.2" },
@@ -254,7 +256,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.13.5"
+version = "3.14.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -264,61 +266,88 @@ dependencies = [
     { name = "frozenlist" },
     { name = "multidict" },
     { name = "propcache" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/77/9a/152096d4808df8e4268befa55fba462f440f14beab85e8ad9bf990516918/aiohttp-3.13.5.tar.gz", hash = "sha256:9d98cc980ecc96be6eb4c1994ce35d28d8b1f5e5208a23b421187d1209dbb7d1", size = 7858271, upload-time = "2026-03-31T22:01:03.343Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/ab/93ce242f899b68c51b0578c027aafa791ab3614cb9345fa5d37b5f5c8e3e/aiohttp-3.14.0.tar.gz", hash = "sha256:2882de819734c715fd1b9c11c97e09fa020d14438203d1d354d8ed1702791c9b", size = 7940674, upload-time = "2026-06-01T19:41:02.763Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bd/85/cebc47ee74d8b408749073a1a46c6fcba13d170dc8af7e61996c6c9394ac/aiohttp-3.13.5-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:02222e7e233295f40e011c1b00e3b0bd451f22cf853a0304c3595633ee47da4b", size = 750547, upload-time = "2026-03-31T21:56:30.024Z" },
-    { url = "https://files.pythonhosted.org/packages/05/98/afd308e35b9d3d8c9ec54c0918f1d722c86dc17ddfec272fcdbcce5a3124/aiohttp-3.13.5-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:bace460460ed20614fa6bc8cb09966c0b8517b8c58ad8046828c6078d25333b5", size = 503535, upload-time = "2026-03-31T21:56:31.935Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/4d/926c183e06b09d5270a309eb50fbde7b09782bfd305dec1e800f329834fb/aiohttp-3.13.5-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f546a4dc1e6a5edbb9fd1fd6ad18134550e096a5a43f4ad74acfbd834fc6670", size = 497830, upload-time = "2026-03-31T21:56:33.654Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/d6/f47d1c690f115a5c2a5e8938cce4a232a5be9aac5c5fb2647efcbbbda333/aiohttp-3.13.5-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c86969d012e51b8e415a8c6ce96f7857d6a87d6207303ab02d5d11ef0cad2274", size = 1682474, upload-time = "2026-03-31T21:56:35.513Z" },
-    { url = "https://files.pythonhosted.org/packages/01/44/056fd37b1bb52eac760303e5196acc74d9d546631b035704ae5927f7b4ac/aiohttp-3.13.5-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b6f6cd1560c5fa427e3b6074bb24d2c64e225afbb7165008903bd42e4e33e28a", size = 1655259, upload-time = "2026-03-31T21:56:37.843Z" },
-    { url = "https://files.pythonhosted.org/packages/91/9f/78eb1a20c1c28ae02f6a3c0f4d7b0dcc66abce5290cadd53d78ce3084175/aiohttp-3.13.5-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:636bc362f0c5bbc7372bc3ae49737f9e3030dbce469f0f422c8f38079780363d", size = 1736204, upload-time = "2026-03-31T21:56:39.822Z" },
-    { url = "https://files.pythonhosted.org/packages/de/6c/d20d7de23f0b52b8c1d9e2033b2db1ac4dacbb470bb74c56de0f5f86bb4f/aiohttp-3.13.5-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6a7cbeb06d1070f1d14895eeeed4dac5913b22d7b456f2eb969f11f4b3993796", size = 1826198, upload-time = "2026-03-31T21:56:41.378Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/86/a6f3ff1fd795f49545a7c74b2c92f62729135d73e7e4055bf74da5a26c82/aiohttp-3.13.5-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bca9ef7517fd7874a1a08970ae88f497bf5c984610caa0bf40bd7e8450852b95", size = 1681329, upload-time = "2026-03-31T21:56:43.374Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/68/84cd3dab6b7b4f3e6fe9459a961acb142aaab846417f6e8905110d7027e5/aiohttp-3.13.5-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:019a67772e034a0e6b9b17c13d0a8fe56ad9fb150fc724b7f3ffd3724288d9e5", size = 1560023, upload-time = "2026-03-31T21:56:45.031Z" },
-    { url = "https://files.pythonhosted.org/packages/41/2c/db61b64b0249e30f954a65ab4cb4970ced57544b1de2e3c98ee5dc24165f/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:f34ecee82858e41dd217734f0c41a532bd066bcaab636ad830f03a30b2a96f2a", size = 1652372, upload-time = "2026-03-31T21:56:47.075Z" },
-    { url = "https://files.pythonhosted.org/packages/25/6f/e96988a6c982d047810c772e28c43c64c300c943b0ed5c1c0c4ce1e1027c/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:4eac02d9af4813ee289cd63a361576da36dba57f5a1ab36377bc2600db0cbb73", size = 1662031, upload-time = "2026-03-31T21:56:48.835Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/26/a56feace81f3d347b4052403a9d03754a0ab23f7940780dada0849a38c92/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:4beac52e9fe46d6abf98b0176a88154b742e878fdf209d2248e99fcdf73cd297", size = 1708118, upload-time = "2026-03-31T21:56:50.833Z" },
-    { url = "https://files.pythonhosted.org/packages/78/6e/b6173a8ff03d01d5e1a694bc06764b5dad1df2d4ed8f0ceec12bb3277936/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:c180f480207a9b2475f2b8d8bd7204e47aec952d084b2a2be58a782ffcf96074", size = 1548667, upload-time = "2026-03-31T21:56:52.81Z" },
-    { url = "https://files.pythonhosted.org/packages/16/13/13296ffe2c132d888b3fe2c195c8b9c0c24c89c3fa5cc2c44464dc23b22e/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:2837fb92951564d6339cedae4a7231692aa9f73cbc4fb2e04263b96844e03b4e", size = 1724490, upload-time = "2026-03-31T21:56:54.541Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/b4/1f1c287f4a79782ef36e5a6e62954c85343bc30470d862d30bd5f26c9fa2/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:d9010032a0b9710f58012a1e9c222528763d860ba2ee1422c03473eab47703e7", size = 1667109, upload-time = "2026-03-31T21:56:56.21Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/42/8461a2aaf60a8f4ea4549a4056be36b904b0eb03d97ca9a8a2604681a500/aiohttp-3.13.5-cp310-cp310-win32.whl", hash = "sha256:7c4b6668b2b2b9027f209ddf647f2a4407784b5d88b8be4efcc72036f365baf9", size = 439478, upload-time = "2026-03-31T21:56:58.292Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/71/06956304cb5ee439dfe8d86e1b2e70088bd88ed1ced1f42fb29e5d855f0e/aiohttp-3.13.5-cp310-cp310-win_amd64.whl", hash = "sha256:cd3db5927bf9167d5a6157ddb2f036f6b6b0ad001ac82355d43e97a4bde76d76", size = 462047, upload-time = "2026-03-31T21:57:00.257Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/f5/a20c4ac64aeaef1679e25c9983573618ff765d7aa829fa2b84ae7573169e/aiohttp-3.13.5-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7ab7229b6f9b5c1ba4910d6c41a9eb11f543eadb3f384df1b4c293f4e73d44d6", size = 757513, upload-time = "2026-03-31T21:57:02.146Z" },
-    { url = "https://files.pythonhosted.org/packages/75/0a/39fa6c6b179b53fcb3e4b3d2b6d6cad0180854eda17060c7218540102bef/aiohttp-3.13.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:8f14c50708bb156b3a3ca7230b3d820199d56a48e3af76fa21c2d6087190fe3d", size = 506748, upload-time = "2026-03-31T21:57:04.275Z" },
-    { url = "https://files.pythonhosted.org/packages/87/ec/e38ce072e724fd7add6243613f8d1810da084f54175353d25ccf9f9c7e5a/aiohttp-3.13.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e7d2f8616f0ff60bd332022279011776c3ac0faa0f1b463f7bb12326fbc97a1c", size = 501673, upload-time = "2026-03-31T21:57:06.208Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/ba/3bc7525d7e2beaa11b309a70d48b0d3cfc3c2089ec6a7d0820d59c657053/aiohttp-3.13.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a2567b72e1ffc3ab25510db43f355b29eeada56c0a622e58dcdb19530eb0a3cb", size = 1763757, upload-time = "2026-03-31T21:57:07.882Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/ab/e87744cf18f1bd78263aba24924d4953b41086bd3a31d22452378e9028a0/aiohttp-3.13.5-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:fb0540c854ac9c0c5ad495908fdfd3e332d553ec731698c0e29b1877ba0d2ec6", size = 1720152, upload-time = "2026-03-31T21:57:09.946Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/f3/ed17a6f2d742af17b50bae2d152315ed1b164b07a5fd5cc1754d99e4dfa5/aiohttp-3.13.5-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c9883051c6972f58bfc4ebb2116345ee2aa151178e99c3f2b2bbe2af712abd13", size = 1818010, upload-time = "2026-03-31T21:57:12.157Z" },
-    { url = "https://files.pythonhosted.org/packages/53/06/ecbc63dc937192e2a5cb46df4d3edb21deb8225535818802f210a6ea5816/aiohttp-3.13.5-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2294172ce08a82fb7c7273485895de1fa1186cc8294cfeb6aef4af42ad261174", size = 1907251, upload-time = "2026-03-31T21:57:14.023Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/a5/0521aa32c1ddf3aa1e71dcc466be0b7db2771907a13f18cddaa45967d97b/aiohttp-3.13.5-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3a807cabd5115fb55af198b98178997a5e0e57dead43eb74a93d9c07d6d4a7dc", size = 1759969, upload-time = "2026-03-31T21:57:16.146Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/78/a38f8c9105199dd3b9706745865a8a59d0041b6be0ca0cc4b2ccf1bab374/aiohttp-3.13.5-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:aa6d0d932e0f39c02b80744273cd5c388a2d9bc07760a03164f229c8e02662f6", size = 1616871, upload-time = "2026-03-31T21:57:17.856Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/41/27392a61ead8ab38072105c71aa44ff891e71653fe53d576a7067da2b4e8/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:60869c7ac4aaabe7110f26499f3e6e5696eae98144735b12a9c3d9eae2b51a49", size = 1739844, upload-time = "2026-03-31T21:57:19.679Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/55/5564e7ae26d94f3214250009a0b1c65a0c6af4bf88924ccb6fdab901de28/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:26d2f8546f1dfa75efa50c3488215a903c0168d253b75fba4210f57ab77a0fb8", size = 1731969, upload-time = "2026-03-31T21:57:22.006Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/c5/705a3929149865fc941bcbdd1047b238e4a72bcb215a9b16b9d7a2e8d992/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:f1162a1492032c82f14271e831c8f4b49f2b6078f4f5fc74de2c912fa225d51d", size = 1795193, upload-time = "2026-03-31T21:57:24.256Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/19/edabed62f718d02cff7231ca0db4ef1c72504235bc467f7b67adb1679f48/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:8b14eb3262fad0dc2f89c1a43b13727e709504972186ff6a99a3ecaa77102b6c", size = 1606477, upload-time = "2026-03-31T21:57:26.364Z" },
-    { url = "https://files.pythonhosted.org/packages/de/fc/76f80ef008675637d88d0b21584596dc27410a990b0918cb1e5776545b5b/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:ca9ac61ac6db4eb6c2a0cd1d0f7e1357647b638ccc92f7e9d8d133e71ed3c6ac", size = 1813198, upload-time = "2026-03-31T21:57:28.316Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/67/5b3ac26b80adb20ea541c487f73730dc8fa107d632c998f25bbbab98fcda/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:7996023b2ed59489ae4762256c8516df9820f751cf2c5da8ed2fb20ee50abab3", size = 1752321, upload-time = "2026-03-31T21:57:30.549Z" },
-    { url = "https://files.pythonhosted.org/packages/88/06/e4a2e49255ea23fa4feeb5ab092d90240d927c15e47b5b5c48dff5a9ce29/aiohttp-3.13.5-cp311-cp311-win32.whl", hash = "sha256:77dfa48c9f8013271011e51c00f8ada19851f013cde2c48fca1ba5e0caf5bb06", size = 439069, upload-time = "2026-03-31T21:57:32.388Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/43/8c7163a596dab4f8be12c190cf467a1e07e4734cf90eebb39f7f5d53fc6a/aiohttp-3.13.5-cp311-cp311-win_amd64.whl", hash = "sha256:d3a4834f221061624b8887090637db9ad4f61752001eae37d56c52fddade2dc8", size = 462859, upload-time = "2026-03-31T21:57:34.455Z" },
-    { url = "https://files.pythonhosted.org/packages/be/6f/353954c29e7dcce7cf00280a02c75f30e133c00793c7a2ed3776d7b2f426/aiohttp-3.13.5-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:023ecba036ddd840b0b19bf195bfae970083fd7024ce1ac22e9bba90464620e9", size = 748876, upload-time = "2026-03-31T21:57:36.319Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/1b/428a7c64687b3b2e9cd293186695affc0e1e54a445d0361743b231f11066/aiohttp-3.13.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:15c933ad7920b7d9a20de151efcd05a6e38302cbf0e10c9b2acb9a42210a2416", size = 499557, upload-time = "2026-03-31T21:57:38.236Z" },
-    { url = "https://files.pythonhosted.org/packages/29/47/7be41556bfbb6917069d6a6634bb7dd5e163ba445b783a90d40f5ac7e3a7/aiohttp-3.13.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ab2899f9fa2f9f741896ebb6fa07c4c883bfa5c7f2ddd8cf2aafa86fa981b2d2", size = 500258, upload-time = "2026-03-31T21:57:39.923Z" },
-    { url = "https://files.pythonhosted.org/packages/67/84/c9ecc5828cb0b3695856c07c0a6817a99d51e2473400f705275a2b3d9239/aiohttp-3.13.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a60eaa2d440cd4707696b52e40ed3e2b0f73f65be07fd0ef23b6b539c9c0b0b4", size = 1749199, upload-time = "2026-03-31T21:57:41.938Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/d3/3c6d610e66b495657622edb6ae7c7fd31b2e9086b4ec50b47897ad6042a9/aiohttp-3.13.5-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:55b3bdd3292283295774ab585160c4004f4f2f203946997f49aac032c84649e9", size = 1721013, upload-time = "2026-03-31T21:57:43.904Z" },
-    { url = "https://files.pythonhosted.org/packages/49/a0/24409c12217456df0bae7babe3b014e460b0b38a8e60753d6cb339f6556d/aiohttp-3.13.5-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c2b2355dc094e5f7d45a7bb262fe7207aa0460b37a0d87027dcf21b5d890e7d5", size = 1781501, upload-time = "2026-03-31T21:57:46.285Z" },
-    { url = "https://files.pythonhosted.org/packages/98/9d/b65ec649adc5bccc008b0957a9a9c691070aeac4e41cea18559fef49958b/aiohttp-3.13.5-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b38765950832f7d728297689ad78f5f2cf79ff82487131c4d26fe6ceecdc5f8e", size = 1878981, upload-time = "2026-03-31T21:57:48.734Z" },
-    { url = "https://files.pythonhosted.org/packages/57/d8/8d44036d7eb7b6a8ec4c5494ea0c8c8b94fbc0ed3991c1a7adf230df03bf/aiohttp-3.13.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b18f31b80d5a33661e08c89e202edabf1986e9b49c42b4504371daeaa11b47c1", size = 1767934, upload-time = "2026-03-31T21:57:51.171Z" },
-    { url = "https://files.pythonhosted.org/packages/31/04/d3f8211f273356f158e3464e9e45484d3fb8c4ce5eb2f6fe9405c3273983/aiohttp-3.13.5-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:33add2463dde55c4f2d9635c6ab33ce154e5ecf322bd26d09af95c5f81cfa286", size = 1566671, upload-time = "2026-03-31T21:57:53.326Z" },
-    { url = "https://files.pythonhosted.org/packages/41/db/073e4ebe00b78e2dfcacff734291651729a62953b48933d765dc513bf798/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:327cc432fdf1356fb4fbc6fe833ad4e9f6aacb71a8acaa5f1855e4b25910e4a9", size = 1705219, upload-time = "2026-03-31T21:57:55.385Z" },
-    { url = "https://files.pythonhosted.org/packages/48/45/7dfba71a2f9fd97b15c95c06819de7eb38113d2cdb6319669195a7d64270/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:7c35b0bf0b48a70b4cb4fc5d7bed9b932532728e124874355de1a0af8ec4bc88", size = 1743049, upload-time = "2026-03-31T21:57:57.341Z" },
-    { url = "https://files.pythonhosted.org/packages/18/71/901db0061e0f717d226386a7f471bb59b19566f2cae5f0d93874b017271f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:df23d57718f24badef8656c49743e11a89fd6f5358fa8a7b96e728fda2abf7d3", size = 1749557, upload-time = "2026-03-31T21:57:59.626Z" },
-    { url = "https://files.pythonhosted.org/packages/08/d5/41eebd16066e59cd43728fe74bce953d7402f2b4ddfdfef2c0e9f17ca274/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:02e048037a6501a5ec1f6fc9736135aec6eb8a004ce48838cb951c515f32c80b", size = 1558931, upload-time = "2026-03-31T21:58:01.972Z" },
-    { url = "https://files.pythonhosted.org/packages/30/e6/4a799798bf05740e66c3a1161079bda7a3dd8e22ca392481d7a7f9af82a6/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:31cebae8b26f8a615d2b546fee45d5ffb76852ae6450e2a03f42c9102260d6fe", size = 1774125, upload-time = "2026-03-31T21:58:04.007Z" },
-    { url = "https://files.pythonhosted.org/packages/84/63/7749337c90f92bc2cb18f9560d67aa6258c7060d1397d21529b8004fcf6f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:888e78eb5ca55a615d285c3c09a7a91b42e9dd6fc699b166ebd5dee87c9ccf14", size = 1732427, upload-time = "2026-03-31T21:58:06.337Z" },
-    { url = "https://files.pythonhosted.org/packages/98/de/cf2f44ff98d307e72fb97d5f5bbae3bfcb442f0ea9790c0bf5c5c2331404/aiohttp-3.13.5-cp312-cp312-win32.whl", hash = "sha256:8bd3ec6376e68a41f9f95f5ed170e2fcf22d4eb27a1f8cb361d0508f6e0557f3", size = 433534, upload-time = "2026-03-31T21:58:08.712Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/ca/eadf6f9c8fa5e31d40993e3db153fb5ed0b11008ad5d9de98a95045bed84/aiohttp-3.13.5-cp312-cp312-win_amd64.whl", hash = "sha256:110e448e02c729bcebb18c60b9214a87ba33bac4a9fa5e9a5f139938b56c6cb1", size = 460446, upload-time = "2026-03-31T21:58:10.945Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/f0/f81190ba488cd106c2fc6d92680e56bb223bbbbf1e6908c2617011290112/aiohttp-3.14.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:692e409052e7436029bbb32977cd7c5bf806ac5fa4085b973996785ffadad33c", size = 760606, upload-time = "2026-06-01T19:36:39.054Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/54/444d37eebf0f15db661ca44ec7caf93962f3c5ca92eb4c9a5d888b70aaa2/aiohttp-3.14.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:40af7ebe53c7990e110dc4ad03566b12c3ac996254298a3d39046dd69cfcb2c2", size = 514677, upload-time = "2026-06-01T19:36:42.408Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/d1/da280e23321c132c0a3fa7c8cc2830621d79174edc64c829443346489a36/aiohttp-3.14.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:02cb2ffbb7da32f82e21ad9952669c45bd88a80e0878264c2f59fe1c6fb2badd", size = 510155, upload-time = "2026-06-01T19:36:44.072Z" },
+    { url = "https://files.pythonhosted.org/packages/09/b8/2e36d54d0991ec5bba451444004591ee0af58cb1662a3a81c562878b9c1f/aiohttp-3.14.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2e2514cb7195f6d7c219339635bea71ae47d1569b051300d32df9dcfabcdb869", size = 1699947, upload-time = "2026-06-01T19:36:45.762Z" },
+    { url = "https://files.pythonhosted.org/packages/57/95/a31d8ea1a0b9ecc084f5a7dd0b431ce64ef585918bb7bdc82afe11843877/aiohttp-3.14.0-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:30e8b7eeb42d02c120ca90d6c6e076a221a16b70a6dac9ae44c7ab5104cc7fe4", size = 1664364, upload-time = "2026-06-01T19:36:47.653Z" },
+    { url = "https://files.pythonhosted.org/packages/01/f6/5de3ddffc87a9e8d09b3be38fbd6dd1a736b2ad477a7e787dcb85f57f338/aiohttp-3.14.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:63e38be0d75a654deaa06be32fb4cab883a4222940be1d05861b6717679cbadb", size = 1761186, upload-time = "2026-06-01T19:36:49.355Z" },
+    { url = "https://files.pythonhosted.org/packages/33/8c/03c5438ec35d7e3a4f33fe895d6c3ec7540a7cec46065f21851211e1ee4d/aiohttp-3.14.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1210d4c87cc00128160c7384ab41877a701295b97cffa6362f908a49b6e8a7ca", size = 1849727, upload-time = "2026-06-01T19:36:51.478Z" },
+    { url = "https://files.pythonhosted.org/packages/22/32/5a05303b0874458920b73f48b8779cc3a93d503f121b38dcc0456dbd698c/aiohttp-3.14.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1a78a77366ed158a0a54b076990e575d7b7cdb728cbfd02711eadab150f2269f", size = 1708197, upload-time = "2026-06-01T19:36:53.241Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/62/478f169488d61414c0a05e7fe423b59ae3d9dcc933d1f0e4acc2c5d5bc3e/aiohttp-3.14.0-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f4d2038c64f36df96cfd3fa0937910e231eafbf897e70a06c155a817bb632fa6", size = 1578147, upload-time = "2026-06-01T19:36:55.154Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/af/b20af85765658972d3337834bd5eebba91b962794f2b4fc3e0ee8c85c0e1/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:4714c70067a08b604d0bf3bc4dfdf82e52944afab41d0428d460862763d2f79b", size = 1665836, upload-time = "2026-06-01T19:36:56.94Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/a3/771879cfd59948f4544b172189048905feff802f20f1c6c5411e998a3e06/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:f79bfd2847513a7ac801bbafd1de02348a37926ac439eeb4bfe96fcff4eada15", size = 1680335, upload-time = "2026-06-01T19:36:58.642Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/16/582e36ad1d32133cd40659f3bc98e71c22179665a1cfbbb4713bce339c06/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:25e9f1d2465a210d60edb64d7b204a147e85d4c194eecef3d1604fb5ace678ce", size = 1731180, upload-time = "2026-06-01T19:37:00.583Z" },
+    { url = "https://files.pythonhosted.org/packages/11/bc/80708fe3f64a07a2c306a42fc7b009118a952709761d215f6d1b4c57195b/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:b5314743ebe926c2fda35d0a298c565c885505f6635c2a30936363404cf274a7", size = 1565805, upload-time = "2026-06-01T19:37:02.446Z" },
+    { url = "https://files.pythonhosted.org/packages/57/8f/8d25897f8273a32fe4ad40a8885eec4f397377ed46e8e383078169f60316/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:28eee8de1d69711c53116df8202f1c2aa0e3f80ef912a88fc18d159d53e7110b", size = 1742496, upload-time = "2026-06-01T19:37:04.222Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/7d/c341d32ab2dec56c8478740695743dc6c21b383cace9376a3eab16311a07/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:89ed35666c95d3efe1955056afcde09e62a57a34e2a4398b17f9f6c1564f0b25", size = 1691240, upload-time = "2026-06-01T19:37:06.277Z" },
+    { url = "https://files.pythonhosted.org/packages/37/0f/a81207dd7a2d4a4f645b3a3f8b5a1da1159dc63117ffb137b698fd6df50f/aiohttp-3.14.0-cp310-cp310-win32.whl", hash = "sha256:5e4646e9a6af29af354204011bf5769cb0276ec5b64653e42f90b3e13845169f", size = 454686, upload-time = "2026-06-01T19:37:07.96Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/ae/842357f2afb9c915715c6f5775239d987f5d0f845abf7675fa794e0a9d40/aiohttp-3.14.0-cp310-cp310-win_amd64.whl", hash = "sha256:22a8d06f204e0518a586d770032db3c7043c9ba3693081b3e3ad425e1458d594", size = 478677, upload-time = "2026-06-01T19:37:09.652Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/d1/330fb22c9535ec177b52396905131c6e39447244b6ca876262939af668ef/aiohttp-3.14.0-cp310-cp310-win_arm64.whl", hash = "sha256:4acfc34bd4d3c58754fc9f22ff1b5e92aabce68f3d4bf7b71a0b732d9bceb78a", size = 450364, upload-time = "2026-06-01T19:37:11.279Z" },
+    { url = "https://files.pythonhosted.org/packages/67/47/7727bfe8db93f8835a001bd4359d8480cc68d1259b8bce334668f8be97bd/aiohttp-3.14.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:54bf3522d6f7351e55f89a62d5c2bf138ad557b031670266c5df604ae88e0b5a", size = 759147, upload-time = "2026-06-01T19:37:12.918Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/f2/cd3fedff6fade73d71df9ec908c210cec518ef90fd00289250684b90aecf/aiohttp-3.14.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0746d9fb0ac4fdef643a84494efe3f06d50335dd8c7a530228b86448aae0a803", size = 513705, upload-time = "2026-06-01T19:37:14.633Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/fe/49746b6b610144a06323bebd8e1211a390310d8c69b98dd6d52df341bc3e/aiohttp-3.14.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:9f3a96b6d39a4872222beee72e1df41d2ff886ae96152cf3e757ef8c5673ef0e", size = 509627, upload-time = "2026-06-01T19:37:16.385Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/3f/28f2f6cf3d5c0e7b01b27140d0e7873fd11fb341169ad3ce78ad04aba628/aiohttp-3.14.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d336820adbb914debbc90a1d8c1bfc4bea55996aecf64866a989d35d1f9fd903", size = 1769293, upload-time = "2026-06-01T19:37:18.067Z" },
+    { url = "https://files.pythonhosted.org/packages/97/6f/2e5f1b525d5474b12b3c60abf733a755845f3bceff21542081ada515f837/aiohttp-3.14.0-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:71b2604c9bfc1b115547d63a094d5244b3f02799833513a99a68aaa7b167c4cb", size = 1732363, upload-time = "2026-06-01T19:37:20.138Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/ce/596120faa85ca7b19cd061e3f2f3be23aa8f11a0aedf9191db9e0da1bd76/aiohttp-3.14.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:610d68800435903e303ca0542b9d3e4eb72a12ff33a6d471a070c1d81eebd3c2", size = 1840375, upload-time = "2026-06-01T19:37:22.104Z" },
+    { url = "https://files.pythonhosted.org/packages/72/3c/a7ffe05a757a4a7867643da69357ec41f506879fbd1b231d2ed90af246b2/aiohttp-3.14.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:514db9a79337068981ee2137310283a07b4b885c584991097a91a4da419bcb81", size = 1921484, upload-time = "2026-06-01T19:37:24.068Z" },
+    { url = "https://files.pythonhosted.org/packages/93/fa/2c861170bbd4a491de93a69e081db1d971092569e0d593a98ef62c384dc1/aiohttp-3.14.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c452d17eeb95d563fc8b936f3050301dbd1d268126c4632d8b70ede9696202ee", size = 1774153, upload-time = "2026-06-01T19:37:26.256Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/da/1d2f5a165f47ec9b1f69d37b8b977fdc4d501aa72ffb7930db27bb9e49ea/aiohttp-3.14.0-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ed94a81506e3d1bdbad5108f497a58f2a2354aedb4ca314d5326f07d1fd1ac2d", size = 1632569, upload-time = "2026-06-01T19:37:28.192Z" },
+    { url = "https://files.pythonhosted.org/packages/46/1d/7a6e295c4257252f70f69e90864fdad74b6a1293054fb3f9e65a15de6d63/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1394dce36e0f0d260ac0b555a654de19cb989f3c1b8bdd24f505314dfea18a00", size = 1740325, upload-time = "2026-06-01T19:37:30.08Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/7e/e1899b1ca3ec62f1eab2a5cbde14039b97493f7f53eb88d9b668562ffa8d/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:d1467d1e7b48a73ca7237e0ee4335f3d02b923dbc27b82fd254bc301c97d4026", size = 1748691, upload-time = "2026-06-01T19:37:32.211Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/54/4e6b61c1fe7d3433f82bcc6bd7e4d7c683a742a10c9b12a025fd3695c047/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:6a5f3532125233c261cf61f32df4059cfcf482eb793c7d3db8452e3142028b86", size = 1814477, upload-time = "2026-06-01T19:37:34.173Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/38/86fd51be2e08d8e45c83d879d255f10391903cd9fe2a16512f7591a15873/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:3ea81eb518a2ecb319d8ec6d1424a37c773f6634bd87d6985eb606b2faac419f", size = 1623393, upload-time = "2026-06-01T19:37:36.281Z" },
+    { url = "https://files.pythonhosted.org/packages/78/49/466e947a42a88ee23c486d036e7e5d1b097f1bafd8084ad9c9a0a92f0f43/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:32e735c3182de7b64f6941a4ede48b38c7f47d9437bd615dd30b5bda8fa1bc93", size = 1824097, upload-time = "2026-06-01T19:37:38.421Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/89/35f3410bc284682338a1be6b6ea0c5abfa05f063942cfaa9256608440434/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:c21ca9a1c63d4509158f478aeb9d02914dcc52adc68d1bc9dee2452284ee5996", size = 1764790, upload-time = "2026-06-01T19:37:40.755Z" },
+    { url = "https://files.pythonhosted.org/packages/42/80/2d4291bd5724d3d17e5951aff5a3e02281483fb47295f0788276ee66cd73/aiohttp-3.14.0-cp311-cp311-win32.whl", hash = "sha256:19ca5fc84130675ba11c6ca5c7da5cb65f7bf8a32cdd2b616bf49cd334688aae", size = 454176, upload-time = "2026-06-01T19:37:42.837Z" },
+    { url = "https://files.pythonhosted.org/packages/59/ed/41d0ad4f6ececffc32bdf1f7b494e5498f7ca5c849ea2e3cc9bbd1668251/aiohttp-3.14.0-cp311-cp311-win_amd64.whl", hash = "sha256:d488e6e9d3bb8ba5ae7066d5be885ae9670eba021b8c6ccb9a3a568e6b19d6e5", size = 479334, upload-time = "2026-06-01T19:37:44.776Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/86/c0b5e305c770053f8c3d069bb52b8196917ba91949d1962d52eb307fb0d2/aiohttp-3.14.0-cp311-cp311-win_arm64.whl", hash = "sha256:8b93618102caf12801638a01a2b478a55410ddd71bd41cfaf6f707953a49ac43", size = 450262, upload-time = "2026-06-01T19:37:46.461Z" },
+    { url = "https://files.pythonhosted.org/packages/89/97/2b6889bfb6b6847520d50d95eb8c4307a45e28aaca39faf4a9454b3d1b2f/aiohttp-3.14.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:b29518c9c2ec7e373e68259206a137c7f4f5439c58baaec4b5ab3ab799850a4e", size = 750194, upload-time = "2026-06-01T19:37:48.164Z" },
+    { url = "https://files.pythonhosted.org/packages/21/e2/62634b7fff918ed98c3c6b2f0e70d520f7f28846cb412d451b04354c6459/aiohttp-3.14.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:dbec68ce61b64cb73cab4d33df9433427b1713c8bcccb181dce695c1b6f8e87c", size = 506966, upload-time = "2026-06-01T19:37:50.014Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/fb/5ce075150828c797a5106f1c2fb26034e709d4289b9d2bf8b07f1e59fac6/aiohttp-3.14.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:3cdf534aa455593e589302990c5097aa5c92c06c4262a20da22934f9186a5fff", size = 507527, upload-time = "2026-06-01T19:37:51.96Z" },
+    { url = "https://files.pythonhosted.org/packages/01/d5/405a0ae4e6b081754a3609c1c97c63a950e000a2def16046f1e736933a0e/aiohttp-3.14.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cb6c657104393b5fbff01a5f59b2023db74058a8077d94475d6c25d03882a108", size = 1762420, upload-time = "2026-06-01T19:37:53.839Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/1d/e05a7c896b15a6bc6fb8fc5319eb437861c2c49c34559ef928add6590315/aiohttp-3.14.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:46fbbec4e4fab7428d4396a3823f9320e4560aa3113b89eeebce712c27c9ed5a", size = 1733672, upload-time = "2026-06-01T19:37:55.791Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/22/a72f7c459e195fa41bf4f7abd1f925b91fe91f8097e51c654229ba144a33/aiohttp-3.14.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2c2c7e05dd5335b298085abf45ddf98673934c3ee1c083d0b9ea13d4186ad500", size = 1805064, upload-time = "2026-06-01T19:37:57.931Z" },
+    { url = "https://files.pythonhosted.org/packages/80/50/e85bdaba0be59ca4838005ebfef4048fcdd5f35a02b07057a9a123394440/aiohttp-3.14.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3c7139100fbaae76515b73051d8f0aa3a3ff02e415eec8a8eee8e2223d9ba955", size = 1902125, upload-time = "2026-06-01T19:38:00.225Z" },
+    { url = "https://files.pythonhosted.org/packages/19/d8/51de5c6b971c27bb1ef620293b8d1ca611ec78736b34b3f6ccf68e4c8785/aiohttp-3.14.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78d6f9286a629ce52728430afe18f8ed2b6c39a1fddb3802d7244b9983910ad2", size = 1783112, upload-time = "2026-06-01T19:38:02.641Z" },
+    { url = "https://files.pythonhosted.org/packages/73/ae/b4402bfde77e43dfb1b6ccff83c7b7ab63ed06b50c4754f0c5423fb374fe/aiohttp-3.14.0-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:cc3c3e12cdaeb92d7dcf13db00e9f6b1956b910e47256e696df1cfa946d02159", size = 1586356, upload-time = "2026-06-01T19:38:04.637Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/05/750a3265ca4dc54a460bd0cb1121a8f2ce9171fce4a135fb47ea7fd594d2/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4d6a998191f5ebe3b8c28463ff72bc030250008b3193c402464efadd08b5ca02", size = 1723119, upload-time = "2026-06-01T19:38:06.713Z" },
+    { url = "https://files.pythonhosted.org/packages/37/01/8c0812c50b3b1b1c37b323bf170d6be8847a8f234060485b7d1e71953f60/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:0fc2b75ae8d169d853be2862d960be8550da6c5c65711d5476407eb3fdb006bd", size = 1757216, upload-time = "2026-06-01T19:38:08.736Z" },
+    { url = "https://files.pythonhosted.org/packages/47/2a/50fb98028a26887cbe48dcc1df92a90825615bc73b5584301304090cded8/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:16eee56bcc72d04600bc56c1759982c2385ec0b41d3fd3521f836bf64a0957ef", size = 1770500, upload-time = "2026-06-01T19:38:11.111Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/32/0ffd598a2fa2b9a423daf242e700cfdabda35d6e602394ad9ae58972c1c7/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:5a2e7ca615c3ddc15b82687e05a624e5f5cba3f1d6c20cb81172d70ea498451e", size = 1576224, upload-time = "2026-06-01T19:38:13.391Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/f9/b9fc381dd9b66afb33f2634c40e229d106467be0afcabe79648631ab6712/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:f0b7b8bbbec3ce9467ee0ebe334622fd90624f593edd3136c567811453fc4fae", size = 1794252, upload-time = "2026-06-01T19:38:15.498Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/fb/05d9214c975f23225a8cd5c439325e338c7c377b315480ef3871db51f54e/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5ba10966d4f03dd96a14365be4b8e37c327c76f11c3ca867116966cdd9f98066", size = 1760193, upload-time = "2026-06-01T19:38:17.624Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/4b/02992fc4fb9e1b6673ee3f888a8e587a6447afda1f6f4aca776c148c2876/aiohttp-3.14.0-cp312-cp312-win32.whl", hash = "sha256:101df7779c80c0636014a6b2c6642acd3efb5b355d48347c9d7dfb720aee9430", size = 448650, upload-time = "2026-06-01T19:38:19.545Z" },
+    { url = "https://files.pythonhosted.org/packages/39/e9/246532214c3abda518477cbaaf16d420295ad8effa5233844cbb38f299ab/aiohttp-3.14.0-cp312-cp312-win_amd64.whl", hash = "sha256:b0a5747586d4467efd1f932710b269131c9717a872dce082cd92a00c1c13123a", size = 476145, upload-time = "2026-06-01T19:38:21.505Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c3/63f8c20090048915711598b0adf475b149216d736157961de06480a45b15/aiohttp-3.14.0-cp312-cp312-win_arm64.whl", hash = "sha256:5f1c5be60add78fabb4aacd13c5a348ae79d2fcbfc7fa78da8f1eb192273b370", size = 444250, upload-time = "2026-06-01T19:38:24.027Z" },
+    { url = "https://files.pythonhosted.org/packages/21/61/d11f7d9a3144bffe825247d6367cd93053666da50b94707c9129c78868d5/aiohttp-3.14.0-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:25400d710641a8040bf022a8a99f579e581ffa1c5bd42c33255d7d6f3957c127", size = 502399, upload-time = "2026-06-01T19:38:25.955Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/9b/a7e317625d36356844f8bb022cabd305b541f968856cc3c2e0b58e53ee6e/aiohttp-3.14.0-cp313-cp313-android_21_x86_64.whl", hash = "sha256:c5492b9929826e07cc3fcb9739ae87aab05dff6b5e67a9b73fd1700c6d008981", size = 510068, upload-time = "2026-06-01T19:38:27.828Z" },
+    { url = "https://files.pythonhosted.org/packages/11/41/cc2d2cfbfbdc3126ba258f3cd27d1ac8a33492ae3c35a4583ee21f0ba7f1/aiohttp-3.14.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:3366751d68d237c621264233a32f3078bbc21b7904ab90a77e03d21390c742c6", size = 481670, upload-time = "2026-06-01T19:38:29.836Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/07/381f4023c3b08cb616e520f566d8c58957abad54e56441d41fe67cfb0195/aiohttp-3.14.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:57ea07d28695a7a40304d42251892a8df765e5588c10ee32afeddcd5df33c0a2", size = 487591, upload-time = "2026-06-01T19:38:31.704Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/4d/4506fdb7a022bdf70011a3bbb4ca00c5c570026ef6a3c5bd7bc70c39089c/aiohttp-3.14.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:076cb014191ae2e65d949e1ad01f1dcfe33e32789b5172510f3e79c79fc04d50", size = 496503, upload-time = "2026-06-01T19:38:33.6Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/7d/c814111e04894a45d9e2defc94443879a6f118d9633d5fedfe6e2e8af5f0/aiohttp-3.14.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:2f3fc37054564dee64a855b5b092d87ec35dcddfaabf7dacb1c8a2b1f83dc0a9", size = 745870, upload-time = "2026-06-01T19:38:36.013Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/ee/80eee0efddfe187e7cd05027086b7ce1c0e492e82a4eda58f5c5543a44a0/aiohttp-3.14.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8fcaef74d2ab0f607d7ff85a0d15e21bb5a258c4a58df1908396eb50d7f4ed3c", size = 505588, upload-time = "2026-06-01T19:38:38.282Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/f8/0f28f04eef75d52fc9c715dde7ce9c0abb810fd20cfeb0fea7afd2ab1e98/aiohttp-3.14.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e4c01b0bfc6209590960e68eac083cd22d5d87c21f974dd6208cafa5d3542bc8", size = 504492, upload-time = "2026-06-01T19:38:40.611Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/db/44c755232085545065c94378dfce38641b1aee647f4939fcd32f5b32e719/aiohttp-3.14.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f12eb7896e81caf403a2b18c9406426f1207361e7239c057ab29c076d4257e83", size = 1752111, upload-time = "2026-06-01T19:38:42.682Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/6a/42e030a46743841414402a3b00cd3d78419055e86c66fb5822c14b5abfc6/aiohttp-3.14.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:6c79a044cacf360ec46738d863d2f41c9300d2a06ef4a7402ea0df306a350e61", size = 1729674, upload-time = "2026-06-01T19:38:44.79Z" },
+    { url = "https://files.pythonhosted.org/packages/34/26/3199beb415202e3108e7b83ecebe10914d806d33fb9860c3e4aa60a19be3/aiohttp-3.14.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:85e0675f47be4eff0636bf88c02140ea89168ae0df3ff1f3f464e9de9610d277", size = 1798808, upload-time = "2026-06-01T19:38:47.01Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/94/b9b6fcf0ee17c21d0d19fb8c22bf83ad18f82e702a9c3bd901a868f5e446/aiohttp-3.14.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:7b33e751cab03fdc960095b1e326cb5a03f5ee577d6ded59f3d1c100f8668882", size = 1891921, upload-time = "2026-06-01T19:38:49.233Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/a3/3800dbd095cb2bb165a7ea5d94d790914677e27f45638c7d80e3f34c8945/aiohttp-3.14.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:26d9224c6dd7f5c749aba4f61315a894601448b28d94d12f4dea0903e26d2096", size = 1777241, upload-time = "2026-06-01T19:38:52.04Z" },
+    { url = "https://files.pythonhosted.org/packages/21/2a/45be91ad1b860508557448d4cc2e165a2ee68dd865657b73bf66cc5a00fb/aiohttp-3.14.0-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:6281aecdf2732940f4fe06bd6adec5ae4d59b78b080b8e3a6b81467301010988", size = 1579554, upload-time = "2026-06-01T19:38:54.508Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/3d/dc94df99ed1511fdf28314f722643ed334112643cab00223577085e788c4/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:23e8314e7aed8576fbe33314d218bd81447a3adbc91dc36f1163bf583cd3084c", size = 1714864, upload-time = "2026-06-01T19:38:56.788Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/e4/1f1c8acbb3acd5c8f795473b92c9c3d44eb60a5692c6104256c8a1c83a0c/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:3b54fbff46127aeafdd764cecd0d99fa2f24a0e37ea5c18a7c3a4ac450df1db3", size = 1749803, upload-time = "2026-06-01T19:38:59.367Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/c8/c45ea6e7ed84cebba939b9c334498a045ba19d79c61b0110df5f21580de3/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:b27d89af91a555f58e08e4902dbcbc48862fd40095720ca705990476bd93b7ac", size = 1765023, upload-time = "2026-06-01T19:39:01.651Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/a1/a932941784432962fe390e1066823aaef64b4e5ac9fa595df57b5fe472a9/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:25d2326a4967bf705a9f9913a13005e93b6020ad8a9f6bd6bd78850d5171332e", size = 1571671, upload-time = "2026-06-01T19:39:04.044Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/01/e1280feac522597a4d46eb67a0cdfa053cfae263033030b761ab146f29fb/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:a1d209375c503472b3c0a340cdf3c55fcd82e84b46dda7caeaced59faba373ec", size = 1789904, upload-time = "2026-06-01T19:39:06.294Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/10/ab28818262f4d26bdb47ed5f1fc7999b69e2fc6e0370b02d0f49011f45ea/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:666c7c5036df57b693026398b69b41874a1931ac5b3485fd910e57bfac253869", size = 1754516, upload-time = "2026-06-01T19:39:08.788Z" },
+    { url = "https://files.pythonhosted.org/packages/af/cc/c122eabd7a1b7e0c9bbdd6be60e4715905b858399145d9df872bb94f1427/aiohttp-3.14.0-cp313-cp313-win32.whl", hash = "sha256:23f094a1ef64823fd35854ddf5c7a80a078162f37f9d2f7c6142b51a6affa456", size = 448656, upload-time = "2026-06-01T19:39:11.171Z" },
+    { url = "https://files.pythonhosted.org/packages/41/a5/bab07d79848a00eedd8ed979ccb302aaea3ac6eb9fa16bd0ed87135869b4/aiohttp-3.14.0-cp313-cp313-win_amd64.whl", hash = "sha256:e03abdaa17d553f17e1d1d06bb266b3970106c78051d06795723e748d8e49d11", size = 475803, upload-time = "2026-06-01T19:39:13.439Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/a0/f03ade8566c153666a3871afccbedf6d99911da006325e1fc6cf72a2de99/aiohttp-3.14.0-cp313-cp313-win_arm64.whl", hash = "sha256:acdb400538cf4769543548bb5d1eb23d39bed4f96554a6078cb728c7cb2c268b", size = 443889, upload-time = "2026-06-01T19:39:15.945Z" },
 ]
 
 [[package]]
@@ -327,7 +356,7 @@ version = "1.4.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "frozenlist" },
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/61/62/06741b579156360248d1ec624842ad0edf697050bbaf7c3e46394e106ad1/aiosignal-1.4.0.tar.gz", hash = "sha256:f47eecd9468083c2029cc99945502cb7708b082c232f9aca65da147157b251c7", size = 25007, upload-time = "2025-07-03T22:54:43.528Z" }
 wheels = [
@@ -752,7 +781,7 @@ source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "exceptiongroup", marker = "python_full_version < '3.11'" },
     { name = "idna" },
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/19/14/2c5dd9f512b66549ae92767a9c7b330ae88e1932ca57876909410251fe13/anyio-4.13.0.tar.gz", hash = "sha256:334b70e641fd2221c1505b3890c69882fe4a2df910cba14d97019b90b24439dc", size = 231622, upload-time = "2026-03-24T12:59:09.671Z" }
 wheels = [
@@ -829,15 +858,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ef/c3/f30a7a63e664acc7c2545ca0491b6ce8264536e0e5cad3965f1d1b91e960/aws_xray_sdk-2.15.0-py2.py3-none-any.whl", hash = "sha256:422d62ad7d52e373eebb90b642eb1bb24657afe03b22a8df4a8b2e5108e278a3", size = 103228, upload-time = "2025-10-29T21:00:24.12Z" },
 ]
 
-[[package]]
-name = "awsipranges"
-version = "0.3.3"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/19/2e/6efa95f995369da828715f41705686cd214b9259ed758266942553d40441/awsipranges-0.3.3.tar.gz", hash = "sha256:4f0b3f22a9dc1163c85b513bed812b6c92bdacd674e6a7b68252a3c25b99e2c0", size = 16739, upload-time = "2022-02-10T21:08:32.825Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/83/ce/5c9a8bf91bdc9592a409c99e58fd99f2727ab8d634719c0ad796021b76d7/awsipranges-0.3.3-py3-none-any.whl", hash = "sha256:f3d7a54aeaf7fe310beb5d377a4034a63a51b72677ae6af3e0967bc4de7eedaf", size = 18106, upload-time = "2022-02-10T21:08:31.497Z" },
-]
-
 [[package]]
 name = "azure-common"
 version = "1.1.28"
@@ -1285,7 +1305,7 @@ wheels = [
 
 [[package]]
 name = "black"
-version = "25.1.0"
+version = "26.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "click" },
@@ -1293,24 +1313,33 @@ dependencies = [
     { name = "packaging" },
     { name = "pathspec" },
     { name = "platformdirs" },
+    { name = "pytokens" },
     { name = "tomli", marker = "python_full_version < '3.11'" },
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/94/49/26a7b0f3f35da4b5a65f081943b7bcd22d7002f5f0fb8098ec1ff21cb6ef/black-25.1.0.tar.gz", hash = "sha256:33496d5cd1222ad73391352b4ae8da15253c5de89b93a80b3e2c8d9a19ec2666", size = 649449, upload-time = "2025-01-29T04:15:40.373Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e1/c5/61175d618685d42b005847464b8fb4743a67b1b8fdb75e50e5a96c31a27a/black-26.3.1.tar.gz", hash = "sha256:2c50f5063a9641c7eed7795014ba37b0f5fa227f3d408b968936e24bc0566b07", size = 666155, upload-time = "2026-03-12T03:36:03.593Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4d/3b/4ba3f93ac8d90410423fdd31d7541ada9bcee1df32fb90d26de41ed40e1d/black-25.1.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:759e7ec1e050a15f89b770cefbf91ebee8917aac5c20483bc2d80a6c3a04df32", size = 1629419, upload-time = "2025-01-29T05:37:06.642Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/02/0bde0485146a8a5e694daed47561785e8b77a0466ccc1f3e485d5ef2925e/black-25.1.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:0e519ecf93120f34243e6b0054db49c00a35f84f195d5bce7e9f5cfc578fc2da", size = 1461080, upload-time = "2025-01-29T05:37:09.321Z" },
-    { url = "https://files.pythonhosted.org/packages/52/0e/abdf75183c830eaca7589144ff96d49bce73d7ec6ad12ef62185cc0f79a2/black-25.1.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:055e59b198df7ac0b7efca5ad7ff2516bca343276c466be72eb04a3bcc1f82d7", size = 1766886, upload-time = "2025-01-29T04:18:24.432Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/a6/97d8bb65b1d8a41f8a6736222ba0a334db7b7b77b8023ab4568288f23973/black-25.1.0-cp310-cp310-win_amd64.whl", hash = "sha256:db8ea9917d6f8fc62abd90d944920d95e73c83a5ee3383493e35d271aca872e9", size = 1419404, upload-time = "2025-01-29T04:19:04.296Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/4f/87f596aca05c3ce5b94b8663dbfe242a12843caaa82dd3f85f1ffdc3f177/black-25.1.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a39337598244de4bae26475f77dda852ea00a93bd4c728e09eacd827ec929df0", size = 1614372, upload-time = "2025-01-29T05:37:11.71Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/d0/2c34c36190b741c59c901e56ab7f6e54dad8df05a6272a9747ecef7c6036/black-25.1.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:96c1c7cd856bba8e20094e36e0f948718dc688dba4a9d78c3adde52b9e6c2299", size = 1442865, upload-time = "2025-01-29T05:37:14.309Z" },
-    { url = "https://files.pythonhosted.org/packages/21/d4/7518c72262468430ead45cf22bd86c883a6448b9eb43672765d69a8f1248/black-25.1.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bce2e264d59c91e52d8000d507eb20a9aca4a778731a08cfff7e5ac4a4bb7096", size = 1749699, upload-time = "2025-01-29T04:18:17.688Z" },
-    { url = "https://files.pythonhosted.org/packages/58/db/4f5beb989b547f79096e035c4981ceb36ac2b552d0ac5f2620e941501c99/black-25.1.0-cp311-cp311-win_amd64.whl", hash = "sha256:172b1dbff09f86ce6f4eb8edf9dede08b1fce58ba194c87d7a4f1a5aa2f5b3c2", size = 1428028, upload-time = "2025-01-29T04:18:51.711Z" },
-    { url = "https://files.pythonhosted.org/packages/83/71/3fe4741df7adf015ad8dfa082dd36c94ca86bb21f25608eb247b4afb15b2/black-25.1.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:4b60580e829091e6f9238c848ea6750efed72140b91b048770b64e74fe04908b", size = 1650988, upload-time = "2025-01-29T05:37:16.707Z" },
-    { url = "https://files.pythonhosted.org/packages/13/f3/89aac8a83d73937ccd39bbe8fc6ac8860c11cfa0af5b1c96d081facac844/black-25.1.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1e2978f6df243b155ef5fa7e558a43037c3079093ed5d10fd84c43900f2d8ecc", size = 1453985, upload-time = "2025-01-29T05:37:18.273Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/22/b99efca33f1f3a1d2552c714b1e1b5ae92efac6c43e790ad539a163d1754/black-25.1.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3b48735872ec535027d979e8dcb20bf4f70b5ac75a8ea99f127c106a7d7aba9f", size = 1783816, upload-time = "2025-01-29T04:18:33.823Z" },
-    { url = "https://files.pythonhosted.org/packages/18/7e/a27c3ad3822b6f2e0e00d63d58ff6299a99a5b3aee69fa77cd4b0076b261/black-25.1.0-cp312-cp312-win_amd64.whl", hash = "sha256:ea0213189960bda9cf99be5b8c8ce66bb054af5e9e861249cd23471bd7b0b3ba", size = 1440860, upload-time = "2025-01-29T04:19:12.944Z" },
-    { url = "https://files.pythonhosted.org/packages/09/71/54e999902aed72baf26bca0d50781b01838251a462612966e9fc4891eadd/black-25.1.0-py3-none-any.whl", hash = "sha256:95e8176dae143ba9097f351d174fdaf0ccd29efb414b362ae3fd72bf0f710717", size = 207646, upload-time = "2025-01-29T04:15:38.082Z" },
+    { url = "https://files.pythonhosted.org/packages/32/a8/11170031095655d36ebc6664fe0897866f6023892396900eec0e8fdc4299/black-26.3.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:86a8b5035fce64f5dcd1b794cf8ec4d31fe458cf6ce3986a30deb434df82a1d2", size = 1866562, upload-time = "2026-03-12T03:39:58.639Z" },
+    { url = "https://files.pythonhosted.org/packages/69/ce/9e7548d719c3248c6c2abfd555d11169457cbd584d98d179111338423790/black-26.3.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:5602bdb96d52d2d0672f24f6ffe5218795736dd34807fd0fd55ccd6bf206168b", size = 1703623, upload-time = "2026-03-12T03:40:00.347Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/0a/8d17d1a9c06f88d3d030d0b1d4373c1551146e252afe4547ed601c0e697f/black-26.3.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6c54a4a82e291a1fee5137371ab488866b7c86a3305af4026bdd4dc78642e1ac", size = 1768388, upload-time = "2026-03-12T03:40:01.765Z" },
+    { url = "https://files.pythonhosted.org/packages/52/79/c1ee726e221c863cde5164f925bacf183dfdf0397d4e3f94889439b947b4/black-26.3.1-cp310-cp310-win_amd64.whl", hash = "sha256:6e131579c243c98f35bce64a7e08e87fb2d610544754675d4a0e73a070a5aa3a", size = 1412969, upload-time = "2026-03-12T03:40:03.252Z" },
+    { url = "https://files.pythonhosted.org/packages/73/a5/15c01d613f5756f68ed8f6d4ec0a1e24b82b18889fa71affd3d1f7fad058/black-26.3.1-cp310-cp310-win_arm64.whl", hash = "sha256:5ed0ca58586c8d9a487352a96b15272b7fa55d139fc8496b519e78023a8dab0a", size = 1220345, upload-time = "2026-03-12T03:40:04.892Z" },
+    { url = "https://files.pythonhosted.org/packages/17/57/5f11c92861f9c92eb9dddf515530bc2d06db843e44bdcf1c83c1427824bc/black-26.3.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:28ef38aee69e4b12fda8dba75e21f9b4f979b490c8ac0baa7cb505369ac9e1ff", size = 1851987, upload-time = "2026-03-12T03:40:06.248Z" },
+    { url = "https://files.pythonhosted.org/packages/54/aa/340a1463660bf6831f9e39646bf774086dbd8ca7fc3cded9d59bbdf4ad0a/black-26.3.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:bf9bf162ed91a26f1adba8efda0b573bc6924ec1408a52cc6f82cb73ec2b142c", size = 1689499, upload-time = "2026-03-12T03:40:07.642Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/01/b726c93d717d72733da031d2de10b92c9fa4c8d0c67e8a8a372076579279/black-26.3.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:474c27574d6d7037c1bc875a81d9be0a9a4f9ee95e62800dab3cfaadbf75acd5", size = 1754369, upload-time = "2026-03-12T03:40:09.279Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/09/61e91881ca291f150cfc9eb7ba19473c2e59df28859a11a88248b5cbbc4d/black-26.3.1-cp311-cp311-win_amd64.whl", hash = "sha256:5e9d0d86df21f2e1677cc4bd090cd0e446278bcbbe49bf3659c308c3e402843e", size = 1413613, upload-time = "2026-03-12T03:40:10.943Z" },
+    { url = "https://files.pythonhosted.org/packages/16/73/544f23891b22e7efe4d8f812371ab85b57f6a01b2fc45e3ba2e52ba985b8/black-26.3.1-cp311-cp311-win_arm64.whl", hash = "sha256:9a5e9f45e5d5e1c5b5c29b3bd4265dcc90e8b92cf4534520896ed77f791f4da5", size = 1219719, upload-time = "2026-03-12T03:40:12.597Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/f8/da5eae4fc75e78e6dceb60624e1b9662ab00d6b452996046dfa9b8a6025b/black-26.3.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:b5e6f89631eb88a7302d416594a32faeee9fb8fb848290da9d0a5f2903519fc1", size = 1895920, upload-time = "2026-03-12T03:40:13.921Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/9f/04e6f26534da2e1629b2b48255c264cabf5eedc5141d04516d9d68a24111/black-26.3.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:41cd2012d35b47d589cb8a16faf8a32ef7a336f56356babd9fcf70939ad1897f", size = 1718499, upload-time = "2026-03-12T03:40:15.239Z" },
+    { url = "https://files.pythonhosted.org/packages/04/91/a5935b2a63e31b331060c4a9fdb5a6c725840858c599032a6f3aac94055f/black-26.3.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f76ff19ec5297dd8e66eb64deda23631e642c9393ab592826fd4bdc97a4bce7", size = 1794994, upload-time = "2026-03-12T03:40:17.124Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/0a/86e462cdd311a3c2a8ece708d22aba17d0b2a0d5348ca34b40cdcbea512e/black-26.3.1-cp312-cp312-win_amd64.whl", hash = "sha256:ddb113db38838eb9f043623ba274cfaf7d51d5b0c22ecb30afe58b1bb8322983", size = 1420867, upload-time = "2026-03-12T03:40:18.83Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/e5/22515a19cb7eaee3440325a6b0d95d2c0e88dd180cb011b12ae488e031d1/black-26.3.1-cp312-cp312-win_arm64.whl", hash = "sha256:dfdd51fc3e64ea4f35873d1b3fb25326773d55d2329ff8449139ebaad7357efb", size = 1230124, upload-time = "2026-03-12T03:40:20.425Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/77/5728052a3c0450c53d9bb3945c4c46b91baa62b2cafab6801411b6271e45/black-26.3.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:855822d90f884905362f602880ed8b5df1b7e3ee7d0db2502d4388a954cc8c54", size = 1895034, upload-time = "2026-03-12T03:40:21.813Z" },
+    { url = "https://files.pythonhosted.org/packages/52/73/7cae55fdfdfbe9d19e9a8d25d145018965fe2079fa908101c3733b0c55a0/black-26.3.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:8a33d657f3276328ce00e4d37fe70361e1ec7614da5d7b6e78de5426cb56332f", size = 1718503, upload-time = "2026-03-12T03:40:23.666Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/87/af89ad449e8254fdbc74654e6467e3c9381b61472cc532ee350d28cfdafb/black-26.3.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f1cd08e99d2f9317292a311dfe578fd2a24b15dbce97792f9c4d752275c1fa56", size = 1793557, upload-time = "2026-03-12T03:40:25.497Z" },
+    { url = "https://files.pythonhosted.org/packages/43/10/d6c06a791d8124b843bf325ab4ac7d2f5b98731dff84d6064eafd687ded1/black-26.3.1-cp313-cp313-win_amd64.whl", hash = "sha256:c7e72339f841b5a237ff14f7d3880ddd0fc7f98a1199e8c4327f9a4f478c1839", size = 1422766, upload-time = "2026-03-12T03:40:27.14Z" },
+    { url = "https://files.pythonhosted.org/packages/59/4f/40a582c015f2d841ac24fed6390bd68f0fc896069ff3a886317959c9daf8/black-26.3.1-cp313-cp313-win_arm64.whl", hash = "sha256:afc622538b430aa4c8c853f7f63bc582b3b8030fd8c80b70fb5fa5b834e575c2", size = 1232140, upload-time = "2026-03-12T03:40:28.882Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/0d/52d98722666d6fc6c3dd4c76df339501d6efd40e0ff95e6186a7b7f0befd/black-26.3.1-py3-none-any.whl", hash = "sha256:2bd5aa94fc267d38bb21a70d7410a89f1a1d318841855f698746f8e7f51acd1b", size = 207542, upload-time = "2026-03-12T03:36:01.668Z" },
 ]
 
 [[package]]
@@ -1405,6 +1434,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/7b/2b/2b6435f76bfeb6bbf055596976da087377ede68df465419d192acf00c437/cffi-2.0.0-cp312-cp312-win32.whl", hash = "sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18", size = 172932, upload-time = "2025-09-08T23:22:57.188Z" },
     { url = "https://files.pythonhosted.org/packages/f8/ed/13bd4418627013bec4ed6e54283b1959cf6db888048c7cf4b4c3b5b36002/cffi-2.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5", size = 183557, upload-time = "2025-09-08T23:22:58.351Z" },
     { url = "https://files.pythonhosted.org/packages/95/31/9f7f93ad2f8eff1dbc1c3656d7ca5bfd8fb52c9d786b4dcf19b2d02217fa/cffi-2.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6", size = 177762, upload-time = "2025-09-08T23:22:59.668Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/8d/a0a47a0c9e413a658623d014e91e74a50cdd2c423f7ccfd44086ef767f90/cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb", size = 185230, upload-time = "2025-09-08T23:23:00.879Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/d2/a6c0296814556c68ee32009d9c2ad4f85f2707cdecfd7727951ec228005d/cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca", size = 181043, upload-time = "2025-09-08T23:23:02.231Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/1e/d22cc63332bd59b06481ceaac49d6c507598642e2230f201649058a7e704/cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b", size = 212446, upload-time = "2025-09-08T23:23:03.472Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/f5/a2c23eb03b61a0b8747f211eb716446c826ad66818ddc7810cc2cc19b3f2/cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b", size = 220101, upload-time = "2025-09-08T23:23:04.792Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/7f/e6647792fc5850d634695bc0e6ab4111ae88e89981d35ac269956605feba/cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2", size = 207948, upload-time = "2025-09-08T23:23:06.127Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/1e/a5a1bd6f1fb30f22573f76533de12a00bf274abcdc55c8edab639078abb6/cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3", size = 206422, upload-time = "2025-09-08T23:23:07.753Z" },
+    { url = "https://files.pythonhosted.org/packages/98/df/0a1755e750013a2081e863e7cd37e0cdd02664372c754e5560099eb7aa44/cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26", size = 219499, upload-time = "2025-09-08T23:23:09.648Z" },
+    { url = "https://files.pythonhosted.org/packages/50/e1/a969e687fcf9ea58e6e2a928ad5e2dd88cc12f6f0ab477e9971f2309b57c/cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c", size = 222928, upload-time = "2025-09-08T23:23:10.928Z" },
+    { url = "https://files.pythonhosted.org/packages/36/54/0362578dd2c9e557a28ac77698ed67323ed5b9775ca9d3fe73fe191bb5d8/cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b", size = 221302, upload-time = "2025-09-08T23:23:12.42Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/6d/bf9bda840d5f1dfdbf0feca87fbdb64a918a69bca42cfa0ba7b137c48cb8/cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27", size = 172909, upload-time = "2025-09-08T23:23:14.32Z" },
+    { url = "https://files.pythonhosted.org/packages/37/18/6519e1ee6f5a1e579e04b9ddb6f1676c17368a7aba48299c3759bbc3c8b3/cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75", size = 183402, upload-time = "2025-09-08T23:23:15.535Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/0e/02ceeec9a7d6ee63bb596121c2c8e9b3a9e150936f4fbef6ca1943e6137c/cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91", size = 177780, upload-time = "2025-09-08T23:23:16.761Z" },
 ]
 
 [[package]]
@@ -1479,6 +1520,22 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/86/eb/890922a8b03a568ca2f336c36585a4713c55d4d67bf0f0c78924be6315ca/charset_normalizer-3.4.7-cp312-cp312-win32.whl", hash = "sha256:2257141f39fe65a3fdf38aeccae4b953e5f3b3324f4ff0daf9f15b8518666a2c", size = 148460, upload-time = "2026-04-02T09:26:41.416Z" },
     { url = "https://files.pythonhosted.org/packages/35/d9/0e7dffa06c5ab081f75b1b786f0aefc88365825dfcd0ac544bdb7b2b6853/charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl", hash = "sha256:5ed6ab538499c8644b8a3e18debabcd7ce684f3fa91cf867521a7a0279cab2d6", size = 159330, upload-time = "2026-04-02T09:26:42.554Z" },
     { url = "https://files.pythonhosted.org/packages/9e/5d/481bcc2a7c88ea6b0878c299547843b2521ccbc40980cb406267088bc701/charset_normalizer-3.4.7-cp312-cp312-win_arm64.whl", hash = "sha256:56be790f86bfb2c98fb742ce566dfb4816e5a83384616ab59c49e0604d49c51d", size = 147828, upload-time = "2026-04-02T09:26:44.075Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/3b/66777e39d3ae1ddc77ee606be4ec6d8cbd4c801f65e5a1b6f2b11b8346dd/charset_normalizer-3.4.7-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:f496c9c3cc02230093d8330875c4c3cdfc3b73612a5fd921c65d39cbcef08063", size = 309627, upload-time = "2026-04-02T09:26:45.198Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/4e/b7f84e617b4854ade48a1b7915c8ccfadeba444d2a18c291f696e37f0d3b/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0ea948db76d31190bf08bd371623927ee1339d5f2a0b4b1b4a4439a65298703c", size = 207008, upload-time = "2026-04-02T09:26:46.824Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/bb/ec73c0257c9e11b268f018f068f5d00aa0ef8c8b09f7753ebd5f2880e248/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a277ab8928b9f299723bc1a2dabb1265911b1a76341f90a510368ca44ad9ab66", size = 228303, upload-time = "2026-04-02T09:26:48.397Z" },
+    { url = "https://files.pythonhosted.org/packages/85/fb/32d1f5033484494619f701e719429c69b766bfc4dbc61aa9e9c8c166528b/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3bec022aec2c514d9cf199522a802bd007cd588ab17ab2525f20f9c34d067c18", size = 224282, upload-time = "2026-04-02T09:26:49.684Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/07/330e3a0dda4c404d6da83b327270906e9654a24f6c546dc886a0eb0ffb23/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e044c39e41b92c845bc815e5ae4230804e8e7bc29e399b0437d64222d92809dd", size = 215595, upload-time = "2026-04-02T09:26:50.915Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/7c/fc890655786e423f02556e0216d4b8c6bcb6bdfa890160dc66bf52dee468/charset_normalizer-3.4.7-cp313-cp313-manylinux_2_31_armv7l.whl", hash = "sha256:f495a1652cf3fbab2eb0639776dad966c2fb874d79d87ca07f9d5f059b8bd215", size = 201986, upload-time = "2026-04-02T09:26:52.197Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/97/bfb18b3db2aed3b90cf54dc292ad79fdd5ad65c4eae454099475cbeadd0d/charset_normalizer-3.4.7-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e712b419df8ba5e42b226c510472b37bd57b38e897d3eca5e8cfd410a29fa859", size = 211711, upload-time = "2026-04-02T09:26:53.49Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/a5/a581c13798546a7fd557c82614a5c65a13df2157e9ad6373166d2a3e645d/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7804338df6fcc08105c7745f1502ba68d900f45fd770d5bdd5288ddccb8a42d8", size = 210036, upload-time = "2026-04-02T09:26:54.975Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/bf/b3ab5bcb478e4193d517644b0fb2bf5497fbceeaa7a1bc0f4d5b50953861/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:481551899c856c704d58119b5025793fa6730adda3571971af568f66d2424bb5", size = 202998, upload-time = "2026-04-02T09:26:56.303Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/4e/23efd79b65d314fa320ec6017b4b5834d5c12a58ba4610aa353af2e2f577/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:f59099f9b66f0d7145115e6f80dd8b1d847176df89b234a5a6b3f00437aa0832", size = 230056, upload-time = "2026-04-02T09:26:57.554Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/9f/1e1941bc3f0e01df116e68dc37a55c4d249df5e6fa77f008841aef68264f/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:f59ad4c0e8f6bba240a9bb85504faa1ab438237199d4cce5f622761507b8f6a6", size = 211537, upload-time = "2026-04-02T09:26:58.843Z" },
+    { url = "https://files.pythonhosted.org/packages/80/0f/088cbb3020d44428964a6c97fe1edfb1b9550396bf6d278330281e8b709c/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:3dedcc22d73ec993f42055eff4fcfed9318d1eeb9a6606c55892a26964964e48", size = 226176, upload-time = "2026-04-02T09:27:00.437Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/9f/130394f9bbe06f4f63e22641d32fc9b202b7e251c9aef4db044324dac493/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:64f02c6841d7d83f832cd97ccf8eb8a906d06eb95d5276069175c696b024b60a", size = 217723, upload-time = "2026-04-02T09:27:02.021Z" },
+    { url = "https://files.pythonhosted.org/packages/73/55/c469897448a06e49f8fa03f6caae97074fde823f432a98f979cc42b90e69/charset_normalizer-3.4.7-cp313-cp313-win32.whl", hash = "sha256:4042d5c8f957e15221d423ba781e85d553722fc4113f523f2feb7b188cc34c5e", size = 148085, upload-time = "2026-04-02T09:27:03.192Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/78/1b74c5bbb3f99b77a1715c91b3e0b5bdb6fe302d95ace4f5b1bec37b0167/charset_normalizer-3.4.7-cp313-cp313-win_amd64.whl", hash = "sha256:3946fa46a0cf3e4c8cb1cc52f56bb536310d34f25f01ca9b6c16afa767dab110", size = 158819, upload-time = "2026-04-02T09:27:04.454Z" },
+    { url = "https://files.pythonhosted.org/packages/68/86/46bd42279d323deb8687c4a5a811fd548cb7d1de10cf6535d099877a9a9f/charset_normalizer-3.4.7-cp313-cp313-win_arm64.whl", hash = "sha256:80d04837f55fc81da168b98de4f4b797ef007fc8a79ab71c6ec9bc4dd662b15b", size = 147915, upload-time = "2026-04-02T09:27:05.971Z" },
     { url = "https://files.pythonhosted.org/packages/db/8f/61959034484a4a7c527811f4721e75d02d653a35afb0b6054474d8185d4c/charset_normalizer-3.4.7-py3-none-any.whl", hash = "sha256:3dce51d0f5e7951f8bb4900c257dad282f49190fdbebecd4ba99bcc41fef404d", size = 61958, upload-time = "2026-04-02T09:28:37.794Z" },
 ]
 
@@ -1586,6 +1643,26 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/1c/8e/5bb04f0318805e190984c6ce106b4c3968a9562a400180e549855d8211bd/coverage-7.6.12-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:b076e625396e787448d27a411aefff867db2bffac8ed04e8f7056b07024eed5a", size = 241329, upload-time = "2025-02-11T14:45:53.19Z" },
     { url = "https://files.pythonhosted.org/packages/9e/9d/fa04d9e6c3f6459f4e0b231925277cfc33d72dfab7fa19c312c03e59da99/coverage-7.6.12-cp312-cp312-win32.whl", hash = "sha256:00b2086892cf06c7c2d74983c9595dc511acca00665480b3ddff749ec4fb2a95", size = 211289, upload-time = "2025-02-11T14:45:54.74Z" },
     { url = "https://files.pythonhosted.org/packages/53/40/53c7ffe3c0c3fff4d708bc99e65f3d78c129110d6629736faf2dbd60ad57/coverage-7.6.12-cp312-cp312-win_amd64.whl", hash = "sha256:7ae6eabf519bc7871ce117fb18bf14e0e343eeb96c377667e3e5dd12095e0288", size = 212079, upload-time = "2025-02-11T14:45:57.22Z" },
+    { url = "https://files.pythonhosted.org/packages/76/89/1adf3e634753c0de3dad2f02aac1e73dba58bc5a3a914ac94a25b2ef418f/coverage-7.6.12-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:488c27b3db0ebee97a830e6b5a3ea930c4a6e2c07f27a5e67e1b3532e76b9ef1", size = 208673, upload-time = "2025-02-11T14:45:59.618Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/64/92a4e239d64d798535c5b45baac6b891c205a8a2e7c9cc8590ad386693dc/coverage-7.6.12-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5d1095bbee1851269f79fd8e0c9b5544e4c00c0c24965e66d8cba2eb5bb535fd", size = 208945, upload-time = "2025-02-11T14:46:01.869Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/d0/4596a3ef3bca20a94539c9b1e10fd250225d1dec57ea78b0867a1cf9742e/coverage-7.6.12-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0533adc29adf6a69c1baa88c3d7dbcaadcffa21afbed3ca7a225a440e4744bf9", size = 242484, upload-time = "2025-02-11T14:46:03.527Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/ef/6fd0d344695af6718a38d0861408af48a709327335486a7ad7e85936dc6e/coverage-7.6.12-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:53c56358d470fa507a2b6e67a68fd002364d23c83741dbc4c2e0680d80ca227e", size = 239525, upload-time = "2025-02-11T14:46:05.973Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/4b/373be2be7dd42f2bcd6964059fd8fa307d265a29d2b9bcf1d044bcc156ed/coverage-7.6.12-cp313-cp313-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:64cbb1a3027c79ca6310bf101014614f6e6e18c226474606cf725238cf5bc2d4", size = 241545, upload-time = "2025-02-11T14:46:07.79Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/7d/0e83cc2673a7790650851ee92f72a343827ecaaea07960587c8f442b5cd3/coverage-7.6.12-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:79cac3390bfa9836bb795be377395f28410811c9066bc4eefd8015258a7578c6", size = 241179, upload-time = "2025-02-11T14:46:11.853Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/8c/566ea92ce2bb7627b0900124e24a99f9244b6c8c92d09ff9f7633eb7c3c8/coverage-7.6.12-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:9b148068e881faa26d878ff63e79650e208e95cf1c22bd3f77c3ca7b1d9821a3", size = 239288, upload-time = "2025-02-11T14:46:13.411Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/e4/869a138e50b622f796782d642c15fb5f25a5870c6d0059a663667a201638/coverage-7.6.12-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8bec2ac5da793c2685ce5319ca9bcf4eee683b8a1679051f8e6ec04c4f2fd7dc", size = 241032, upload-time = "2025-02-11T14:46:15.005Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/28/a52ff5d62a9f9e9fe9c4f17759b98632edd3a3489fce70154c7d66054dd3/coverage-7.6.12-cp313-cp313-win32.whl", hash = "sha256:200e10beb6ddd7c3ded322a4186313d5ca9e63e33d8fab4faa67ef46d3460af3", size = 211315, upload-time = "2025-02-11T14:46:16.638Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/17/ab849b7429a639f9722fa5628364c28d675c7ff37ebc3268fe9840dda13c/coverage-7.6.12-cp313-cp313-win_amd64.whl", hash = "sha256:2b996819ced9f7dbb812c701485d58f261bef08f9b85304d41219b1496b591ef", size = 212099, upload-time = "2025-02-11T14:46:18.268Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/1c/b9965bf23e171d98505eb5eb4fb4d05c44efd256f2e0f19ad1ba8c3f54b0/coverage-7.6.12-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:299cf973a7abff87a30609879c10df0b3bfc33d021e1adabc29138a48888841e", size = 209511, upload-time = "2025-02-11T14:46:20.768Z" },
+    { url = "https://files.pythonhosted.org/packages/57/b3/119c201d3b692d5e17784fee876a9a78e1b3051327de2709392962877ca8/coverage-7.6.12-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4b467a8c56974bf06e543e69ad803c6865249d7a5ccf6980457ed2bc50312703", size = 209729, upload-time = "2025-02-11T14:46:22.258Z" },
+    { url = "https://files.pythonhosted.org/packages/52/4e/a7feb5a56b266304bc59f872ea07b728e14d5a64f1ad3a2cc01a3259c965/coverage-7.6.12-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2458f275944db8129f95d91aee32c828a408481ecde3b30af31d552c2ce284a0", size = 253988, upload-time = "2025-02-11T14:46:23.999Z" },
+    { url = "https://files.pythonhosted.org/packages/65/19/069fec4d6908d0dae98126aa7ad08ce5130a6decc8509da7740d36e8e8d2/coverage-7.6.12-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0a9d8be07fb0832636a0f72b80d2a652fe665e80e720301fb22b191c3434d924", size = 249697, upload-time = "2025-02-11T14:46:25.617Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/da/5b19f09ba39df7c55f77820736bf17bbe2416bbf5216a3100ac019e15839/coverage-7.6.12-cp313-cp313t-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:14d47376a4f445e9743f6c83291e60adb1b127607a3618e3185bbc8091f0467b", size = 252033, upload-time = "2025-02-11T14:46:28.069Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/89/4c2750df7f80a7872267f7c5fe497c69d45f688f7b3afe1297e52e33f791/coverage-7.6.12-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:b95574d06aa9d2bd6e5cc35a5bbe35696342c96760b69dc4287dbd5abd4ad51d", size = 251535, upload-time = "2025-02-11T14:46:29.818Z" },
+    { url = "https://files.pythonhosted.org/packages/78/3b/6d3ae3c1cc05f1b0460c51e6f6dcf567598cbd7c6121e5ad06643974703c/coverage-7.6.12-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:ecea0c38c9079570163d663c0433a9af4094a60aafdca491c6a3d248c7432827", size = 249192, upload-time = "2025-02-11T14:46:31.563Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/8e/c14a79f535ce41af7d436bbad0d3d90c43d9e38ec409b4770c894031422e/coverage-7.6.12-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:2251fabcfee0a55a8578a9d29cecfee5f2de02f11530e7d5c5a05859aa85aee9", size = 250627, upload-time = "2025-02-11T14:46:33.145Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/79/b7cee656cfb17a7f2c1b9c3cee03dd5d8000ca299ad4038ba64b61a9b044/coverage-7.6.12-cp313-cp313t-win32.whl", hash = "sha256:eb5507795caabd9b2ae3f1adc95f67b1104971c22c624bb354232d65c4fc90b3", size = 212033, upload-time = "2025-02-11T14:46:35.79Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/c3/f7aaa3813f1fa9a4228175a7bd368199659d392897e184435a3b66408dd3/coverage-7.6.12-cp313-cp313t-win_amd64.whl", hash = "sha256:f60a297c3987c6c02ffb29effc70eadcbb412fe76947d394a1091a3615948e2f", size = 213240, upload-time = "2025-02-11T14:46:38.119Z" },
     { url = "https://files.pythonhosted.org/packages/7a/7f/05818c62c7afe75df11e0233bd670948d68b36cdbf2a339a095bc02624a8/coverage-7.6.12-pp39.pp310-none-any.whl", hash = "sha256:7e39e845c4d764208e7b8f6a21c541ade741e2c41afabdfa1caa28687a3c98cf", size = 200558, upload-time = "2025-02-11T14:47:00.292Z" },
     { url = "https://files.pythonhosted.org/packages/fb/b2/f655700e1024dec98b10ebaafd0cedbc25e40e4abe62a3c8e2ceef4f8f0a/coverage-7.6.12-py3-none-any.whl", hash = "sha256:eb8668cfbc279a536c633137deeb9435d2962caec279c3f8cf8b91fff6ff8953", size = 200552, upload-time = "2025-02-11T14:47:01.999Z" },
 ]
@@ -1774,29 +1851,41 @@ wheels = [
 
 [[package]]
 name = "dulwich"
-version = "0.23.0"
+version = "1.2.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "typing-extensions", marker = "python_full_version < '3.12'" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/4b/ac/ba58cf420640c7bc77ae8e1b31e174d83c9117750c63cf9ea3b5e202e5c4/dulwich-0.23.0.tar.gz", hash = "sha256:0aa6c2489dd5e978b27e9b75983b7331a66c999f0efc54ebe37cab808ed322ae", size = 575116, upload-time = "2025-06-21T17:56:47.494Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7f/85/ceb8ecff5cdeee4ceeebb86b599476dee559041dacc6c2c50cc0d4711549/dulwich-1.2.5.tar.gz", hash = "sha256:0395b2c8924c3424bafe2d9c1edd5348cc4b21ce9c1d6655bf01f9a5c47164c8", size = 1253230, upload-time = "2026-05-28T22:27:55.17Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ba/8d/d725f0c9ddb218c7d9e3e02ee4545e998b57e1d7c12f5ab3e2d61f577410/dulwich-0.23.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:c13b0d5a9009cde23ecb8cb201df6e23e2a7a82c5e2d6ba6443fbb322c9befc6", size = 973413, upload-time = "2025-06-21T17:56:04.641Z" },
-    { url = "https://files.pythonhosted.org/packages/97/82/0316022bd64b3525acfebc88b6b7506d04b0402b7dbfb746cd15529b9ea8/dulwich-0.23.0-cp310-cp310-manylinux_2_28_aarch64.whl", hash = "sha256:a68faf8612bf93de1285048d6ad13160f0fb3c5596a86e694e78f4e212886fa5", size = 1050614, upload-time = "2025-06-21T17:56:07.084Z" },
-    { url = "https://files.pythonhosted.org/packages/65/a0/e3f71d6d74809cd9245d3d2921448fd32a8417f74b4e912e82cef0cf5098/dulwich-0.23.0-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:d971566826f16ec67c70641c1fbdb337323aa5b533799bc5a4641f4750e73b36", size = 1052830, upload-time = "2025-06-21T17:56:08.682Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/38/8dd887d9b64f47f8097e207ed7e8d5dd640a19aa763e632d97174961585f/dulwich-0.23.0-cp310-cp310-win32.whl", hash = "sha256:27d970adf539806dfc4fe3e4c9e8dc6ebf0318977a56e24d22f13413535a51ba", size = 642779, upload-time = "2025-06-21T17:56:10.391Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/ca/a345085526ac3b7aaa891ca4ec7ad9375cd8d017e42d4dbf20a443231275/dulwich-0.23.0-cp310-cp310-win_amd64.whl", hash = "sha256:025178533e884ffdb0d9d8db4b8870745d438cbfecb782fd1b56c3b6438e86cf", size = 658637, upload-time = "2025-06-21T17:56:12.093Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/11/f6bbba8583f69cf19ef4bd7f5fde1a6b5ccaf8b6951781cec8db247116f4/dulwich-0.23.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:d68498fdda13ab00791b483daab3bcfe9f9721c037aa458695e6ad81640c57cc", size = 972658, upload-time = "2025-06-21T17:56:13.505Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/9d/2720e0ab58666378a33c752a61543f936cd6b06dfe5d84a2215ddc0914b0/dulwich-0.23.0-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:cb7bb930b12471a1cfcea4b3d25a671dc0ad32573f0ad25684684298959a1527", size = 1049813, upload-time = "2025-06-21T17:56:14.884Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/f3/81d8075141dfcc0a0449c2093596e58d3e11444e3af54e819eca63b84dd0/dulwich-0.23.0-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:a2abbce32fd2bc7902bcc5f69b10bf22576810de21651baaa864b78fd7aec261", size = 1051639, upload-time = "2025-06-21T17:56:16.437Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/0d/c06ccb227b096aef5906142fe78b5c79f9070a0ea6152fc219941186d540/dulwich-0.23.0-cp311-cp311-win32.whl", hash = "sha256:9e3151f10ce2a9ff91bca64c74345217f53bdd947dc958032343822009832f7a", size = 642918, upload-time = "2025-06-21T17:56:18.373Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/1c/1e99aa34c9aead9e641b2d9934f0a3d00257f75027cf5cdecc8a1a6c18ae/dulwich-0.23.0-cp311-cp311-win_amd64.whl", hash = "sha256:3ae9f1d9dc92d4e9a3f89ba2c55221f7b6442c5dd93b3f6f539a3c9eb3f37bdd", size = 659010, upload-time = "2025-06-21T17:56:19.947Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/d7/1e6fba0235babe912e8467b036062e37d11672cbbeb0d8074f9d4559057b/dulwich-0.23.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:52cdef66a7994d29528ca79ca59452518bbba3fd56a9c61c61f6c467c1c7956e", size = 960292, upload-time = "2025-06-21T17:56:21.308Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/6a/23f0c487ec03f2752600cab4a8e0dedb38186246c475bf3fa90a8db830d5/dulwich-0.23.0-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:d473888a6ab9ed5d4a4c3f053cbe5b77f72d54b6efdf5688fed76094316e571e", size = 1047892, upload-time = "2025-06-21T17:56:22.989Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/e2/8f3d216be5fd0ee1180d917b59b34b54b9896384cf139f319b5d3a8f16b4/dulwich-0.23.0-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:19fcf20224c641a61c774da92f098fbaae9938c7e17a52841e64092adf7e78f9", size = 1048699, upload-time = "2025-06-21T17:56:24.602Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/c4/18e6223cd4ad1ae9334eb4e6aa5952fd8f5c3d75762918eb90c209fec4ba/dulwich-0.23.0-cp312-cp312-win32.whl", hash = "sha256:7fc8b76b704ef35cd001e993e3aa4e1d666a2064bf467c07c560f12b2959dcaf", size = 641268, upload-time = "2025-06-21T17:56:26.18Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/9c/65bfbbac62d8a2967e13f6a1512371c5eb6b906a61fb6dead992669cad0e/dulwich-0.23.0-cp312-cp312-win_amd64.whl", hash = "sha256:cb0566b888b578325350b4d67c61a0de35d417e9877560e3a6df88cae4576a59", size = 657837, upload-time = "2025-06-21T17:56:27.821Z" },
-    { url = "https://files.pythonhosted.org/packages/35/31/49318ee9db4b402e6d8b9b01bd4cae9298f59e1bb9bd56cf4a94e48fa069/dulwich-0.23.0-py3-none-any.whl", hash = "sha256:d8da6694ca332bb48775e35ee2215aa4673821164a91b83062f699c69f7cd135", size = 313776, upload-time = "2025-06-21T17:56:46.221Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/af/60929b502d6541cb015beb9f1da82600aac64d5f705d0188aaf44a7aa77f/dulwich-1.2.5-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:46db47394ba8a95748ae739f5d3a5a3e1724a2f857bf2437bc71bfc0baaed91d", size = 1400236, upload-time = "2026-05-28T22:26:50.998Z" },
+    { url = "https://files.pythonhosted.org/packages/04/f8/25de359a9249cc05a58c2500babfe2adff174931f2fa3fe97c700ca16626/dulwich-1.2.5-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:66aded7d364341b55941973a1562323f25bd205f0809692b687ec36ccd31242c", size = 1382996, upload-time = "2026-05-28T22:26:53.545Z" },
+    { url = "https://files.pythonhosted.org/packages/04/f7/640fee144007262096173f5fafd04cc7e5a0d72b0ceeeb9c9a51d99abc43/dulwich-1.2.5-cp310-cp310-manylinux_2_28_aarch64.whl", hash = "sha256:dd9569bc26174a3437d749114d36c81fc6c7478b55370ae50125e34e9629e4fe", size = 1471811, upload-time = "2026-05-28T22:26:55.044Z" },
+    { url = "https://files.pythonhosted.org/packages/51/2a/348c1f0baa0c42dc79a9f503463ddb00452c234ec5c9e20b43530d78528e/dulwich-1.2.5-cp310-cp310-manylinux_2_28_x86_64.whl", hash = "sha256:827366331603150de5976d72dd456a3fd5fc91e856471dc1d10fd64758c05f02", size = 1498006, upload-time = "2026-05-28T22:26:56.531Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/f8/95f51bcbc2ce86beea49a67f61228be86bf614a24aa714a8c59e0abdd153/dulwich-1.2.5-cp310-cp310-win32.whl", hash = "sha256:6c683c0f4a062894b6826c61102d415dae86ade61a10003c82ccc2b91858d5fb", size = 1066964, upload-time = "2026-05-28T22:26:58.049Z" },
+    { url = "https://files.pythonhosted.org/packages/68/c1/ffa02a1623c3d668de8e66b654187bb8dc24c085224644e5554537ee4642/dulwich-1.2.5-cp310-cp310-win_amd64.whl", hash = "sha256:a6620963196c49212c511cd909f367dacf771f199a27d116f357cc671ea956c7", size = 1079537, upload-time = "2026-05-28T22:26:59.319Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/4a/654ae1671610fdf6b65a64586ad67ddd8550d4d08a632b2a4b9614754b6d/dulwich-1.2.5-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:556593fd11637f80f6018bee1916b1a84f5b420423b470ebb3f1a782ad6ef081", size = 1399277, upload-time = "2026-05-28T22:27:00.801Z" },
+    { url = "https://files.pythonhosted.org/packages/85/d8/06ee3bc8eded4bd7adf8adf0c9ea5f19bf96f7e5e626bfaf7311cde4208a/dulwich-1.2.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a70477c991e96cfe8fdd7c866e7251faf71b38bfeb51d6f27554c9cce1caabf3", size = 1382310, upload-time = "2026-05-28T22:27:02.216Z" },
+    { url = "https://files.pythonhosted.org/packages/07/17/a03adf50b9095f9f5d863393f21d585dea39bdc4fdf60788ff3a9407a512/dulwich-1.2.5-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:9008ef25cabd379cda4fa86000fc38ca14b72afe17db798a8c85c0b2b7ce4d1e", size = 1470993, upload-time = "2026-05-28T22:27:04.075Z" },
+    { url = "https://files.pythonhosted.org/packages/60/58/1dc352d2a5e80befe4338af7208febb44bcfd7496b0dde5ac6dacb07b031/dulwich-1.2.5-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:a5549f4afc973e0a15ea6b0244d57f848d3f3ee13dac557eb311024aebebf128", size = 1497820, upload-time = "2026-05-28T22:27:05.549Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/a8/e058959a87e7df7753b112ef66a43ccbc57338c1bbdc23a0edf3833396df/dulwich-1.2.5-cp311-cp311-win32.whl", hash = "sha256:5108acead814d1de8b6262d6d8fb90af7e82f5a4d83788b6b48e39d01800a92f", size = 1066549, upload-time = "2026-05-28T22:27:06.832Z" },
+    { url = "https://files.pythonhosted.org/packages/33/91/ff0b444f686718635348986bd73dfce42e947912417893de35de399b878b/dulwich-1.2.5-cp311-cp311-win_amd64.whl", hash = "sha256:5e067b7feceb7034bc99e7c7143a704f1d97d4be7027d9a0aa5a83c0657ff091", size = 1079481, upload-time = "2026-05-28T22:27:08.33Z" },
+    { url = "https://files.pythonhosted.org/packages/19/22/4f75770bbe5521cac61c4820ef46d4fbf8c2175d3519ba3d0378d4ba798e/dulwich-1.2.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:701a9ecf7a8a44f5e2459e46befa93530cf36a8b1ae3140aefc007db1d7d0207", size = 1396522, upload-time = "2026-05-28T22:27:09.997Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/b1/c07c347681c0cf6acd4b189bf6e8d6207c71a1347b7a1e865eb40faa46b9/dulwich-1.2.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:2f90d68bfa97c4ca71de7507984365aefe27b6d248cb28dc99644d0f3ae8c60b", size = 1334826, upload-time = "2026-05-28T22:27:11.582Z" },
+    { url = "https://files.pythonhosted.org/packages/13/80/6818eb7ce492e18ab2efa92ab901d173b4b0b159e5681c1424f329600c40/dulwich-1.2.5-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:00b54a1d56ddbacdd8eadd6d4787a51b3a05fefa30eadbf9165fd283a00b90ed", size = 1416616, upload-time = "2026-05-28T22:27:13.195Z" },
+    { url = "https://files.pythonhosted.org/packages/14/a7/9790e60d19870f6554f7583722bb324c1355784316f20aeda1c0b5b1491a/dulwich-1.2.5-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:d8f7ea8f47e38e5b0de3fab97e07e9c9161ffddc90b3964512cab2b7749df4e6", size = 1441354, upload-time = "2026-05-28T22:27:14.683Z" },
+    { url = "https://files.pythonhosted.org/packages/91/44/0ea8a69c24aa1254ff5996d682eae2eab287d471b937dcdb26d9ea9720b4/dulwich-1.2.5-cp312-cp312-win32.whl", hash = "sha256:8929134acf4ff967203df7600b38535f9b5b590462067a7e30dbce01acb97af9", size = 1017058, upload-time = "2026-05-28T22:27:16.121Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/9c/2fcddda7faec3bae52db7c64bfcb5dc756f597f33fae90e8d4e4b4d3b39b/dulwich-1.2.5-cp312-cp312-win_amd64.whl", hash = "sha256:9693d2c9e226b2ea855c1dc3a87e2f4d972f7523fc0f7924e5997e9f4c23d97f", size = 1031731, upload-time = "2026-05-28T22:27:17.633Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/33/8bd311edfb312e907b4ec7ad4680922e3f5baeccd18d987aeb57141a685d/dulwich-1.2.5-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:2f10dafa1ef5660b1331364bc8d68446448608a8d8f493ed0e260eaf5133e71c", size = 1530974, upload-time = "2026-05-28T22:27:19.301Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/0d/e4704188a78efbe785d6dc921b70a4f896dbbd4e37caed3a4122be31e871/dulwich-1.2.5-cp313-cp313-android_21_x86_64.whl", hash = "sha256:9b6d234f1f91335e9f01d9daac42ddc2d2e5c2fdbe285d8eeef50353b283648a", size = 1524254, upload-time = "2026-05-28T22:27:20.993Z" },
+    { url = "https://files.pythonhosted.org/packages/62/95/feb632693a629314593972f9393bb0a614aee5301ebd0848cb1c7fbfa56c/dulwich-1.2.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:c65230abaa52c72093b70d3b499d5689d1d8f9627e88ad3c3b4f8154e86ac0c8", size = 1394846, upload-time = "2026-05-28T22:27:22.475Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/4c/f0b4ae4cd2a34bf21ac37944d75c68d2297ebc0128928f988767d1542ef0/dulwich-1.2.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e128cddeccae4146b556684a0d5426454fff5bfe7306862e5a8ce6b471568af4", size = 1333523, upload-time = "2026-05-28T22:27:23.966Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/bf/b834306cd6a5959b1521d7f4d3e7473d39cdaea43063d97fa1eed6f1ba28/dulwich-1.2.5-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:07cb75b58216440e2c170fff4f3d55a5f387358d9489863af8cb11f24ee37121", size = 1415849, upload-time = "2026-05-28T22:27:25.329Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/e5/8a6110eb9314fea1bf79c13ab1a5ab699167f1401284cee4bebbf3db2e90/dulwich-1.2.5-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:df4ac3746099562c8160d78d55bb2fa10c9ada7ef970af3e2536bd133cb7830e", size = 1441075, upload-time = "2026-05-28T22:27:26.723Z" },
+    { url = "https://files.pythonhosted.org/packages/00/75/e993287749f7fa9ff871a0a4fbbede81727f982b1658ba50e7273a100fd3/dulwich-1.2.5-cp313-cp313-win32.whl", hash = "sha256:9fc113c1348c7eb22c4e8790f68b562bb4f42a721fafb813e89a57e9cd632040", size = 1016835, upload-time = "2026-05-28T22:27:28.544Z" },
+    { url = "https://files.pythonhosted.org/packages/50/bc/17cc36a67696e06e040e8035fcfdc2583e3834f736b7fe808d3ce01531d0/dulwich-1.2.5-cp313-cp313-win_amd64.whl", hash = "sha256:1ba83ec3cfb4c506c277400357a51523c8258fa07b841ee06e8e1071da4cfed1", size = 1031444, upload-time = "2026-05-28T22:27:30.204Z" },
+    { url = "https://files.pythonhosted.org/packages/07/4b/4a18a59ad230581cd0ef460e96001f90762e566dc2dfdba22aa358eb5a0e/dulwich-1.2.5-py3-none-any.whl", hash = "sha256:1679b376433a0fc7f36586afda1d4ed7427afa7a79d4bf17e5014474eea69fa4", size = 686745, upload-time = "2026-05-28T22:27:53.695Z" },
 ]
 
 [[package]]
@@ -1948,6 +2037,38 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/66/bb/852b9d6db2fa40be96f29c0d1205c306288f0684df8fd26ca1951d461a56/frozenlist-1.8.0-cp312-cp312-win32.whl", hash = "sha256:433403ae80709741ce34038da08511d4a77062aa924baf411ef73d1146e74faf", size = 39985, upload-time = "2025-10-06T05:36:23.661Z" },
     { url = "https://files.pythonhosted.org/packages/b8/af/38e51a553dd66eb064cdf193841f16f077585d4d28394c2fa6235cb41765/frozenlist-1.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:34187385b08f866104f0c0617404c8eb08165ab1272e884abc89c112e9c00746", size = 44591, upload-time = "2025-10-06T05:36:24.958Z" },
     { url = "https://files.pythonhosted.org/packages/a7/06/1dc65480ab147339fecc70797e9c2f69d9cea9cf38934ce08df070fdb9cb/frozenlist-1.8.0-cp312-cp312-win_arm64.whl", hash = "sha256:fe3c58d2f5db5fbd18c2987cba06d51b0529f52bc3a6cdc33d3f4eab725104bd", size = 40102, upload-time = "2025-10-06T05:36:26.333Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/40/0832c31a37d60f60ed79e9dfb5a92e1e2af4f40a16a29abcc7992af9edff/frozenlist-1.8.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:8d92f1a84bb12d9e56f818b3a746f3efba93c1b63c8387a73dde655e1e42282a", size = 85717, upload-time = "2025-10-06T05:36:27.341Z" },
+    { url = "https://files.pythonhosted.org/packages/30/ba/b0b3de23f40bc55a7057bd38434e25c34fa48e17f20ee273bbde5e0650f3/frozenlist-1.8.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:96153e77a591c8adc2ee805756c61f59fef4cf4073a9275ee86fe8cba41241f7", size = 49651, upload-time = "2025-10-06T05:36:28.855Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/ab/6e5080ee374f875296c4243c381bbdef97a9ac39c6e3ce1d5f7d42cb78d6/frozenlist-1.8.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f21f00a91358803399890ab167098c131ec2ddd5f8f5fd5fe9c9f2c6fcd91e40", size = 49417, upload-time = "2025-10-06T05:36:29.877Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/4e/e4691508f9477ce67da2015d8c00acd751e6287739123113a9fca6f1604e/frozenlist-1.8.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:fb30f9626572a76dfe4293c7194a09fb1fe93ba94c7d4f720dfae3b646b45027", size = 234391, upload-time = "2025-10-06T05:36:31.301Z" },
+    { url = "https://files.pythonhosted.org/packages/40/76/c202df58e3acdf12969a7895fd6f3bc016c642e6726aa63bd3025e0fc71c/frozenlist-1.8.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eaa352d7047a31d87dafcacbabe89df0aa506abb5b1b85a2fb91bc3faa02d822", size = 233048, upload-time = "2025-10-06T05:36:32.531Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/c0/8746afb90f17b73ca5979c7a3958116e105ff796e718575175319b5bb4ce/frozenlist-1.8.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:03ae967b4e297f58f8c774c7eabcce57fe3c2434817d4385c50661845a058121", size = 226549, upload-time = "2025-10-06T05:36:33.706Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/eb/4c7eefc718ff72f9b6c4893291abaae5fbc0c82226a32dcd8ef4f7a5dbef/frozenlist-1.8.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f6292f1de555ffcc675941d65fffffb0a5bcd992905015f85d0592201793e0e5", size = 239833, upload-time = "2025-10-06T05:36:34.947Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/4e/e5c02187cf704224f8b21bee886f3d713ca379535f16893233b9d672ea71/frozenlist-1.8.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:29548f9b5b5e3460ce7378144c3010363d8035cea44bc0bf02d57f5a685e084e", size = 245363, upload-time = "2025-10-06T05:36:36.534Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/96/cb85ec608464472e82ad37a17f844889c36100eed57bea094518bf270692/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ec3cc8c5d4084591b4237c0a272cc4f50a5b03396a47d9caaf76f5d7b38a4f11", size = 229314, upload-time = "2025-10-06T05:36:38.582Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/6f/4ae69c550e4cee66b57887daeebe006fe985917c01d0fff9caab9883f6d0/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:517279f58009d0b1f2e7c1b130b377a349405da3f7621ed6bfae50b10adf20c1", size = 243365, upload-time = "2025-10-06T05:36:40.152Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/58/afd56de246cf11780a40a2c28dc7cbabbf06337cc8ddb1c780a2d97e88d8/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:db1e72ede2d0d7ccb213f218df6a078a9c09a7de257c2fe8fcef16d5925230b1", size = 237763, upload-time = "2025-10-06T05:36:41.355Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/36/cdfaf6ed42e2644740d4a10452d8e97fa1c062e2a8006e4b09f1b5fd7d63/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:b4dec9482a65c54a5044486847b8a66bf10c9cb4926d42927ec4e8fd5db7fed8", size = 240110, upload-time = "2025-10-06T05:36:42.716Z" },
+    { url = "https://files.pythonhosted.org/packages/03/a8/9ea226fbefad669f11b52e864c55f0bd57d3c8d7eb07e9f2e9a0b39502e1/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:21900c48ae04d13d416f0e1e0c4d81f7931f73a9dfa0b7a8746fb2fe7dd970ed", size = 233717, upload-time = "2025-10-06T05:36:44.251Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/0b/1b5531611e83ba7d13ccc9988967ea1b51186af64c42b7a7af465dcc9568/frozenlist-1.8.0-cp313-cp313-win32.whl", hash = "sha256:8b7b94a067d1c504ee0b16def57ad5738701e4ba10cec90529f13fa03c833496", size = 39628, upload-time = "2025-10-06T05:36:45.423Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/cf/174c91dbc9cc49bc7b7aab74d8b734e974d1faa8f191c74af9b7e80848e6/frozenlist-1.8.0-cp313-cp313-win_amd64.whl", hash = "sha256:878be833caa6a3821caf85eb39c5ba92d28e85df26d57afb06b35b2efd937231", size = 43882, upload-time = "2025-10-06T05:36:46.796Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/17/502cd212cbfa96eb1388614fe39a3fc9ab87dbbe042b66f97acb57474834/frozenlist-1.8.0-cp313-cp313-win_arm64.whl", hash = "sha256:44389d135b3ff43ba8cc89ff7f51f5a0bb6b63d829c8300f79a2fe4fe61bcc62", size = 39676, upload-time = "2025-10-06T05:36:47.8Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/5c/3bbfaa920dfab09e76946a5d2833a7cbdf7b9b4a91c714666ac4855b88b4/frozenlist-1.8.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:e25ac20a2ef37e91c1b39938b591457666a0fa835c7783c3a8f33ea42870db94", size = 89235, upload-time = "2025-10-06T05:36:48.78Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/d6/f03961ef72166cec1687e84e8925838442b615bd0b8854b54923ce5b7b8a/frozenlist-1.8.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:07cdca25a91a4386d2e76ad992916a85038a9b97561bf7a3fd12d5d9ce31870c", size = 50742, upload-time = "2025-10-06T05:36:49.837Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/bb/a6d12b7ba4c3337667d0e421f7181c82dda448ce4e7ad7ecd249a16fa806/frozenlist-1.8.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4e0c11f2cc6717e0a741f84a527c52616140741cd812a50422f83dc31749fb52", size = 51725, upload-time = "2025-10-06T05:36:50.851Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/71/d1fed0ffe2c2ccd70b43714c6cab0f4188f09f8a67a7914a6b46ee30f274/frozenlist-1.8.0-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:b3210649ee28062ea6099cfda39e147fa1bc039583c8ee4481cb7811e2448c51", size = 284533, upload-time = "2025-10-06T05:36:51.898Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/1f/fb1685a7b009d89f9bf78a42d94461bc06581f6e718c39344754a5d9bada/frozenlist-1.8.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:581ef5194c48035a7de2aefc72ac6539823bb71508189e5de01d60c9dcd5fa65", size = 292506, upload-time = "2025-10-06T05:36:53.101Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/3b/b991fe1612703f7e0d05c0cf734c1b77aaf7c7d321df4572e8d36e7048c8/frozenlist-1.8.0-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3ef2d026f16a2b1866e1d86fc4e1291e1ed8a387b2c333809419a2f8b3a77b82", size = 274161, upload-time = "2025-10-06T05:36:54.309Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/ec/c5c618767bcdf66e88945ec0157d7f6c4a1322f1473392319b7a2501ded7/frozenlist-1.8.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5500ef82073f599ac84d888e3a8c1f77ac831183244bfd7f11eaa0289fb30714", size = 294676, upload-time = "2025-10-06T05:36:55.566Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/ce/3934758637d8f8a88d11f0585d6495ef54b2044ed6ec84492a91fa3b27aa/frozenlist-1.8.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:50066c3997d0091c411a66e710f4e11752251e6d2d73d70d8d5d4c76442a199d", size = 300638, upload-time = "2025-10-06T05:36:56.758Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/4f/a7e4d0d467298f42de4b41cbc7ddaf19d3cfeabaf9ff97c20c6c7ee409f9/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:5c1c8e78426e59b3f8005e9b19f6ff46e5845895adbde20ece9218319eca6506", size = 283067, upload-time = "2025-10-06T05:36:57.965Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/48/c7b163063d55a83772b268e6d1affb960771b0e203b632cfe09522d67ea5/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:eefdba20de0d938cec6a89bd4d70f346a03108a19b9df4248d3cf0d88f1b0f51", size = 292101, upload-time = "2025-10-06T05:36:59.237Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/d0/2366d3c4ecdc2fd391e0afa6e11500bfba0ea772764d631bbf82f0136c9d/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:cf253e0e1c3ceb4aaff6df637ce033ff6535fb8c70a764a8f46aafd3d6ab798e", size = 289901, upload-time = "2025-10-06T05:37:00.811Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/94/daff920e82c1b70e3618a2ac39fbc01ae3e2ff6124e80739ce5d71c9b920/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:032efa2674356903cd0261c4317a561a6850f3ac864a63fc1583147fb05a79b0", size = 289395, upload-time = "2025-10-06T05:37:02.115Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/20/bba307ab4235a09fdcd3cc5508dbabd17c4634a1af4b96e0f69bfe551ebd/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:6da155091429aeba16851ecb10a9104a108bcd32f6c1642867eadaee401c1c41", size = 283659, upload-time = "2025-10-06T05:37:03.711Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/00/04ca1c3a7a124b6de4f8a9a17cc2fcad138b4608e7a3fc5877804b8715d7/frozenlist-1.8.0-cp313-cp313t-win32.whl", hash = "sha256:0f96534f8bfebc1a394209427d0f8a63d343c9779cda6fc25e8e121b5fd8555b", size = 43492, upload-time = "2025-10-06T05:37:04.915Z" },
+    { url = "https://files.pythonhosted.org/packages/59/5e/c69f733a86a94ab10f68e496dc6b7e8bc078ebb415281d5698313e3af3a1/frozenlist-1.8.0-cp313-cp313t-win_amd64.whl", hash = "sha256:5d63a068f978fc69421fb0e6eb91a9603187527c86b7cd3f534a5b77a592b888", size = 48034, upload-time = "2025-10-06T05:37:06.343Z" },
+    { url = "https://files.pythonhosted.org/packages/16/6c/be9d79775d8abe79b05fa6d23da99ad6e7763a1d080fbae7290b286093fd/frozenlist-1.8.0-cp313-cp313t-win_arm64.whl", hash = "sha256:bf0a7e10b077bf5fb9380ad3ae8ce20ef919a6ad93b4552896419ac7e1d8e042", size = 41749, upload-time = "2025-10-06T05:37:07.431Z" },
     { url = "https://files.pythonhosted.org/packages/9a/9a/e35b4a917281c0b8419d4207f4334c8e8c5dbf4f3f5f9ada73958d937dcc/frozenlist-1.8.0-py3-none-any.whl", hash = "sha256:0c18a16eab41e82c295618a77502e17b195883241c563b00f0aa5106fc4eaa0d", size = 13409, upload-time = "2025-10-06T05:38:16.721Z" },
 ]
 
@@ -2380,6 +2501,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/2b/24/e581ffed864cd33c1b445b5763d617448ebb880f48675fc9de0471a95cbc/lazy_object_proxy-1.12.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c4fcbe74fb85df8ba7825fa05eddca764138da752904b378f0ae5ab33a36c308", size = 69329, upload-time = "2025-08-22T13:42:41.311Z" },
     { url = "https://files.pythonhosted.org/packages/78/be/15f8f5a0b0b2e668e756a152257d26370132c97f2f1943329b08f057eff0/lazy_object_proxy-1.12.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:563d2ec8e4d4b68ee7848c5ab4d6057a6d703cb7963b342968bb8758dda33a23", size = 70690, upload-time = "2025-08-22T13:42:42.51Z" },
     { url = "https://files.pythonhosted.org/packages/5d/aa/f02be9bbfb270e13ee608c2b28b8771f20a5f64356c6d9317b20043c6129/lazy_object_proxy-1.12.0-cp312-cp312-win_amd64.whl", hash = "sha256:53c7fd99eb156bbb82cbc5d5188891d8fdd805ba6c1e3b92b90092da2a837073", size = 26563, upload-time = "2025-08-22T13:42:43.685Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/26/b74c791008841f8ad896c7f293415136c66cc27e7c7577de4ee68040c110/lazy_object_proxy-1.12.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:86fd61cb2ba249b9f436d789d1356deae69ad3231dc3c0f17293ac535162672e", size = 26745, upload-time = "2025-08-22T13:42:44.982Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/52/641870d309e5d1fb1ea7d462a818ca727e43bfa431d8c34b173eb090348c/lazy_object_proxy-1.12.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:81d1852fb30fab81696f93db1b1e55a5d1ff7940838191062f5f56987d5fcc3e", size = 71537, upload-time = "2025-08-22T13:42:46.141Z" },
+    { url = "https://files.pythonhosted.org/packages/47/b6/919118e99d51c5e76e8bf5a27df406884921c0acf2c7b8a3b38d847ab3e9/lazy_object_proxy-1.12.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:be9045646d83f6c2664c1330904b245ae2371b5c57a3195e4028aedc9f999655", size = 71141, upload-time = "2025-08-22T13:42:47.375Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/47/1d20e626567b41de085cf4d4fb3661a56c159feaa73c825917b3b4d4f806/lazy_object_proxy-1.12.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:67f07ab742f1adfb3966c40f630baaa7902be4222a17941f3d85fd1dae5565ff", size = 69449, upload-time = "2025-08-22T13:42:48.49Z" },
+    { url = "https://files.pythonhosted.org/packages/58/8d/25c20ff1a1a8426d9af2d0b6f29f6388005fc8cd10d6ee71f48bff86fdd0/lazy_object_proxy-1.12.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:75ba769017b944fcacbf6a80c18b2761a1795b03f8899acdad1f1c39db4409be", size = 70744, upload-time = "2025-08-22T13:42:49.608Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/67/8ec9abe15c4f8a4bcc6e65160a2c667240d025cbb6591b879bea55625263/lazy_object_proxy-1.12.0-cp313-cp313-win_amd64.whl", hash = "sha256:7b22c2bbfb155706b928ac4d74c1a63ac8552a55ba7fff4445155523ea4067e1", size = 26568, upload-time = "2025-08-22T13:42:57.719Z" },
+    { url = "https://files.pythonhosted.org/packages/23/12/cd2235463f3469fd6c62d41d92b7f120e8134f76e52421413a0ad16d493e/lazy_object_proxy-1.12.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4a79b909aa16bde8ae606f06e6bbc9d3219d2e57fb3e0076e17879072b742c65", size = 27391, upload-time = "2025-08-22T13:42:50.62Z" },
+    { url = "https://files.pythonhosted.org/packages/60/9e/f1c53e39bbebad2e8609c67d0830cc275f694d0ea23d78e8f6db526c12d3/lazy_object_proxy-1.12.0-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:338ab2f132276203e404951205fe80c3fd59429b3a724e7b662b2eb539bb1be9", size = 80552, upload-time = "2025-08-22T13:42:51.731Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/b6/6c513693448dcb317d9d8c91d91f47addc09553613379e504435b4cc8b3e/lazy_object_proxy-1.12.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8c40b3c9faee2e32bfce0df4ae63f4e73529766893258eca78548bac801c8f66", size = 82857, upload-time = "2025-08-22T13:42:53.225Z" },
+    { url = "https://files.pythonhosted.org/packages/12/1c/d9c4aaa4c75da11eb7c22c43d7c90a53b4fca0e27784a5ab207768debea7/lazy_object_proxy-1.12.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:717484c309df78cedf48396e420fa57fc8a2b1f06ea889df7248fdd156e58847", size = 80833, upload-time = "2025-08-22T13:42:54.391Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/ae/29117275aac7d7d78ae4f5a4787f36ff33262499d486ac0bf3e0b97889f6/lazy_object_proxy-1.12.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:a6b7ea5ea1ffe15059eb44bcbcb258f97bcb40e139b88152c40d07b1a1dfc9ac", size = 79516, upload-time = "2025-08-22T13:42:55.812Z" },
+    { url = "https://files.pythonhosted.org/packages/19/40/b4e48b2c38c69392ae702ae7afa7b6551e0ca5d38263198b7c79de8b3bdf/lazy_object_proxy-1.12.0-cp313-cp313t-win_amd64.whl", hash = "sha256:08c465fb5cd23527512f9bd7b4c7ba6cec33e28aad36fbbe46bf7b858f9f3f7f", size = 27656, upload-time = "2025-08-22T13:42:56.793Z" },
     { url = "https://files.pythonhosted.org/packages/41/a0/b91504515c1f9a299fc157967ffbd2f0321bce0516a3d5b89f6f4cad0355/lazy_object_proxy-1.12.0-pp39.pp310.pp311.graalpy311-none-any.whl", hash = "sha256:c3b2e0af1f7f77c4263759c4824316ce458fabe0fceadcd24ef8ca08b2d1e402", size = 15072, upload-time = "2025-08-22T13:50:05.498Z" },
 ]
 
@@ -2413,6 +2546,22 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b2/e7/d667d337367686311c38b580d1ca3d5a23a6617e129f26becd4f5dc458df/lz4-4.4.5-cp312-cp312-win32.whl", hash = "sha256:214e37cfe270948ea7eb777229e211c601a3e0875541c1035ab408fbceaddf50", size = 88189, upload-time = "2025-11-03T13:01:52.605Z" },
     { url = "https://files.pythonhosted.org/packages/a5/0b/a54cd7406995ab097fceb907c7eb13a6ddd49e0b231e448f1a81a50af65c/lz4-4.4.5-cp312-cp312-win_amd64.whl", hash = "sha256:713a777de88a73425cf08eb11f742cd2c98628e79a8673d6a52e3c5f0c116f33", size = 99497, upload-time = "2025-11-03T13:01:53.477Z" },
     { url = "https://files.pythonhosted.org/packages/6a/7e/dc28a952e4bfa32ca16fa2eb026e7a6ce5d1411fcd5986cd08c74ec187b9/lz4-4.4.5-cp312-cp312-win_arm64.whl", hash = "sha256:a88cbb729cc333334ccfb52f070463c21560fca63afcf636a9f160a55fac3301", size = 91279, upload-time = "2025-11-03T13:01:54.419Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/46/08fd8ef19b782f301d56a9ccfd7dafec5fd4fc1a9f017cf22a1accb585d7/lz4-4.4.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:6bb05416444fafea170b07181bc70640975ecc2a8c92b3b658c554119519716c", size = 207171, upload-time = "2025-11-03T13:01:56.595Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/3f/ea3334e59de30871d773963997ecdba96c4584c5f8007fd83cfc8f1ee935/lz4-4.4.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:b424df1076e40d4e884cfcc4c77d815368b7fb9ebcd7e634f937725cd9a8a72a", size = 207163, upload-time = "2025-11-03T13:01:57.721Z" },
+    { url = "https://files.pythonhosted.org/packages/41/7b/7b3a2a0feb998969f4793c650bb16eff5b06e80d1f7bff867feb332f2af2/lz4-4.4.5-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:216ca0c6c90719731c64f41cfbd6f27a736d7e50a10b70fad2a9c9b262ec923d", size = 1292136, upload-time = "2025-11-03T13:02:00.375Z" },
+    { url = "https://files.pythonhosted.org/packages/89/d1/f1d259352227bb1c185288dd694121ea303e43404aa77560b879c90e7073/lz4-4.4.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:533298d208b58b651662dd972f52d807d48915176e5b032fb4f8c3b6f5fe535c", size = 1279639, upload-time = "2025-11-03T13:02:01.649Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/fb/ba9256c48266a09012ed1d9b0253b9aa4fe9cdff094f8febf5b26a4aa2a2/lz4-4.4.5-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:451039b609b9a88a934800b5fc6ee401c89ad9c175abf2f4d9f8b2e4ef1afc64", size = 1368257, upload-time = "2025-11-03T13:02:03.35Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/6d/dee32a9430c8b0e01bbb4537573cabd00555827f1a0a42d4e24ca803935c/lz4-4.4.5-cp313-cp313-win32.whl", hash = "sha256:a5f197ffa6fc0e93207b0af71b302e0a2f6f29982e5de0fbda61606dd3a55832", size = 88191, upload-time = "2025-11-03T13:02:04.406Z" },
+    { url = "https://files.pythonhosted.org/packages/18/e0/f06028aea741bbecb2a7e9648f4643235279a770c7ffaf70bd4860c73661/lz4-4.4.5-cp313-cp313-win_amd64.whl", hash = "sha256:da68497f78953017deb20edff0dba95641cc86e7423dfadf7c0264e1ac60dc22", size = 99502, upload-time = "2025-11-03T13:02:05.886Z" },
+    { url = "https://files.pythonhosted.org/packages/61/72/5bef44afb303e56078676b9f2486f13173a3c1e7f17eaac1793538174817/lz4-4.4.5-cp313-cp313-win_arm64.whl", hash = "sha256:c1cfa663468a189dab510ab231aad030970593f997746d7a324d40104db0d0a9", size = 91285, upload-time = "2025-11-03T13:02:06.77Z" },
+    { url = "https://files.pythonhosted.org/packages/49/55/6a5c2952971af73f15ed4ebfdd69774b454bd0dc905b289082ca8664fba1/lz4-4.4.5-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:67531da3b62f49c939e09d56492baf397175ff39926d0bd5bd2d191ac2bff95f", size = 207348, upload-time = "2025-11-03T13:02:08.117Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/d7/fd62cbdbdccc35341e83aabdb3f6d5c19be2687d0a4eaf6457ddf53bba64/lz4-4.4.5-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:a1acbbba9edbcbb982bc2cac5e7108f0f553aebac1040fbec67a011a45afa1ba", size = 207340, upload-time = "2025-11-03T13:02:09.152Z" },
+    { url = "https://files.pythonhosted.org/packages/77/69/225ffadaacb4b0e0eb5fd263541edd938f16cd21fe1eae3cd6d5b6a259dc/lz4-4.4.5-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:a482eecc0b7829c89b498fda883dbd50e98153a116de612ee7c111c8bcf82d1d", size = 1293398, upload-time = "2025-11-03T13:02:10.272Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/9e/2ce59ba4a21ea5dc43460cba6f34584e187328019abc0e66698f2b66c881/lz4-4.4.5-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e099ddfaa88f59dd8d36c8a3c66bd982b4984edf127eb18e30bb49bdba68ce67", size = 1281209, upload-time = "2025-11-03T13:02:12.091Z" },
+    { url = "https://files.pythonhosted.org/packages/80/4f/4d946bd1624ec229b386a3bc8e7a85fa9a963d67d0a62043f0af0978d3da/lz4-4.4.5-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a2af2897333b421360fdcce895c6f6281dc3fab018d19d341cf64d043fc8d90d", size = 1369406, upload-time = "2025-11-03T13:02:13.683Z" },
+    { url = "https://files.pythonhosted.org/packages/02/a2/d429ba4720a9064722698b4b754fb93e42e625f1318b8fe834086c7c783b/lz4-4.4.5-cp313-cp313t-win32.whl", hash = "sha256:66c5de72bf4988e1b284ebdd6524c4bead2c507a2d7f172201572bac6f593901", size = 88325, upload-time = "2025-11-03T13:02:14.743Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/85/7ba10c9b97c06af6c8f7032ec942ff127558863df52d866019ce9d2425cf/lz4-4.4.5-cp313-cp313t-win_amd64.whl", hash = "sha256:cdd4bdcbaf35056086d910d219106f6a04e1ab0daa40ec0eeef1626c27d0fddb", size = 99643, upload-time = "2025-11-03T13:02:15.978Z" },
+    { url = "https://files.pythonhosted.org/packages/77/4d/a175459fb29f909e13e57c8f475181ad8085d8d7869bd8ad99033e3ee5fa/lz4-4.4.5-cp313-cp313t-win_arm64.whl", hash = "sha256:28ccaeb7c5222454cd5f60fcd152564205bcb801bd80e125949d2dfbadc76bbd", size = 91504, upload-time = "2025-11-03T13:02:17.313Z" },
 ]
 
 [[package]]
@@ -2475,6 +2624,28 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/2f/e1/78ee7a023dac597a5825441ebd17170785a9dab23de95d2c7508ade94e0e/markupsafe-3.0.3-cp312-cp312-win32.whl", hash = "sha256:d88b440e37a16e651bda4c7c2b930eb586fd15ca7406cb39e211fcff3bf3017d", size = 14540, upload-time = "2025-09-27T18:36:38.761Z" },
     { url = "https://files.pythonhosted.org/packages/aa/5b/bec5aa9bbbb2c946ca2733ef9c4ca91c91b6a24580193e891b5f7dbe8e1e/markupsafe-3.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:26a5784ded40c9e318cfc2bdb30fe164bdb8665ded9cd64d500a34fb42067b1c", size = 15105, upload-time = "2025-09-27T18:36:39.701Z" },
     { url = "https://files.pythonhosted.org/packages/e5/f1/216fc1bbfd74011693a4fd837e7026152e89c4bcf3e77b6692fba9923123/markupsafe-3.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:35add3b638a5d900e807944a078b51922212fb3dedb01633a8defc4b01a3c85f", size = 13906, upload-time = "2025-09-27T18:36:40.689Z" },
+    { url = "https://files.pythonhosted.org/packages/38/2f/907b9c7bbba283e68f20259574b13d005c121a0fa4c175f9bed27c4597ff/markupsafe-3.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795", size = 11622, upload-time = "2025-09-27T18:36:41.777Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/d9/5f7756922cdd676869eca1c4e3c0cd0df60ed30199ffd775e319089cb3ed/markupsafe-3.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219", size = 12029, upload-time = "2025-09-27T18:36:43.257Z" },
+    { url = "https://files.pythonhosted.org/packages/00/07/575a68c754943058c78f30db02ee03a64b3c638586fba6a6dd56830b30a3/markupsafe-3.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6", size = 24374, upload-time = "2025-09-27T18:36:44.508Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/21/9b05698b46f218fc0e118e1f8168395c65c8a2c750ae2bab54fc4bd4e0e8/markupsafe-3.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676", size = 22980, upload-time = "2025-09-27T18:36:45.385Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/71/544260864f893f18b6827315b988c146b559391e6e7e8f7252839b1b846a/markupsafe-3.0.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9", size = 21990, upload-time = "2025-09-27T18:36:46.916Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/28/b50fc2f74d1ad761af2f5dcce7492648b983d00a65b8c0e0cb457c82ebbe/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1", size = 23784, upload-time = "2025-09-27T18:36:47.884Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/76/104b2aa106a208da8b17a2fb72e033a5a9d7073c68f7e508b94916ed47a9/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc", size = 21588, upload-time = "2025-09-27T18:36:48.82Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/99/16a5eb2d140087ebd97180d95249b00a03aa87e29cc224056274f2e45fd6/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12", size = 23041, upload-time = "2025-09-27T18:36:49.797Z" },
+    { url = "https://files.pythonhosted.org/packages/19/bc/e7140ed90c5d61d77cea142eed9f9c303f4c4806f60a1044c13e3f1471d0/markupsafe-3.0.3-cp313-cp313-win32.whl", hash = "sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed", size = 14543, upload-time = "2025-09-27T18:36:51.584Z" },
+    { url = "https://files.pythonhosted.org/packages/05/73/c4abe620b841b6b791f2edc248f556900667a5a1cf023a6646967ae98335/markupsafe-3.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5", size = 15113, upload-time = "2025-09-27T18:36:52.537Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/3a/fa34a0f7cfef23cf9500d68cb7c32dd64ffd58a12b09225fb03dd37d5b80/markupsafe-3.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485", size = 13911, upload-time = "2025-09-27T18:36:53.513Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/d7/e05cd7efe43a88a17a37b3ae96e79a19e846f3f456fe79c57ca61356ef01/markupsafe-3.0.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73", size = 11658, upload-time = "2025-09-27T18:36:54.819Z" },
+    { url = "https://files.pythonhosted.org/packages/99/9e/e412117548182ce2148bdeacdda3bb494260c0b0184360fe0d56389b523b/markupsafe-3.0.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37", size = 12066, upload-time = "2025-09-27T18:36:55.714Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/e6/fa0ffcda717ef64a5108eaa7b4f5ed28d56122c9a6d70ab8b72f9f715c80/markupsafe-3.0.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19", size = 25639, upload-time = "2025-09-27T18:36:56.908Z" },
+    { url = "https://files.pythonhosted.org/packages/96/ec/2102e881fe9d25fc16cb4b25d5f5cde50970967ffa5dddafdb771237062d/markupsafe-3.0.3-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025", size = 23569, upload-time = "2025-09-27T18:36:57.913Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/30/6f2fce1f1f205fc9323255b216ca8a235b15860c34b6798f810f05828e32/markupsafe-3.0.3-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6", size = 23284, upload-time = "2025-09-27T18:36:58.833Z" },
+    { url = "https://files.pythonhosted.org/packages/58/47/4a0ccea4ab9f5dcb6f79c0236d954acb382202721e704223a8aafa38b5c8/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f", size = 24801, upload-time = "2025-09-27T18:36:59.739Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/70/3780e9b72180b6fecb83a4814d84c3bf4b4ae4bf0b19c27196104149734c/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb", size = 22769, upload-time = "2025-09-27T18:37:00.719Z" },
+    { url = "https://files.pythonhosted.org/packages/98/c5/c03c7f4125180fc215220c035beac6b9cb684bc7a067c84fc69414d315f5/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009", size = 23642, upload-time = "2025-09-27T18:37:01.673Z" },
+    { url = "https://files.pythonhosted.org/packages/80/d6/2d1b89f6ca4bff1036499b1e29a1d02d282259f3681540e16563f27ebc23/markupsafe-3.0.3-cp313-cp313t-win32.whl", hash = "sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354", size = 14612, upload-time = "2025-09-27T18:37:02.639Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/98/e48a4bfba0a0ffcf9925fe2d69240bfaa19c6f7507b8cd09c70684a53c1e/markupsafe-3.0.3-cp313-cp313t-win_amd64.whl", hash = "sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218", size = 15200, upload-time = "2025-09-27T18:37:03.582Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/72/e3cc540f351f316e9ed0f092757459afbc595824ca724cbc5a5d4263713f/markupsafe-3.0.3-cp313-cp313t-win_arm64.whl", hash = "sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287", size = 13973, upload-time = "2025-09-27T18:37:04.929Z" },
 ]
 
 [[package]]
@@ -2497,21 +2668,21 @@ wheels = [
 
 [[package]]
 name = "microsoft-kiota-abstractions"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "opentelemetry-api" },
     { name = "opentelemetry-sdk" },
     { name = "std-uritemplate" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/fa/42/e9ddbdf6c2c772651e09ad74bd28dbf1c11e3f54bbb7cdb88ce57959f7c3/microsoft_kiota_abstractions-1.9.2.tar.gz", hash = "sha256:29cdafe8d0672f23099556e0b120dca6231c752cca9393e1e0092fa9ca594572", size = 24456, upload-time = "2025-02-06T13:12:37.979Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8f/94/37315b82a1bcc08145e5bc2af7396a4be8160ac138ec269611c3b9589b7a/microsoft_kiota_abstractions-1.9.9.tar.gz", hash = "sha256:5df9a8e0517a4568726c2cac6d9789284cc6ffa66043b68eba42ae55749fb861", size = 24468, upload-time = "2026-03-02T21:03:50.133Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4c/29/5d2f55d5925236e7c4c1a1b521567bc89ecf0b439354eae0f10e7f10aba2/microsoft_kiota_abstractions-1.9.2-py3-none-any.whl", hash = "sha256:a8853d272a84da59d6a2fe11a76c28e9c55bdab268a345ba48e918cb6822b607", size = 44411, upload-time = "2025-02-06T13:12:36.093Z" },
+    { url = "https://files.pythonhosted.org/packages/53/6a/7d5a1a8131f0eccc6b45839c091aa00ba29661854e7defaa7936cf342fa7/microsoft_kiota_abstractions-1.9.9-py3-none-any.whl", hash = "sha256:8d0a14eda42f3f0ccac2e9512227a338f69998dc9b782fd21cb8ca7c48302caa", size = 44453, upload-time = "2026-03-02T21:03:51.11Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-authentication-azure"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohttp" },
@@ -2520,14 +2691,14 @@ dependencies = [
     { name = "opentelemetry-api" },
     { name = "opentelemetry-sdk" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/97/bc/91b07dd6923f351afaa3121d12eab99a49f4da8128975fc8eefc1d1bef9b/microsoft_kiota_authentication_azure-1.9.2.tar.gz", hash = "sha256:171045f522a93d9340fbddc4cabb218f14f1d9d289e82e535b3d9291986c3d5a", size = 4986, upload-time = "2025-02-06T13:12:47.76Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ca/ce/5ae8b37ee4a50f0ed5e092c2d0105d60b592e6102a190959f76658a0994c/microsoft_kiota_authentication_azure-1.9.9.tar.gz", hash = "sha256:aca5e7dc8a0a28224f9025a479349ac2f9aaf166bfd6bc707f232658b45eec28", size = 5000, upload-time = "2026-03-02T21:04:02.355Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/31/91/30a29f828b40d85c0bcef803fafbca6a30761fe5cef451dee0e6ad95a74a/microsoft_kiota_authentication_azure-1.9.2-py3-none-any.whl", hash = "sha256:56840f8b15df8aedfd143fb2deb7cc7fae4ac0bafb1a50546b7313a7b3ab4ca0", size = 6908, upload-time = "2025-02-06T13:12:46.153Z" },
+    { url = "https://files.pythonhosted.org/packages/98/de/dc504324b776d00a420886cc6f39e04be2cf48cab0e9b18f8450a5efcc29/microsoft_kiota_authentication_azure-1.9.9-py3-none-any.whl", hash = "sha256:73dc21a1a2861ea78a135327291db3322e2255542a18b311dd03fd908342e902", size = 6951, upload-time = "2026-03-02T21:04:03.18Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-http"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "httpx", extra = ["http2"] },
@@ -2535,57 +2706,57 @@ dependencies = [
     { name = "opentelemetry-api" },
     { name = "opentelemetry-sdk" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5d/f3/4738613a6711917a1b4f829c962f3ce09a286c12a1037dc0fd666a9f4ad7/microsoft_kiota_http-1.9.2.tar.gz", hash = "sha256:2ba3d04a3d1d5d600736eebc1e33533d54d87799ac4fbb92c9cce4a97809af61", size = 21205, upload-time = "2025-02-06T13:12:56.783Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5d/3f/fc18eb0d1d845daf6355fd54fd990af7f7e10043ef6a6da39b9e5981cbaf/microsoft_kiota_http-1.9.9.tar.gz", hash = "sha256:ae672b145df71b644f8da0951767a12a4ce47a40576d86eba19b7c22d9e160f9", size = 21493, upload-time = "2026-03-02T21:04:11.662Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/95/2d/1b23c6f3c3fd1bbf065c11cdb66f59ccefcfed7bae0b7de9adb260260e05/microsoft_kiota_http-1.9.2-py3-none-any.whl", hash = "sha256:3a2d930a70d0184d9f4848473f929ee892462cae1acfaf33b2d193f1828c76c2", size = 31507, upload-time = "2025-02-06T13:12:55.022Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/6a/cc1b1055b4b6d4dfc1be7a71917c2f0ef19c070c6a18b16d3c1032d20925/microsoft_kiota_http-1.9.9-py3-none-any.whl", hash = "sha256:a5b1b217ac9afeb4054f12515417e3b1d2be12a9385a70a41d18d64379ea2e7e", size = 31945, upload-time = "2026-03-02T21:04:12.328Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-serialization-form"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5d/51/ddbed9c6a3d7197c94d03d5a71bd01181fa0e6051b5919ca81e116061a30/microsoft_kiota_serialization_form-1.9.2.tar.gz", hash = "sha256:badfbe65d8ec3369bd58b01022d13ef590edf14babeef94188efe3f4ec24fe41", size = 8987, upload-time = "2025-02-06T13:13:07.425Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/b4/18e9fce60a30c8b6ea0a6278fb81cf352127340d48df2d7c52ff1b579488/microsoft_kiota_serialization_form-1.9.9.tar.gz", hash = "sha256:3cdc8b172baec5b5282af72f2ce02715edcd23252ce0b5af96075256edd75114", size = 9015, upload-time = "2026-03-02T21:04:20.39Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/68/e1/5cd5f6c636f9913ccf9143fc78f61563cecdf3c268a5d0743d3da26e3add/microsoft_kiota_serialization_form-1.9.2-py3-none-any.whl", hash = "sha256:7b997efb2c8750b1d4fbc00878ba2a3e6e1df3fcefc8815226c90fcc9c54f218", size = 10664, upload-time = "2025-02-06T13:13:04.482Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/24/eb8436b882f1473bd0a868848d214df3df2d9b3db8e5422d111032f1114f/microsoft_kiota_serialization_form-1.9.9-py3-none-any.whl", hash = "sha256:1c426d4f0d463fc9215c41d7fa0f3dc5fe8d3c80573d555cf63ea67000148d84", size = 10718, upload-time = "2026-03-02T21:04:21.25Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-serialization-json"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/7d/ea/fee81f1cb68d5163573294935311a9c45d7da7dc08aa4acd86690ddafdcb/microsoft_kiota_serialization_json-1.9.2.tar.gz", hash = "sha256:19f7beb69c67b2cb77ca96f77824ee78a693929e20237bb5476ea54f69118bf1", size = 9345, upload-time = "2025-02-06T13:13:15.582Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b8/2f/d36eba916c00136da122d1701acb862c5b1f2e22b6dc6fa4e0f4abda2786/microsoft_kiota_serialization_json-1.9.9.tar.gz", hash = "sha256:9b27479427f49bbac15ead8e8ff0176e47fcdf81153611acc408f5f399342079", size = 9545, upload-time = "2026-03-02T21:04:29.177Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/95/1a/30dbe36cbd3f5d55d63f7ba086d51e90875806723a336e4782b17df80541/microsoft_kiota_serialization_json-1.9.2-py3-none-any.whl", hash = "sha256:8f4ecf485607fff3df5ce8fa9b9c957bc7f4bff1658b183703e180af753098e3", size = 10963, upload-time = "2025-02-06T13:13:14.351Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/7b/b3f606ef2dcbdebe12ae27004ed6e7542370cb2494265f11a8877a1de2d1/microsoft_kiota_serialization_json-1.9.9-py3-none-any.whl", hash = "sha256:bb80b93e81bab41dc142e9b254f79bf0b7b9fe49a796ca0c8e8691925bd3967f", size = 11210, upload-time = "2026-03-02T21:04:29.844Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-serialization-multipart"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d0/10/a8ea0a0f58bbc79c5f22bf868f10eac9f505f092e3f72ba1f050ab13316c/microsoft_kiota_serialization_multipart-1.9.2.tar.gz", hash = "sha256:b1851409205668d83f5c7a35a8b6fca974b341985b4a92841e95aaec93b7ca0a", size = 5152, upload-time = "2025-02-06T13:13:37.39Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5f/44/24087f0fac7c5682c13c7fb61468a0c5a5185b9f243de3a99309aa6fcaa7/microsoft_kiota_serialization_multipart-1.9.9.tar.gz", hash = "sha256:f8730be6da5f6c63a6bf4ea310a9723b9998a47a04745887dc156d08f119a829", size = 5162, upload-time = "2026-03-02T21:04:48.1Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ca/2a/2109bbf9865685bbedf756b8b8a25284c366870496f8fe3a5a0ee7c476f5/microsoft_kiota_serialization_multipart-1.9.2-py3-none-any.whl", hash = "sha256:641ad374046f1c7adff90d110bdc68d77418adb1e479a716f4ffea3647f0ead6", size = 6649, upload-time = "2025-02-06T13:13:34.579Z" },
+    { url = "https://files.pythonhosted.org/packages/61/db/6b988fdf771c3d07dff4a116176d575832daf2a43823444d145d71da5b61/microsoft_kiota_serialization_multipart-1.9.9-py3-none-any.whl", hash = "sha256:572e9cbafa2eb946452cdadfb019a4e9245768c0d61c3089d3436d4f5106c550", size = 6696, upload-time = "2026-03-02T21:04:48.98Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-serialization-text"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/81/20/aac457a8a0ce90510dc82ca5ba0d80484aeaf87d75d08ebefcbb81373683/microsoft_kiota_serialization_text-1.9.2.tar.gz", hash = "sha256:4289508ebac0cefdc4fa21c545051769a9409913972355ccda9116b647f978f2", size = 7306, upload-time = "2025-02-06T13:13:25.045Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a3/3c/d244ad08e03003134871698aa54de8243bcc61c0faf3ab114293bb76d6ad/microsoft_kiota_serialization_text-1.9.9.tar.gz", hash = "sha256:18bc0764dda4078a4c953300253344e05d0cdb9c17136f1a2f695d438cedb402", size = 7325, upload-time = "2026-03-02T21:04:37.567Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5a/3a/81c75a275183ceadfd3b87731adff69ebb46c5f43b8617c88375a53808e5/microsoft_kiota_serialization_text-1.9.2-py3-none-any.whl", hash = "sha256:6e63129ea29eb9b976f4ed56fc6595d204e29fc309958b639299e9f9f4e5edb4", size = 8840, upload-time = "2025-02-06T13:13:22.997Z" },
+    { url = "https://files.pythonhosted.org/packages/37/f8/43f8d00fed6e090810d3ce0c05e06c23eaa5dee6e87ab1fb89d96ca9559f/microsoft_kiota_serialization_text-1.9.9-py3-none-any.whl", hash = "sha256:84418119d4929a76fde7f31e957e240e003bf145757838b9aa3a0f36dec1b789", size = 8885, upload-time = "2026-03-02T21:04:38.76Z" },
 ]
 
 [[package]]
@@ -2781,6 +2952,42 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ca/a4/840f5b97339e27846c46307f2530a2805d9d537d8b8bd416af031cad7fa0/multidict-6.7.1-cp312-cp312-win32.whl", hash = "sha256:28ca5ce2fd9716631133d0e9a9b9a745ad7f60bac2bccafb56aa380fc0b6c511", size = 41887, upload-time = "2026-01-26T02:44:14.245Z" },
     { url = "https://files.pythonhosted.org/packages/80/31/0b2517913687895f5904325c2069d6a3b78f66cc641a86a2baf75a05dcbb/multidict-6.7.1-cp312-cp312-win_amd64.whl", hash = "sha256:fcee94dfbd638784645b066074b338bc9cc155d4b4bffa4adce1615c5a426c19", size = 46053, upload-time = "2026-01-26T02:44:15.371Z" },
     { url = "https://files.pythonhosted.org/packages/0c/5b/aba28e4ee4006ae4c7df8d327d31025d760ffa992ea23812a601d226e682/multidict-6.7.1-cp312-cp312-win_arm64.whl", hash = "sha256:ba0a9fb644d0c1a2194cf7ffb043bd852cea63a57f66fbd33959f7dae18517bf", size = 43307, upload-time = "2026-01-26T02:44:16.852Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/22/929c141d6c0dba87d3e1d38fbdf1ba8baba86b7776469f2bc2d3227a1e67/multidict-6.7.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:2b41f5fed0ed563624f1c17630cb9941cf2309d4df00e494b551b5f3e3d67a23", size = 76174, upload-time = "2026-01-26T02:44:18.509Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/75/bc704ae15fee974f8fccd871305e254754167dce5f9e42d88a2def741a1d/multidict-6.7.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:84e61e3af5463c19b67ced91f6c634effb89ef8bfc5ca0267f954451ed4bb6a2", size = 45116, upload-time = "2026-01-26T02:44:19.745Z" },
+    { url = "https://files.pythonhosted.org/packages/79/76/55cd7186f498ed080a18440c9013011eb548f77ae1b297206d030eb1180a/multidict-6.7.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:935434b9853c7c112eee7ac891bc4cb86455aa631269ae35442cb316790c1445", size = 43524, upload-time = "2026-01-26T02:44:21.571Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/3c/414842ef8d5a1628d68edee29ba0e5bcf235dbfb3ccd3ea303a7fe8c72ff/multidict-6.7.1-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:432feb25a1cb67fe82a9680b4d65fb542e4635cb3166cd9c01560651ad60f177", size = 249368, upload-time = "2026-01-26T02:44:22.803Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/32/befed7f74c458b4a525e60519fe8d87eef72bb1e99924fa2b0f9d97a221e/multidict-6.7.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e82d14e3c948952a1a85503817e038cba5905a3352de76b9a465075d072fba23", size = 256952, upload-time = "2026-01-26T02:44:24.306Z" },
+    { url = "https://files.pythonhosted.org/packages/03/d6/c878a44ba877f366630c860fdf74bfb203c33778f12b6ac274936853c451/multidict-6.7.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:4cfb48c6ea66c83bcaaf7e4dfa7ec1b6bbcf751b7db85a328902796dfde4c060", size = 240317, upload-time = "2026-01-26T02:44:25.772Z" },
+    { url = "https://files.pythonhosted.org/packages/68/49/57421b4d7ad2e9e60e25922b08ceb37e077b90444bde6ead629095327a6f/multidict-6.7.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:1d540e51b7e8e170174555edecddbd5538105443754539193e3e1061864d444d", size = 267132, upload-time = "2026-01-26T02:44:27.648Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/fe/ec0edd52ddbcea2a2e89e174f0206444a61440b40f39704e64dc807a70bd/multidict-6.7.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:273d23f4b40f3dce4d6c8a821c741a86dec62cded82e1175ba3d99be128147ed", size = 268140, upload-time = "2026-01-26T02:44:29.588Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/73/6e1b01cbeb458807aa0831742232dbdd1fa92bfa33f52a3f176b4ff3dc11/multidict-6.7.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d624335fd4fa1c08a53f8b4be7676ebde19cd092b3895c421045ca87895b429", size = 254277, upload-time = "2026-01-26T02:44:30.902Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/b2/5fb8c124d7561a4974c342bc8c778b471ebbeb3cc17df696f034a7e9afe7/multidict-6.7.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:12fad252f8b267cc75b66e8fc51b3079604e8d43a75428ffe193cd9e2195dfd6", size = 252291, upload-time = "2026-01-26T02:44:32.31Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/96/51d4e4e06bcce92577fcd488e22600bd38e4fd59c20cb49434d054903bd2/multidict-6.7.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:03ede2a6ffbe8ef936b92cb4529f27f42be7f56afcdab5ab739cd5f27fb1cbf9", size = 250156, upload-time = "2026-01-26T02:44:33.734Z" },
+    { url = "https://files.pythonhosted.org/packages/db/6b/420e173eec5fba721a50e2a9f89eda89d9c98fded1124f8d5c675f7a0c0f/multidict-6.7.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:90efbcf47dbe33dcf643a1e400d67d59abeac5db07dc3f27d6bdeae497a2198c", size = 249742, upload-time = "2026-01-26T02:44:35.222Z" },
+    { url = "https://files.pythonhosted.org/packages/44/a3/ec5b5bd98f306bc2aa297b8c6f11a46714a56b1e6ef5ebda50a4f5d7c5fb/multidict-6.7.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:5c4b9bfc148f5a91be9244d6264c53035c8a0dcd2f51f1c3c6e30e30ebaa1c84", size = 262221, upload-time = "2026-01-26T02:44:36.604Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/f7/e8c0d0da0cd1e28d10e624604e1a36bcc3353aaebdfdc3a43c72bc683a12/multidict-6.7.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:401c5a650f3add2472d1d288c26deebc540f99e2fb83e9525007a74cd2116f1d", size = 258664, upload-time = "2026-01-26T02:44:38.008Z" },
+    { url = "https://files.pythonhosted.org/packages/52/da/151a44e8016dd33feed44f730bd856a66257c1ee7aed4f44b649fb7edeb3/multidict-6.7.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:97891f3b1b3ffbded884e2916cacf3c6fc87b66bb0dde46f7357404750559f33", size = 249490, upload-time = "2026-01-26T02:44:39.386Z" },
+    { url = "https://files.pythonhosted.org/packages/87/af/a3b86bf9630b732897f6fc3f4c4714b90aa4361983ccbdcd6c0339b21b0c/multidict-6.7.1-cp313-cp313-win32.whl", hash = "sha256:e1c5988359516095535c4301af38d8a8838534158f649c05dd1050222321bcb3", size = 41695, upload-time = "2026-01-26T02:44:41.318Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/35/e994121b0e90e46134673422dd564623f93304614f5d11886b1b3e06f503/multidict-6.7.1-cp313-cp313-win_amd64.whl", hash = "sha256:960c83bf01a95b12b08fd54324a4eb1d5b52c88932b5cba5d6e712bb3ed12eb5", size = 45884, upload-time = "2026-01-26T02:44:42.488Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/61/42d3e5dbf661242a69c97ea363f2d7b46c567da8eadef8890022be6e2ab0/multidict-6.7.1-cp313-cp313-win_arm64.whl", hash = "sha256:563fe25c678aaba333d5399408f5ec3c383ca5b663e7f774dd179a520b8144df", size = 43122, upload-time = "2026-01-26T02:44:43.664Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/b3/e6b21c6c4f314bb956016b0b3ef2162590a529b84cb831c257519e7fde44/multidict-6.7.1-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:c76c4bec1538375dad9d452d246ca5368ad6e1c9039dadcf007ae59c70619ea1", size = 83175, upload-time = "2026-01-26T02:44:44.894Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/76/23ecd2abfe0957b234f6c960f4ade497f55f2c16aeb684d4ecdbf1c95791/multidict-6.7.1-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:57b46b24b5d5ebcc978da4ec23a819a9402b4228b8a90d9c656422b4bdd8a963", size = 48460, upload-time = "2026-01-26T02:44:46.106Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/57/a0ed92b23f3a042c36bc4227b72b97eca803f5f1801c1ab77c8a212d455e/multidict-6.7.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:e954b24433c768ce78ab7929e84ccf3422e46deb45a4dc9f93438f8217fa2d34", size = 46930, upload-time = "2026-01-26T02:44:47.278Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/66/02ec7ace29162e447f6382c495dc95826bf931d3818799bbef11e8f7df1a/multidict-6.7.1-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:3bd231490fa7217cc832528e1cd8752a96f0125ddd2b5749390f7c3ec8721b65", size = 242582, upload-time = "2026-01-26T02:44:48.604Z" },
+    { url = "https://files.pythonhosted.org/packages/58/18/64f5a795e7677670e872673aca234162514696274597b3708b2c0d276cce/multidict-6.7.1-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:253282d70d67885a15c8a7716f3a73edf2d635793ceda8173b9ecc21f2fb8292", size = 250031, upload-time = "2026-01-26T02:44:50.544Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/ed/e192291dbbe51a8290c5686f482084d31bcd9d09af24f63358c3d42fd284/multidict-6.7.1-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:0b4c48648d7649c9335cf1927a8b87fa692de3dcb15faa676c6a6f1f1aabda43", size = 228596, upload-time = "2026-01-26T02:44:51.951Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/7e/3562a15a60cf747397e7f2180b0a11dc0c38d9175a650e75fa1b4d325e15/multidict-6.7.1-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:98bc624954ec4d2c7cb074b8eefc2b5d0ce7d482e410df446414355d158fe4ca", size = 257492, upload-time = "2026-01-26T02:44:53.902Z" },
+    { url = "https://files.pythonhosted.org/packages/24/02/7d0f9eae92b5249bb50ac1595b295f10e263dd0078ebb55115c31e0eaccd/multidict-6.7.1-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1b99af4d9eec0b49927b4402bcbb58dea89d3e0db8806a4086117019939ad3dd", size = 255899, upload-time = "2026-01-26T02:44:55.316Z" },
+    { url = "https://files.pythonhosted.org/packages/00/e3/9b60ed9e23e64c73a5cde95269ef1330678e9c6e34dd4eb6b431b85b5a10/multidict-6.7.1-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6aac4f16b472d5b7dc6f66a0d49dd57b0e0902090be16594dc9ebfd3d17c47e7", size = 247970, upload-time = "2026-01-26T02:44:56.783Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/06/538e58a63ed5cfb0bd4517e346b91da32fde409d839720f664e9a4ae4f9d/multidict-6.7.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:21f830fe223215dffd51f538e78c172ed7c7f60c9b96a2bf05c4848ad49921c3", size = 245060, upload-time = "2026-01-26T02:44:58.195Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/2f/d743a3045a97c895d401e9bd29aaa09b94f5cbdf1bd561609e5a6c431c70/multidict-6.7.1-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:f5dd81c45b05518b9aa4da4aa74e1c93d715efa234fd3e8a179df611cc85e5f4", size = 235888, upload-time = "2026-01-26T02:44:59.57Z" },
+    { url = "https://files.pythonhosted.org/packages/38/83/5a325cac191ab28b63c52f14f1131f3b0a55ba3b9aa65a6d0bf2a9b921a0/multidict-6.7.1-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:eb304767bca2bb92fb9c5bd33cedc95baee5bb5f6c88e63706533a1c06ad08c8", size = 243554, upload-time = "2026-01-26T02:45:01.054Z" },
+    { url = "https://files.pythonhosted.org/packages/20/1f/9d2327086bd15da2725ef6aae624208e2ef828ed99892b17f60c344e57ed/multidict-6.7.1-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:c9035dde0f916702850ef66460bc4239d89d08df4d02023a5926e7446724212c", size = 252341, upload-time = "2026-01-26T02:45:02.484Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/2c/2a1aa0280cf579d0f6eed8ee5211c4f1730bd7e06c636ba2ee6aafda302e/multidict-6.7.1-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:af959b9beeb66c822380f222f0e0a1889331597e81f1ded7f374f3ecb0fd6c52", size = 246391, upload-time = "2026-01-26T02:45:03.862Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/03/7ca022ffc36c5a3f6e03b179a5ceb829be9da5783e6fe395f347c0794680/multidict-6.7.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:41f2952231456154ee479651491e94118229844dd7226541788be783be2b5108", size = 243422, upload-time = "2026-01-26T02:45:05.296Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/1d/b31650eab6c5778aceed46ba735bd97f7c7d2f54b319fa916c0f96e7805b/multidict-6.7.1-cp313-cp313t-win32.whl", hash = "sha256:df9f19c28adcb40b6aae30bbaa1478c389efd50c28d541d76760199fc1037c32", size = 47770, upload-time = "2026-01-26T02:45:06.754Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/5b/2d2d1d522e51285bd61b1e20df8f47ae1a9d80839db0b24ea783b3832832/multidict-6.7.1-cp313-cp313t-win_amd64.whl", hash = "sha256:d54ecf9f301853f2c5e802da559604b3e95bb7a3b01a9c295c6ee591b9882de8", size = 53109, upload-time = "2026-01-26T02:45:08.044Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/a3/cc409ba012c83ca024a308516703cf339bdc4b696195644a7215a5164a24/multidict-6.7.1-cp313-cp313t-win_arm64.whl", hash = "sha256:5a37ca18e360377cfda1d62f5f382ff41f2b8c4ccb329ed974cc2e1643440118", size = 45573, upload-time = "2026-01-26T02:45:09.349Z" },
     { url = "https://files.pythonhosted.org/packages/81/08/7036c080d7117f28a4af526d794aab6a84463126db031b007717c1a6676e/multidict-6.7.1-py3-none-any.whl", hash = "sha256:55d97cc6dae627efa6a6e548885712d4864b81110ac76fa4e534c03819fa4a56", size = 12319, upload-time = "2026-01-26T02:46:44.004Z" },
 ]
 
@@ -2831,40 +3038,64 @@ wheels = [
 
 [[package]]
 name = "numpy"
-version = "2.0.2"
+version = "2.2.6"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a9/75/10dd1f8116a8b796cb2c737b674e02d02e80454bda953fa7e65d8c12b016/numpy-2.0.2.tar.gz", hash = "sha256:883c987dee1880e2a864ab0dc9892292582510604156762362d9326444636e78", size = 18902015, upload-time = "2024-08-26T20:19:40.945Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/76/21/7d2a95e4bba9dc13d043ee156a356c0a8f0c6309dff6b21b4d71a073b8a8/numpy-2.2.6.tar.gz", hash = "sha256:e29554e2bef54a90aa5cc07da6ce955accb83f21ab5de01a62c8478897b264fd", size = 20276440, upload-time = "2025-05-17T22:38:04.611Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/21/91/3495b3237510f79f5d81f2508f9f13fea78ebfdf07538fc7444badda173d/numpy-2.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:51129a29dbe56f9ca83438b706e2e69a39892b5eda6cedcb6b0c9fdc9b0d3ece", size = 21165245, upload-time = "2024-08-26T20:04:14.625Z" },
-    { url = "https://files.pythonhosted.org/packages/05/33/26178c7d437a87082d11019292dce6d3fe6f0e9026b7b2309cbf3e489b1d/numpy-2.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f15975dfec0cf2239224d80e32c3170b1d168335eaedee69da84fbe9f1f9cd04", size = 13738540, upload-time = "2024-08-26T20:04:36.784Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/31/cc46e13bf07644efc7a4bf68df2df5fb2a1a88d0cd0da9ddc84dc0033e51/numpy-2.0.2-cp310-cp310-macosx_14_0_arm64.whl", hash = "sha256:8c5713284ce4e282544c68d1c3b2c7161d38c256d2eefc93c1d683cf47683e66", size = 5300623, upload-time = "2024-08-26T20:04:46.491Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/16/7bfcebf27bb4f9d7ec67332ffebee4d1bf085c84246552d52dbb548600e7/numpy-2.0.2-cp310-cp310-macosx_14_0_x86_64.whl", hash = "sha256:becfae3ddd30736fe1889a37f1f580e245ba79a5855bff5f2a29cb3ccc22dd7b", size = 6901774, upload-time = "2024-08-26T20:04:58.173Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/a3/561c531c0e8bf082c5bef509d00d56f82e0ea7e1e3e3a7fc8fa78742a6e5/numpy-2.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2da5960c3cf0df7eafefd806d4e612c5e19358de82cb3c343631188991566ccd", size = 13907081, upload-time = "2024-08-26T20:05:19.098Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/66/f7177ab331876200ac7563a580140643d1179c8b4b6a6b0fc9838de2a9b8/numpy-2.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:496f71341824ed9f3d2fd36cf3ac57ae2e0165c143b55c3a035ee219413f3318", size = 19523451, upload-time = "2024-08-26T20:05:47.479Z" },
-    { url = "https://files.pythonhosted.org/packages/25/7f/0b209498009ad6453e4efc2c65bcdf0ae08a182b2b7877d7ab38a92dc542/numpy-2.0.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:a61ec659f68ae254e4d237816e33171497e978140353c0c2038d46e63282d0c8", size = 19927572, upload-time = "2024-08-26T20:06:17.137Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/df/2619393b1e1b565cd2d4c4403bdd979621e2c4dea1f8532754b2598ed63b/numpy-2.0.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:d731a1c6116ba289c1e9ee714b08a8ff882944d4ad631fd411106a30f083c326", size = 14400722, upload-time = "2024-08-26T20:06:39.16Z" },
-    { url = "https://files.pythonhosted.org/packages/22/ad/77e921b9f256d5da36424ffb711ae79ca3f451ff8489eeca544d0701d74a/numpy-2.0.2-cp310-cp310-win32.whl", hash = "sha256:984d96121c9f9616cd33fbd0618b7f08e0cfc9600a7ee1d6fd9b239186d19d97", size = 6472170, upload-time = "2024-08-26T20:06:50.361Z" },
-    { url = "https://files.pythonhosted.org/packages/10/05/3442317535028bc29cf0c0dd4c191a4481e8376e9f0db6bcf29703cadae6/numpy-2.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:c7b0be4ef08607dd04da4092faee0b86607f111d5ae68036f16cc787e250a131", size = 15905558, upload-time = "2024-08-26T20:07:13.881Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/cf/034500fb83041aa0286e0fb16e7c76e5c8b67c0711bb6e9e9737a717d5fe/numpy-2.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:49ca4decb342d66018b01932139c0961a8f9ddc7589611158cb3c27cbcf76448", size = 21169137, upload-time = "2024-08-26T20:07:45.345Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/d9/32de45561811a4b87fbdee23b5797394e3d1504b4a7cf40c10199848893e/numpy-2.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:11a76c372d1d37437857280aa142086476136a8c0f373b2e648ab2c8f18fb195", size = 13703552, upload-time = "2024-08-26T20:08:06.666Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/ca/2f384720020c7b244d22508cb7ab23d95f179fcfff33c31a6eeba8d6c512/numpy-2.0.2-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:807ec44583fd708a21d4a11d94aedf2f4f3c3719035c76a2bbe1fe8e217bdc57", size = 5298957, upload-time = "2024-08-26T20:08:15.83Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/78/a3e4f9fb6aa4e6fdca0c5428e8ba039408514388cf62d89651aade838269/numpy-2.0.2-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:8cafab480740e22f8d833acefed5cc87ce276f4ece12fdaa2e8903db2f82897a", size = 6905573, upload-time = "2024-08-26T20:08:27.185Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/72/cfc3a1beb2caf4efc9d0b38a15fe34025230da27e1c08cc2eb9bfb1c7231/numpy-2.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a15f476a45e6e5a3a79d8a14e62161d27ad897381fecfa4a09ed5322f2085669", size = 13914330, upload-time = "2024-08-26T20:08:48.058Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/a8/c17acf65a931ce551fee11b72e8de63bf7e8a6f0e21add4c937c83563538/numpy-2.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:13e689d772146140a252c3a28501da66dfecd77490b498b168b501835041f951", size = 19534895, upload-time = "2024-08-26T20:09:16.536Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/86/8767f3d54f6ae0165749f84648da9dcc8cd78ab65d415494962c86fac80f/numpy-2.0.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:9ea91dfb7c3d1c56a0e55657c0afb38cf1eeae4544c208dc465c3c9f3a7c09f9", size = 19937253, upload-time = "2024-08-26T20:09:46.263Z" },
-    { url = "https://files.pythonhosted.org/packages/df/87/f76450e6e1c14e5bb1eae6836478b1028e096fd02e85c1c37674606ab752/numpy-2.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c1c9307701fec8f3f7a1e6711f9089c06e6284b3afbbcd259f7791282d660a15", size = 14414074, upload-time = "2024-08-26T20:10:08.483Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/ca/0f0f328e1e59f73754f06e1adfb909de43726d4f24c6a3f8805f34f2b0fa/numpy-2.0.2-cp311-cp311-win32.whl", hash = "sha256:a392a68bd329eafac5817e5aefeb39038c48b671afd242710b451e76090e81f4", size = 6470640, upload-time = "2024-08-26T20:10:19.732Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/57/3a3f14d3a759dcf9bf6e9eda905794726b758819df4663f217d658a58695/numpy-2.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:286cd40ce2b7d652a6f22efdfc6d1edf879440e53e76a75955bc0c826c7e64dc", size = 15910230, upload-time = "2024-08-26T20:10:43.413Z" },
-    { url = "https://files.pythonhosted.org/packages/45/40/2e117be60ec50d98fa08c2f8c48e09b3edea93cfcabd5a9ff6925d54b1c2/numpy-2.0.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:df55d490dea7934f330006d0f81e8551ba6010a5bf035a249ef61a94f21c500b", size = 20895803, upload-time = "2024-08-26T20:11:13.916Z" },
-    { url = "https://files.pythonhosted.org/packages/46/92/1b8b8dee833f53cef3e0a3f69b2374467789e0bb7399689582314df02651/numpy-2.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8df823f570d9adf0978347d1f926b2a867d5608f434a7cff7f7908c6570dcf5e", size = 13471835, upload-time = "2024-08-26T20:11:34.779Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/19/e2793bde475f1edaea6945be141aef6c8b4c669b90c90a300a8954d08f0a/numpy-2.0.2-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:9a92ae5c14811e390f3767053ff54eaee3bf84576d99a2456391401323f4ec2c", size = 5038499, upload-time = "2024-08-26T20:11:43.902Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/ff/ddf6dac2ff0dd50a7327bcdba45cb0264d0e96bb44d33324853f781a8f3c/numpy-2.0.2-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:a842d573724391493a97a62ebbb8e731f8a5dcc5d285dfc99141ca15a3302d0c", size = 6633497, upload-time = "2024-08-26T20:11:55.09Z" },
-    { url = "https://files.pythonhosted.org/packages/72/21/67f36eac8e2d2cd652a2e69595a54128297cdcb1ff3931cfc87838874bd4/numpy-2.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c05e238064fc0610c840d1cf6a13bf63d7e391717d247f1bf0318172e759e692", size = 13621158, upload-time = "2024-08-26T20:12:14.95Z" },
-    { url = "https://files.pythonhosted.org/packages/39/68/e9f1126d757653496dbc096cb429014347a36b228f5a991dae2c6b6cfd40/numpy-2.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0123ffdaa88fa4ab64835dcbde75dcdf89c453c922f18dced6e27c90d1d0ec5a", size = 19236173, upload-time = "2024-08-26T20:12:44.049Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/e9/1f5333281e4ebf483ba1c888b1d61ba7e78d7e910fdd8e6499667041cc35/numpy-2.0.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:96a55f64139912d61de9137f11bf39a55ec8faec288c75a54f93dfd39f7eb40c", size = 19634174, upload-time = "2024-08-26T20:13:13.634Z" },
-    { url = "https://files.pythonhosted.org/packages/71/af/a469674070c8d8408384e3012e064299f7a2de540738a8e414dcfd639996/numpy-2.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:ec9852fb39354b5a45a80bdab5ac02dd02b15f44b3804e9f00c556bf24b4bded", size = 14099701, upload-time = "2024-08-26T20:13:34.851Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/3d/08ea9f239d0e0e939b6ca52ad403c84a2bce1bde301a8eb4888c1c1543f1/numpy-2.0.2-cp312-cp312-win32.whl", hash = "sha256:671bec6496f83202ed2d3c8fdc486a8fc86942f2e69ff0e986140339a63bcbe5", size = 6174313, upload-time = "2024-08-26T20:13:45.653Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/b5/4ac39baebf1fdb2e72585c8352c56d063b6126be9fc95bd2bb5ef5770c20/numpy-2.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:cfd41e13fdc257aa5778496b8caa5e856dc4896d4ccf01841daee1d96465467a", size = 15606179, upload-time = "2024-08-26T20:14:08.786Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/3e/ed6db5be21ce87955c0cbd3009f2803f59fa08df21b5df06862e2d8e2bdd/numpy-2.2.6-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:b412caa66f72040e6d268491a59f2c43bf03eb6c96dd8f0307829feb7fa2b6fb", size = 21165245, upload-time = "2025-05-17T21:27:58.555Z" },
+    { url = "https://files.pythonhosted.org/packages/22/c2/4b9221495b2a132cc9d2eb862e21d42a009f5a60e45fc44b00118c174bff/numpy-2.2.6-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8e41fd67c52b86603a91c1a505ebaef50b3314de0213461c7a6e99c9a3beff90", size = 14360048, upload-time = "2025-05-17T21:28:21.406Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/77/dc2fcfc66943c6410e2bf598062f5959372735ffda175b39906d54f02349/numpy-2.2.6-cp310-cp310-macosx_14_0_arm64.whl", hash = "sha256:37e990a01ae6ec7fe7fa1c26c55ecb672dd98b19c3d0e1d1f326fa13cb38d163", size = 5340542, upload-time = "2025-05-17T21:28:30.931Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/4f/1cb5fdc353a5f5cc7feb692db9b8ec2c3d6405453f982435efc52561df58/numpy-2.2.6-cp310-cp310-macosx_14_0_x86_64.whl", hash = "sha256:5a6429d4be8ca66d889b7cf70f536a397dc45ba6faeb5f8c5427935d9592e9cf", size = 6878301, upload-time = "2025-05-17T21:28:41.613Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/17/96a3acd228cec142fcb8723bd3cc39c2a474f7dcf0a5d16731980bcafa95/numpy-2.2.6-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:efd28d4e9cd7d7a8d39074a4d44c63eda73401580c5c76acda2ce969e0a38e83", size = 14297320, upload-time = "2025-05-17T21:29:02.78Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/63/3de6a34ad7ad6646ac7d2f55ebc6ad439dbbf9c4370017c50cf403fb19b5/numpy-2.2.6-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fc7b73d02efb0e18c000e9ad8b83480dfcd5dfd11065997ed4c6747470ae8915", size = 16801050, upload-time = "2025-05-17T21:29:27.675Z" },
+    { url = "https://files.pythonhosted.org/packages/07/b6/89d837eddef52b3d0cec5c6ba0456c1bf1b9ef6a6672fc2b7873c3ec4e2e/numpy-2.2.6-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:74d4531beb257d2c3f4b261bfb0fc09e0f9ebb8842d82a7b4209415896adc680", size = 15807034, upload-time = "2025-05-17T21:29:51.102Z" },
+    { url = "https://files.pythonhosted.org/packages/01/c8/dc6ae86e3c61cfec1f178e5c9f7858584049b6093f843bca541f94120920/numpy-2.2.6-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8fc377d995680230e83241d8a96def29f204b5782f371c532579b4f20607a289", size = 18614185, upload-time = "2025-05-17T21:30:18.703Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/c5/0064b1b7e7c89137b471ccec1fd2282fceaae0ab3a9550f2568782d80357/numpy-2.2.6-cp310-cp310-win32.whl", hash = "sha256:b093dd74e50a8cba3e873868d9e93a85b78e0daf2e98c6797566ad8044e8363d", size = 6527149, upload-time = "2025-05-17T21:30:29.788Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/dd/4b822569d6b96c39d1215dbae0582fd99954dcbcf0c1a13c61783feaca3f/numpy-2.2.6-cp310-cp310-win_amd64.whl", hash = "sha256:f0fd6321b839904e15c46e0d257fdd101dd7f530fe03fd6359c1ea63738703f3", size = 12904620, upload-time = "2025-05-17T21:30:48.994Z" },
+    { url = "https://files.pythonhosted.org/packages/da/a8/4f83e2aa666a9fbf56d6118faaaf5f1974d456b1823fda0a176eff722839/numpy-2.2.6-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f9f1adb22318e121c5c69a09142811a201ef17ab257a1e66ca3025065b7f53ae", size = 21176963, upload-time = "2025-05-17T21:31:19.36Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/2b/64e1affc7972decb74c9e29e5649fac940514910960ba25cd9af4488b66c/numpy-2.2.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:c820a93b0255bc360f53eca31a0e676fd1101f673dda8da93454a12e23fc5f7a", size = 14406743, upload-time = "2025-05-17T21:31:41.087Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/9f/0121e375000b5e50ffdd8b25bf78d8e1a5aa4cca3f185d41265198c7b834/numpy-2.2.6-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:3d70692235e759f260c3d837193090014aebdf026dfd167834bcba43e30c2a42", size = 5352616, upload-time = "2025-05-17T21:31:50.072Z" },
+    { url = "https://files.pythonhosted.org/packages/31/0d/b48c405c91693635fbe2dcd7bc84a33a602add5f63286e024d3b6741411c/numpy-2.2.6-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:481b49095335f8eed42e39e8041327c05b0f6f4780488f61286ed3c01368d491", size = 6889579, upload-time = "2025-05-17T21:32:01.712Z" },
+    { url = "https://files.pythonhosted.org/packages/52/b8/7f0554d49b565d0171eab6e99001846882000883998e7b7d9f0d98b1f934/numpy-2.2.6-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b64d8d4d17135e00c8e346e0a738deb17e754230d7e0810ac5012750bbd85a5a", size = 14312005, upload-time = "2025-05-17T21:32:23.332Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/dd/2238b898e51bd6d389b7389ffb20d7f4c10066d80351187ec8e303a5a475/numpy-2.2.6-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ba10f8411898fc418a521833e014a77d3ca01c15b0c6cdcce6a0d2897e6dbbdf", size = 16821570, upload-time = "2025-05-17T21:32:47.991Z" },
+    { url = "https://files.pythonhosted.org/packages/83/6c/44d0325722cf644f191042bf47eedad61c1e6df2432ed65cbe28509d404e/numpy-2.2.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bd48227a919f1bafbdda0583705e547892342c26fb127219d60a5c36882609d1", size = 15818548, upload-time = "2025-05-17T21:33:11.728Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/9d/81e8216030ce66be25279098789b665d49ff19eef08bfa8cb96d4957f422/numpy-2.2.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9551a499bf125c1d4f9e250377c1ee2eddd02e01eac6644c080162c0c51778ab", size = 18620521, upload-time = "2025-05-17T21:33:39.139Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/fd/e19617b9530b031db51b0926eed5345ce8ddc669bb3bc0044b23e275ebe8/numpy-2.2.6-cp311-cp311-win32.whl", hash = "sha256:0678000bb9ac1475cd454c6b8c799206af8107e310843532b04d49649c717a47", size = 6525866, upload-time = "2025-05-17T21:33:50.273Z" },
+    { url = "https://files.pythonhosted.org/packages/31/0a/f354fb7176b81747d870f7991dc763e157a934c717b67b58456bc63da3df/numpy-2.2.6-cp311-cp311-win_amd64.whl", hash = "sha256:e8213002e427c69c45a52bbd94163084025f533a55a59d6f9c5b820774ef3303", size = 12907455, upload-time = "2025-05-17T21:34:09.135Z" },
+    { url = "https://files.pythonhosted.org/packages/82/5d/c00588b6cf18e1da539b45d3598d3557084990dcc4331960c15ee776ee41/numpy-2.2.6-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:41c5a21f4a04fa86436124d388f6ed60a9343a6f767fced1a8a71c3fbca038ff", size = 20875348, upload-time = "2025-05-17T21:34:39.648Z" },
+    { url = "https://files.pythonhosted.org/packages/66/ee/560deadcdde6c2f90200450d5938f63a34b37e27ebff162810f716f6a230/numpy-2.2.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:de749064336d37e340f640b05f24e9e3dd678c57318c7289d222a8a2f543e90c", size = 14119362, upload-time = "2025-05-17T21:35:01.241Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/65/4baa99f1c53b30adf0acd9a5519078871ddde8d2339dc5a7fde80d9d87da/numpy-2.2.6-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:894b3a42502226a1cac872f840030665f33326fc3dac8e57c607905773cdcde3", size = 5084103, upload-time = "2025-05-17T21:35:10.622Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/89/e5a34c071a0570cc40c9a54eb472d113eea6d002e9ae12bb3a8407fb912e/numpy-2.2.6-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:71594f7c51a18e728451bb50cc60a3ce4e6538822731b2933209a1f3614e9282", size = 6625382, upload-time = "2025-05-17T21:35:21.414Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/35/8c80729f1ff76b3921d5c9487c7ac3de9b2a103b1cd05e905b3090513510/numpy-2.2.6-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f2618db89be1b4e05f7a1a847a9c1c0abd63e63a1607d892dd54668dd92faf87", size = 14018462, upload-time = "2025-05-17T21:35:42.174Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/3d/1e1db36cfd41f895d266b103df00ca5b3cbe965184df824dec5c08c6b803/numpy-2.2.6-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fd83c01228a688733f1ded5201c678f0c53ecc1006ffbc404db9f7a899ac6249", size = 16527618, upload-time = "2025-05-17T21:36:06.711Z" },
+    { url = "https://files.pythonhosted.org/packages/61/c6/03ed30992602c85aa3cd95b9070a514f8b3c33e31124694438d88809ae36/numpy-2.2.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:37c0ca431f82cd5fa716eca9506aefcabc247fb27ba69c5062a6d3ade8cf8f49", size = 15505511, upload-time = "2025-05-17T21:36:29.965Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/25/5761d832a81df431e260719ec45de696414266613c9ee268394dd5ad8236/numpy-2.2.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fe27749d33bb772c80dcd84ae7e8df2adc920ae8297400dabec45f0dedb3f6de", size = 18313783, upload-time = "2025-05-17T21:36:56.883Z" },
+    { url = "https://files.pythonhosted.org/packages/57/0a/72d5a3527c5ebffcd47bde9162c39fae1f90138c961e5296491ce778e682/numpy-2.2.6-cp312-cp312-win32.whl", hash = "sha256:4eeaae00d789f66c7a25ac5f34b71a7035bb474e679f410e5e1a94deb24cf2d4", size = 6246506, upload-time = "2025-05-17T21:37:07.368Z" },
+    { url = "https://files.pythonhosted.org/packages/36/fa/8c9210162ca1b88529ab76b41ba02d433fd54fecaf6feb70ef9f124683f1/numpy-2.2.6-cp312-cp312-win_amd64.whl", hash = "sha256:c1f9540be57940698ed329904db803cf7a402f3fc200bfe599334c9bd84a40b2", size = 12614190, upload-time = "2025-05-17T21:37:26.213Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/5c/6657823f4f594f72b5471f1db1ab12e26e890bb2e41897522d134d2a3e81/numpy-2.2.6-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:0811bb762109d9708cca4d0b13c4f67146e3c3b7cf8d34018c722adb2d957c84", size = 20867828, upload-time = "2025-05-17T21:37:56.699Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/9e/14520dc3dadf3c803473bd07e9b2bd1b69bc583cb2497b47000fed2fa92f/numpy-2.2.6-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:287cc3162b6f01463ccd86be154f284d0893d2b3ed7292439ea97eafa8170e0b", size = 14143006, upload-time = "2025-05-17T21:38:18.291Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/06/7e96c57d90bebdce9918412087fc22ca9851cceaf5567a45c1f404480e9e/numpy-2.2.6-cp313-cp313-macosx_14_0_arm64.whl", hash = "sha256:f1372f041402e37e5e633e586f62aa53de2eac8d98cbfb822806ce4bbefcb74d", size = 5076765, upload-time = "2025-05-17T21:38:27.319Z" },
+    { url = "https://files.pythonhosted.org/packages/73/ed/63d920c23b4289fdac96ddbdd6132e9427790977d5457cd132f18e76eae0/numpy-2.2.6-cp313-cp313-macosx_14_0_x86_64.whl", hash = "sha256:55a4d33fa519660d69614a9fad433be87e5252f4b03850642f88993f7b2ca566", size = 6617736, upload-time = "2025-05-17T21:38:38.141Z" },
+    { url = "https://files.pythonhosted.org/packages/85/c5/e19c8f99d83fd377ec8c7e0cf627a8049746da54afc24ef0a0cb73d5dfb5/numpy-2.2.6-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f92729c95468a2f4f15e9bb94c432a9229d0d50de67304399627a943201baa2f", size = 14010719, upload-time = "2025-05-17T21:38:58.433Z" },
+    { url = "https://files.pythonhosted.org/packages/19/49/4df9123aafa7b539317bf6d342cb6d227e49f7a35b99c287a6109b13dd93/numpy-2.2.6-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1bc23a79bfabc5d056d106f9befb8d50c31ced2fbc70eedb8155aec74a45798f", size = 16526072, upload-time = "2025-05-17T21:39:22.638Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/6c/04b5f47f4f32f7c2b0e7260442a8cbcf8168b0e1a41ff1495da42f42a14f/numpy-2.2.6-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:e3143e4451880bed956e706a3220b4e5cf6172ef05fcc397f6f36a550b1dd868", size = 15503213, upload-time = "2025-05-17T21:39:45.865Z" },
+    { url = "https://files.pythonhosted.org/packages/17/0a/5cd92e352c1307640d5b6fec1b2ffb06cd0dabe7d7b8227f97933d378422/numpy-2.2.6-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:b4f13750ce79751586ae2eb824ba7e1e8dba64784086c98cdbbcc6a42112ce0d", size = 18316632, upload-time = "2025-05-17T21:40:13.331Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/3b/5cba2b1d88760ef86596ad0f3d484b1cbff7c115ae2429678465057c5155/numpy-2.2.6-cp313-cp313-win32.whl", hash = "sha256:5beb72339d9d4fa36522fc63802f469b13cdbe4fdab4a288f0c441b74272ebfd", size = 6244532, upload-time = "2025-05-17T21:43:46.099Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/3b/d58c12eafcb298d4e6d0d40216866ab15f59e55d148a5658bb3132311fcf/numpy-2.2.6-cp313-cp313-win_amd64.whl", hash = "sha256:b0544343a702fa80c95ad5d3d608ea3599dd54d4632df855e4c8d24eb6ecfa1c", size = 12610885, upload-time = "2025-05-17T21:44:05.145Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/9e/4bf918b818e516322db999ac25d00c75788ddfd2d2ade4fa66f1f38097e1/numpy-2.2.6-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:0bca768cd85ae743b2affdc762d617eddf3bcf8724435498a1e80132d04879e6", size = 20963467, upload-time = "2025-05-17T21:40:44Z" },
+    { url = "https://files.pythonhosted.org/packages/61/66/d2de6b291507517ff2e438e13ff7b1e2cdbdb7cb40b3ed475377aece69f9/numpy-2.2.6-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:fc0c5673685c508a142ca65209b4e79ed6740a4ed6b2267dbba90f34b0b3cfda", size = 14225144, upload-time = "2025-05-17T21:41:05.695Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/25/480387655407ead912e28ba3a820bc69af9adf13bcbe40b299d454ec011f/numpy-2.2.6-cp313-cp313t-macosx_14_0_arm64.whl", hash = "sha256:5bd4fc3ac8926b3819797a7c0e2631eb889b4118a9898c84f585a54d475b7e40", size = 5200217, upload-time = "2025-05-17T21:41:15.903Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/4a/6e313b5108f53dcbf3aca0c0f3e9c92f4c10ce57a0a721851f9785872895/numpy-2.2.6-cp313-cp313t-macosx_14_0_x86_64.whl", hash = "sha256:fee4236c876c4e8369388054d02d0e9bb84821feb1a64dd59e137e6511a551f8", size = 6712014, upload-time = "2025-05-17T21:41:27.321Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/30/172c2d5c4be71fdf476e9de553443cf8e25feddbe185e0bd88b096915bcc/numpy-2.2.6-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e1dda9c7e08dc141e0247a5b8f49cf05984955246a327d4c48bda16821947b2f", size = 14077935, upload-time = "2025-05-17T21:41:49.738Z" },
+    { url = "https://files.pythonhosted.org/packages/12/fb/9e743f8d4e4d3c710902cf87af3512082ae3d43b945d5d16563f26ec251d/numpy-2.2.6-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f447e6acb680fd307f40d3da4852208af94afdfab89cf850986c3ca00562f4fa", size = 16600122, upload-time = "2025-05-17T21:42:14.046Z" },
+    { url = "https://files.pythonhosted.org/packages/12/75/ee20da0e58d3a66f204f38916757e01e33a9737d0b22373b3eb5a27358f9/numpy-2.2.6-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:389d771b1623ec92636b0786bc4ae56abafad4a4c513d36a55dce14bd9ce8571", size = 15586143, upload-time = "2025-05-17T21:42:37.464Z" },
+    { url = "https://files.pythonhosted.org/packages/76/95/bef5b37f29fc5e739947e9ce5179ad402875633308504a52d188302319c8/numpy-2.2.6-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8e9ace4a37db23421249ed236fdcdd457d671e25146786dfc96835cd951aa7c1", size = 18385260, upload-time = "2025-05-17T21:43:05.189Z" },
+    { url = "https://files.pythonhosted.org/packages/09/04/f2f83279d287407cf36a7a8053a5abe7be3622a4363337338f2585e4afda/numpy-2.2.6-cp313-cp313t-win32.whl", hash = "sha256:038613e9fb8c72b0a41f025a7e4c3f0b7a1b5d768ece4796b674c8f3fe13efff", size = 6377225, upload-time = "2025-05-17T21:43:16.254Z" },
+    { url = "https://files.pythonhosted.org/packages/67/0e/35082d13c09c02c011cf21570543d202ad929d961c02a147493cb0c2bdf5/numpy-2.2.6-cp313-cp313t-win_amd64.whl", hash = "sha256:6031dd6dfecc0cf9f668681a37648373bddd6421fff6c66ec1624eed0180ee06", size = 12771374, upload-time = "2025-05-17T21:43:35.479Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/3b/d94a75f4dbf1ef5d321523ecac21ef23a3cd2ac8b78ae2aac40873590229/numpy-2.2.6-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:0b605b275d7bd0c640cad4e5d30fa701a8d59302e127e5f79138ad62762c3e3d", size = 21040391, upload-time = "2025-05-17T21:44:35.948Z" },
+    { url = "https://files.pythonhosted.org/packages/17/f4/09b2fa1b58f0fb4f7c7963a1649c64c4d315752240377ed74d9cd878f7b5/numpy-2.2.6-pp310-pypy310_pp73-macosx_14_0_x86_64.whl", hash = "sha256:7befc596a7dc9da8a337f79802ee8adb30a552a94f792b9c9d18c840055907db", size = 6786754, upload-time = "2025-05-17T21:44:47.446Z" },
+    { url = "https://files.pythonhosted.org/packages/af/30/feba75f143bdc868a1cc3f44ccfa6c4b9ec522b36458e738cd00f67b573f/numpy-2.2.6-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ce47521a4754c8f4593837384bd3424880629f718d87c5d44f8ed763edd63543", size = 16643476, upload-time = "2025-05-17T21:45:11.871Z" },
+    { url = "https://files.pythonhosted.org/packages/37/48/ac2a9584402fb6c0cd5b5d1a91dcf176b15760130dd386bbafdbfe3640bf/numpy-2.2.6-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:d042d24c90c41b54fd506da306759e06e568864df8ec17ccc17e9e884634fd00", size = 12812666, upload-time = "2025-05-17T21:45:31.426Z" },
 ]
 
 [[package]]
@@ -3065,6 +3296,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/20/e8/45a05d9c39d2cea61ab175dbe6a2de1d05b679e8de2011da4ee190d7e748/pandas-2.2.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:6dfcb5ee8d4d50c06a51c2fffa6cff6272098ad6540aed1a76d15fb9318194d8", size = 16359235, upload-time = "2024-09-20T19:02:07.094Z" },
     { url = "https://files.pythonhosted.org/packages/1d/99/617d07a6a5e429ff90c90da64d428516605a1ec7d7bea494235e1c3882de/pandas-2.2.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:062309c1b9ea12a50e8ce661145c6aab431b1e99530d3cd60640e255778bd43a", size = 14056756, upload-time = "2024-09-20T13:09:20.474Z" },
     { url = "https://files.pythonhosted.org/packages/29/d4/1244ab8edf173a10fd601f7e13b9566c1b525c4f365d6bee918e68381889/pandas-2.2.3-cp312-cp312-win_amd64.whl", hash = "sha256:59ef3764d0fe818125a5097d2ae867ca3fa64df032331b7e0917cf5d7bf66b13", size = 11504248, upload-time = "2024-09-20T13:09:23.137Z" },
+    { url = "https://files.pythonhosted.org/packages/64/22/3b8f4e0ed70644e85cfdcd57454686b9057c6c38d2f74fe4b8bc2527214a/pandas-2.2.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f00d1345d84d8c86a63e476bb4955e46458b304b9575dcf71102b5c705320015", size = 12477643, upload-time = "2024-09-20T13:09:25.522Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/93/b3f5d1838500e22c8d793625da672f3eec046b1a99257666c94446969282/pandas-2.2.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3508d914817e153ad359d7e069d752cdd736a247c322d932eb89e6bc84217f28", size = 11281573, upload-time = "2024-09-20T13:09:28.012Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/94/6c79b07f0e5aab1dcfa35a75f4817f5c4f677931d4234afcd75f0e6a66ca/pandas-2.2.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:22a9d949bfc9a502d320aa04e5d02feab689d61da4e7764b62c30b991c42c5f0", size = 15196085, upload-time = "2024-09-20T19:02:10.451Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/31/aa8da88ca0eadbabd0a639788a6da13bb2ff6edbbb9f29aa786450a30a91/pandas-2.2.3-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f3a255b2c19987fbbe62a9dfd6cff7ff2aa9ccab3fc75218fd4b7530f01efa24", size = 12711809, upload-time = "2024-09-20T13:09:30.814Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/7c/c6dbdb0cb2a4344cacfb8de1c5808ca885b2e4dcfde8008266608f9372af/pandas-2.2.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:800250ecdadb6d9c78eae4990da62743b857b470883fa27f652db8bdde7f6659", size = 16356316, upload-time = "2024-09-20T19:02:13.825Z" },
+    { url = "https://files.pythonhosted.org/packages/57/b7/8b757e7d92023b832869fa8881a992696a0bfe2e26f72c9ae9f255988d42/pandas-2.2.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6374c452ff3ec675a8f46fd9ab25c4ad0ba590b71cf0656f8b6daa5202bca3fb", size = 14022055, upload-time = "2024-09-20T13:09:33.462Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/bc/4b18e2b8c002572c5a441a64826252ce5da2aa738855747247a971988043/pandas-2.2.3-cp313-cp313-win_amd64.whl", hash = "sha256:61c5ad4043f791b61dd4752191d9f07f0ae412515d59ba8f005832a532f8736d", size = 11481175, upload-time = "2024-09-20T13:09:35.871Z" },
+    { url = "https://files.pythonhosted.org/packages/76/a3/a5d88146815e972d40d19247b2c162e88213ef51c7c25993942c39dbf41d/pandas-2.2.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:3b71f27954685ee685317063bf13c7709a7ba74fc996b84fc6821c59b0f06468", size = 12615650, upload-time = "2024-09-20T13:09:38.685Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/8c/f0fd18f6140ddafc0c24122c8a964e48294acc579d47def376fef12bcb4a/pandas-2.2.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:38cf8125c40dae9d5acc10fa66af8ea6fdf760b2714ee482ca691fc66e6fcb18", size = 11290177, upload-time = "2024-09-20T13:09:41.141Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/f9/e995754eab9c0f14c6777401f7eece0943840b7a9fc932221c19d1abee9f/pandas-2.2.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ba96630bc17c875161df3818780af30e43be9b166ce51c9a18c1feae342906c2", size = 14651526, upload-time = "2024-09-20T19:02:16.905Z" },
+    { url = "https://files.pythonhosted.org/packages/25/b0/98d6ae2e1abac4f35230aa756005e8654649d305df9a28b16b9ae4353bff/pandas-2.2.3-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1db71525a1538b30142094edb9adc10be3f3e176748cd7acc2240c2f2e5aa3a4", size = 11871013, upload-time = "2024-09-20T13:09:44.39Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/57/0f72a10f9db6a4628744c8e8f0df4e6e21de01212c7c981d31e50ffc8328/pandas-2.2.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:15c0e1e02e93116177d29ff83e8b1619c93ddc9c49083f237d4312337a61165d", size = 15711620, upload-time = "2024-09-20T19:02:20.639Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/5f/b38085618b950b79d2d9164a711c52b10aefc0ae6833b96f626b7021b2ed/pandas-2.2.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:ad5b65698ab28ed8d7f18790a0dc58005c7629f227be9ecc1072aa74c0c1d43a", size = 13098436, upload-time = "2024-09-20T13:09:48.112Z" },
 ]
 
 [[package]]
@@ -3209,6 +3453,40 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/cf/74/66bd798b5b3be70aa1b391f5cc9d6a0a5532d7fd3b19ec0b213e72e6ad9d/propcache-0.5.2-cp312-cp312-win32.whl", hash = "sha256:8c7972d8f193740d9175f0998ab38717e6cd322d5935c5b0fef8c0d323fd9031", size = 39018, upload-time = "2026-05-08T21:00:31.622Z" },
     { url = "https://files.pythonhosted.org/packages/61/7c/5c0d34aa3024694d6dcb9271cdbdd08c4e47c1c0ad95ec7e7bc74cdea145/propcache-0.5.2-cp312-cp312-win_amd64.whl", hash = "sha256:d9ee8826a7d47863a08ac44e1a5f611a462eefc3a194b492da242128bec75b42", size = 42322, upload-time = "2026-05-08T21:00:32.918Z" },
     { url = "https://files.pythonhosted.org/packages/4d/91/875812f1a3feb20ceba818ef39fbe4d92f1081e04ac815c822496d0d038b/propcache-0.5.2-cp312-cp312-win_arm64.whl", hash = "sha256:2800a4a8ead6b28cccd1ec54b59346f0def7922ee1c7598e8499c733cfbb7c84", size = 38172, upload-time = "2026-05-08T21:00:35.124Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/09/f049e45385503fe67db75a6b6186a7b9f0c3930366dc960522c312a825b1/propcache-0.5.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:099aaf4b4d1a02265b92a977edf00b5c4f63b3b17ac6de39b0d637c9cac0188a", size = 94457, upload-time = "2026-05-08T21:00:36.355Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/65/83d1d05655baf63113731bd5a1008435e14f8d1e5a06cbe4ec5b23ad7a31/propcache-0.5.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:68ce1c44c7a813a7f71ea04315a8c7b330b63db99d059a797a4651bb6f69f117", size = 53835, upload-time = "2026-05-08T21:00:38.072Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/12/a6ba6482bb5ea3260c000c9b20881c95fa11c6b30173715668259f844ed7/propcache-0.5.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:fc299c129490f55f254cd90be0deca4764e36e9a7c08b4aa588479a3bbed3098", size = 54545, upload-time = "2026-05-08T21:00:39.319Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/19/7fa086f5764c59ec8a8e157cd93aa8497acc00aba9dcdec56bfffb32602d/propcache-0.5.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a6ae2198be502c10f09b2516e7b5d019816924bc3183a43ce792a7bd6625e6f4", size = 59886, upload-time = "2026-05-08T21:00:40.621Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/e4/5d7663dc8235956c8f5281698a3af1d351d8820341ddd890f59d9a9127f2/propcache-0.5.2-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6041d31504dc1779d700e1edcfb08eea334b357620b06681a4eabb57a74e574e", size = 63261, upload-time = "2026-05-08T21:00:41.775Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/4a/15a03adee24d6350da4292caeac44c34c033d2afe5e87eb370f38854560f/propcache-0.5.2-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f7eabc04151c78a9f4d5bbb5f1faf571e4defeb4b585e0fe95b60ff2dbe4d3d7", size = 64184, upload-time = "2026-05-08T21:00:43.018Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/c6/979176efdaa3d239e36d503d5af63a0a773b36662ed8f52e5b6a6d9fd40e/propcache-0.5.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4db0ba63d693afd40d249bd93f842b5f144f8fcbb83de05660373bcf30517b1d", size = 61534, upload-time = "2026-05-08T21:00:44.507Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/22/63e8cd1bae4c2d2be6493b6b7d10566ddafad88137cfbc99964a1119853c/propcache-0.5.2-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1dbcf7675229b35d31abb6547d8ebc8c27a830ac3f9a794edff6254873ec7c0a", size = 61500, upload-time = "2026-05-08T21:00:45.796Z" },
+    { url = "https://files.pythonhosted.org/packages/60/5a/28e5d9acbac1cc9ccb67045e8c1b943aa8d79fdf39c93bd73cacd68008ea/propcache-0.5.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d310c013aad2c72f1c3f2f8dd3279d460a858c551f97aeb8c63e4693cca7b4d2", size = 59994, upload-time = "2026-05-08T21:00:47.093Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/40/db650677f554a95b9c01a7c9d93d629e93a15562f5deb4573c9ee136fed2/propcache-0.5.2-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:06187263ddad280d05b4d8a8b3bb7d164cbebd469236544a42e6d9b28ac6a4fa", size = 56884, upload-time = "2026-05-08T21:00:48.376Z" },
+    { url = "https://files.pythonhosted.org/packages/80/45/70b39b89516ff8b96bf732fa6fded8cef20f293cb1508690101c3c07ec51/propcache-0.5.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:3115559b8effafd63b142ea5ed53d63a16ea6469cbc63dce4ee194b42db5d853", size = 63464, upload-time = "2026-05-08T21:00:49.954Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/e2/fa59d3a89eac5534293124af4f1d0d0ada091ce4a0ab4610ce03fd2bdd8d/propcache-0.5.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:c60462af8e6dc30c35407c7237ea908d777b22862bbee27bc4699c0d8bcdc45a", size = 61588, upload-time = "2026-05-08T21:00:51.281Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/97/efb547a55c4bc7381cfb202d6a2239ac621045277bc1ea5dfd3a7f0516c0/propcache-0.5.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:40314bca9ac559716fe374094fc81c11dcc34b64fd6c585360f5775690505704", size = 64667, upload-time = "2026-05-08T21:00:52.602Z" },
+    { url = "https://files.pythonhosted.org/packages/92/56/f5c7d9b4b7595d5127da38974d791b2153f3d1eae6c674af3583ace92ad3/propcache-0.5.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:cfa21e036ce1e1db2be04ba3b85d2df1bb1702fa01932d984c5464c665228ff4", size = 62463, upload-time = "2026-05-08T21:00:54.303Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/3b/484a3a65fc9f9f60c41dcd17b428bace5389544e2c680994534a20755066/propcache-0.5.2-cp313-cp313-win32.whl", hash = "sha256:f156a3529f38063b6dbaf356e15602a7f95f8055b1295a438433a6386f10463d", size = 38621, upload-time = "2026-05-08T21:00:55.808Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/fd/3f0f10dba4dabad3bf53102be007abf55481067952bde0fdddff439e7c61/propcache-0.5.2-cp313-cp313-win_amd64.whl", hash = "sha256:dfed59d0a5aeb01e242e66ff0300bc4a265a7c05f612d30016f0b60b1017d757", size = 41649, upload-time = "2026-05-08T21:00:57.061Z" },
+    { url = "https://files.pythonhosted.org/packages/90/ec/6ce619cc32bb500a482f811f9cd509368b4e58e638d13f2c68f370d6b475/propcache-0.5.2-cp313-cp313-win_arm64.whl", hash = "sha256:ba338430e87ceb9c8f0cf754de38a9860560261e56c00376debd628698a7364f", size = 37636, upload-time = "2026-05-08T21:00:58.646Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/82/c1d268bbbf2ef981c5bf0fbbe746db617c66e3bcefe431a1aa8943fbe23a/propcache-0.5.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:a592f5f3da71c8691c788c13cb6734b6d17663d2e1cb8caddf0673d01ef8847d", size = 98872, upload-time = "2026-05-08T21:00:59.889Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/d4/52c871e73e864e6b34c0e2d58ac1ec5ccd149497ddc7ad2137ae98323a35/propcache-0.5.2-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:6a997d0489e9668a384fcfd5061b857aa5361de73191cac204d04b889cfbbafa", size = 56257, upload-time = "2026-05-08T21:01:01.195Z" },
+    { url = "https://files.pythonhosted.org/packages/67/f0/9b90ca2a210b3d09bcfcd96ecd0f55545c091535abce2a45de2775cfd357/propcache-0.5.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:10734b5484ea113152ee25a91dccedf81631791805d2c9ccb054958e51842c94", size = 56696, upload-time = "2026-05-08T21:01:02.941Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/0e/6e9d4ba07c8e56e21ddec1e75f12148142b21ca83a51871babce095334f4/propcache-0.5.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cafca7e56c12bb02ae16d283742bef25a61122e9dab2b5b3f2ccbe589ce32164", size = 62378, upload-time = "2026-05-08T21:01:04.475Z" },
+    { url = "https://files.pythonhosted.org/packages/65/19/c10badaa463dde8a27ce884f8ee2ec37e6035b7c9f5ff0c8f74f06f08dac/propcache-0.5.2-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f064f8d2b59177878b7615df1735cd8fe3462ed6be8c7b217d17a276489c2b7f", size = 65283, upload-time = "2026-05-08T21:01:05.959Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/b6/93bea99ca80e19cef6512a8580e5b7857bbe09422d9daa7fd4ef5723306c/propcache-0.5.2-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f78abfa8dfc32376fd1aacf597b2f2fbbe0ea751419aee718af5d4f82537ef8c", size = 66616, upload-time = "2026-05-08T21:01:07.228Z" },
+    { url = "https://files.pythonhosted.org/packages/83/e4/5c7462e50625f051f37fb38b8224f7639f667184bbd34424ec83819bb1b7/propcache-0.5.2-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f7467da8a9822bf1a55336f877340c5bcbd3c482afc43a99771169f74a26dedc", size = 63773, upload-time = "2026-05-08T21:01:08.514Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/b6/99238894047b13c823be25027e736626cd414a52a5e30d2c3347c2733529/propcache-0.5.2-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a6ddc6ac9e25de626c1f129c1b467d7ecd33ce2237d3fd0c4e429feef0a7ee1f", size = 63664, upload-time = "2026-05-08T21:01:09.874Z" },
+    { url = "https://files.pythonhosted.org/packages/85/1e/a3a1a63116a2b8edb415a8bb9a6f0c34bd03830b1e18e8ce2904e1dc1cf4/propcache-0.5.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:2f22cbbac9e26a8e864c0985ff1268d5d939d53d9d9411a9824279097e03a2cb", size = 62643, upload-time = "2026-05-08T21:01:11.132Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/03/893cf147de2fc6543c5eaa07ad833170e7e2a2385725bbebe8c0503723bb/propcache-0.5.2-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:fc76378c62a0f04d0cd82fbb1a2cd2d7e28fcb40d5873f28a6c44e388aaa2751", size = 59595, upload-time = "2026-05-08T21:01:12.387Z" },
+    { url = "https://files.pythonhosted.org/packages/86/3b/04c1a2e12c57766568ba75ba72b3bf2042818d4c1425fab6fc07155c7cff/propcache-0.5.2-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:acd2c8edba48e31e58a363b8cf4e5c7db3b04b3f9e371f601df30d9b0d244836", size = 65711, upload-time = "2026-05-08T21:01:13.676Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/34/80f8d0099f8d6bacc4de1624c85672681c8cd1149ca2da0e38fd120b817f/propcache-0.5.2-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:452b5065457eb9991ec5eb38ff41d6cd4c991c9ac7c531c4d5849ae473a9a13f", size = 64247, upload-time = "2026-05-08T21:01:14.936Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/1a/8b08f3a5f1037e9e370c55883ceeeee0f6dd0416fb2d2d67b8bfc91f2a79/propcache-0.5.2-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:3430bb2bfe1331885c427745a751e774ee679fd4344f80b97bf879815fe8fa55", size = 67102, upload-time = "2026-05-08T21:01:16.281Z" },
+    { url = "https://files.pythonhosted.org/packages/34/68/8bdb7bb7756d76e005490649d10e4a8369e610c74d619f71e1aedf889e9c/propcache-0.5.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:cef6cea3922890dd6c9654971001fa797b526c16ab5e1e46c05fd6f877be7568", size = 64964, upload-time = "2026-05-08T21:01:17.57Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/aa/50fb0b5d3968b61a510926ff8b8465f1d6e976b3ab74496d7a4b9fc42515/propcache-0.5.2-cp313-cp313t-win32.whl", hash = "sha256:72d61e16dd78228b58c5d47be830ff3da7e5f139abdf0aef9d86cde1c5cf2191", size = 42546, upload-time = "2026-05-08T21:01:18.946Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/4c/0ddbae64321bd4a95bcbfc19307238016b5b1fee645c84626c8d539e5b74/propcache-0.5.2-cp313-cp313t-win_amd64.whl", hash = "sha256:0958834041a0166d343b8d2cedcd8bcbaeb4fdbe0cf08320c5379f143c3be6e7", size = 46330, upload-time = "2026-05-08T21:01:20.162Z" },
+    { url = "https://files.pythonhosted.org/packages/00/d9/9cddc8efb78d8af264c5ec9f6d10b62f57c515feda8d321595f56010fb23/propcache-0.5.2-cp313-cp313t-win_arm64.whl", hash = "sha256:6de8bd93ddde9b992cf2b2e0d796d501a19026b5b9fd87356d7d0779531a8d96", size = 40521, upload-time = "2026-05-08T21:01:21.399Z" },
     { url = "https://files.pythonhosted.org/packages/3a/ed/1cdcab6ba3d6ab7feca11fc14f0eeea80755bb53ef4e892079f31b10a25f/propcache-0.5.2-py3-none-any.whl", hash = "sha256:be1ddfcbb376e3de5d2e2db1d58d6d67463e6b4f9f040c000de8e300295465fe", size = 14036, upload-time = "2026-05-08T21:02:10.673Z" },
 ]
 
@@ -3241,7 +3519,7 @@ wheels = [
 
 [[package]]
 name = "prowler"
-version = "5.30.0"
+version = "5.31.0"
 source = { editable = "." }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },
@@ -3258,7 +3536,6 @@ dependencies = [
     { name = "alibabacloud-tea-openapi" },
     { name = "alibabacloud-vpc20160428" },
     { name = "alive-progress" },
-    { name = "awsipranges" },
     { name = "azure-identity" },
     { name = "azure-keyvault-keys" },
     { name = "azure-mgmt-apimanagement" },
@@ -3321,6 +3598,7 @@ dependencies = [
     { name = "slack-sdk" },
     { name = "stackit-core" },
     { name = "stackit-iaas" },
+    { name = "stackit-objectstorage" },
     { name = "stackit-resourcemanager" },
     { name = "tabulate" },
     { name = "tzlocal" },
@@ -3366,7 +3644,6 @@ requires-dist = [
     { name = "alibabacloud-tea-openapi", specifier = "==0.4.4" },
     { name = "alibabacloud-vpc20160428", specifier = "==6.13.0" },
     { name = "alive-progress", specifier = "==3.3.0" },
-    { name = "awsipranges", specifier = "==0.3.3" },
     { name = "azure-identity", specifier = "==1.21.0" },
     { name = "azure-keyvault-keys", specifier = "==4.10.0" },
     { name = "azure-mgmt-apimanagement", specifier = "==5.0.0" },
@@ -3403,21 +3680,21 @@ requires-dist = [
     { name = "dash-bootstrap-components", specifier = "==2.0.3" },
     { name = "defusedxml", specifier = "==0.7.1" },
     { name = "detect-secrets", specifier = "==1.5.0" },
-    { name = "dulwich", specifier = "==0.23.0" },
+    { name = "dulwich", specifier = "==1.2.5" },
     { name = "google-api-python-client", specifier = "==2.163.0" },
     { name = "google-auth-httplib2", specifier = "==0.2.0" },
     { name = "h2", specifier = "==4.3.0" },
     { name = "jsonschema", specifier = "==4.23.0" },
     { name = "kubernetes", specifier = "==32.0.1" },
     { name = "markdown", specifier = "==3.10.2" },
-    { name = "microsoft-kiota-abstractions", specifier = "==1.9.2" },
+    { name = "microsoft-kiota-abstractions", specifier = "==1.9.9" },
     { name = "msgraph-sdk", specifier = "==1.55.0" },
-    { name = "numpy", specifier = "==2.0.2" },
+    { name = "numpy", specifier = "==2.2.6" },
     { name = "oci", specifier = "==2.169.0" },
     { name = "okta", specifier = "==3.4.2" },
     { name = "openstacksdk", specifier = "==4.2.0" },
     { name = "pandas", specifier = "==2.2.3" },
-    { name = "py-iam-expand", specifier = "==0.1.0" },
+    { name = "py-iam-expand", specifier = "==0.3.0" },
     { name = "py-ocsf-models", specifier = "==0.8.1" },
     { name = "pydantic", specifier = "==2.12.5" },
     { name = "pygithub", specifier = "==2.8.0" },
@@ -3429,6 +3706,7 @@ requires-dist = [
     { name = "slack-sdk", specifier = "==3.39.0" },
     { name = "stackit-core", specifier = "==0.2.0" },
     { name = "stackit-iaas", specifier = "==1.4.0" },
+    { name = "stackit-objectstorage", specifier = "==1.4.0" },
     { name = "stackit-resourcemanager", specifier = "==0.8.0" },
     { name = "tabulate", specifier = "==0.9.0" },
     { name = "tzlocal", specifier = "==5.3.1" },
@@ -3438,7 +3716,7 @@ requires-dist = [
 [package.metadata.requires-dev]
 dev = [
     { name = "bandit", specifier = "==1.8.3" },
-    { name = "black", specifier = "==25.1.0" },
+    { name = "black", specifier = "==26.3.1" },
     { name = "coverage", specifier = "==7.6.12" },
     { name = "docker", specifier = "==7.1.0" },
     { name = "filelock", specifier = "==3.20.3" },
@@ -3450,7 +3728,7 @@ dev = [
     { name = "openapi-spec-validator", specifier = "==0.7.1" },
     { name = "prek", specifier = "==0.3.9" },
     { name = "pylint", specifier = "==3.3.4" },
-    { name = "pytest", specifier = "==8.3.5" },
+    { name = "pytest", specifier = "==9.0.3" },
     { name = "pytest-cov", specifier = "==6.0.0" },
     { name = "pytest-env", specifier = "==1.1.5" },
     { name = "pytest-randomly", specifier = "==3.16.0" },
@@ -3464,6 +3742,12 @@ version = "7.2.2"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/aa/c6/d1ddf4abb55e93cebc4f2ed8b5d6dbad109ecb8d63748dd2b20ab5e57ebe/psutil-7.2.2.tar.gz", hash = "sha256:0746f5f8d406af344fd547f1c8daa5f5c33dbc293bb8d6a16d80b4bb88f59372", size = 493740, upload-time = "2026-01-28T18:14:54.428Z" }
 wheels = [
+    { url = "https://files.pythonhosted.org/packages/51/08/510cbdb69c25a96f4ae523f733cdc963ae654904e8db864c07585ef99875/psutil-7.2.2-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:2edccc433cbfa046b980b0df0171cd25bcaeb3a68fe9022db0979e7aa74a826b", size = 130595, upload-time = "2026-01-28T18:14:57.293Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/f5/97baea3fe7a5a9af7436301f85490905379b1c6f2dd51fe3ecf24b4c5fbf/psutil-7.2.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:e78c8603dcd9a04c7364f1a3e670cea95d51ee865e4efb3556a3a63adef958ea", size = 131082, upload-time = "2026-01-28T18:14:59.732Z" },
+    { url = "https://files.pythonhosted.org/packages/37/d6/246513fbf9fa174af531f28412297dd05241d97a75911ac8febefa1a53c6/psutil-7.2.2-cp313-cp313t-manylinux2010_x86_64.manylinux_2_12_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1a571f2330c966c62aeda00dd24620425d4b0cc86881c89861fbc04549e5dc63", size = 181476, upload-time = "2026-01-28T18:15:01.884Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/b5/9182c9af3836cca61696dabe4fd1304e17bc56cb62f17439e1154f225dd3/psutil-7.2.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:917e891983ca3c1887b4ef36447b1e0873e70c933afc831c6b6da078ba474312", size = 184062, upload-time = "2026-01-28T18:15:04.436Z" },
+    { url = "https://files.pythonhosted.org/packages/16/ba/0756dca669f5a9300d0cbcbfae9a4c30e446dfc7440ffe43ded5724bfd93/psutil-7.2.2-cp313-cp313t-win_amd64.whl", hash = "sha256:ab486563df44c17f5173621c7b198955bd6b613fb87c71c161f827d3fb149a9b", size = 139893, upload-time = "2026-01-28T18:15:06.378Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/61/8fa0e26f33623b49949346de05ec1ddaad02ed8ba64af45f40a147dbfa97/psutil-7.2.2-cp313-cp313t-win_arm64.whl", hash = "sha256:ae0aefdd8796a7737eccea863f80f81e468a1e4cf14d926bd9b6f5f2d5f90ca9", size = 135589, upload-time = "2026-01-28T18:15:08.03Z" },
     { url = "https://files.pythonhosted.org/packages/e7/36/5ee6e05c9bd427237b11b3937ad82bb8ad2752d72c6969314590dd0c2f6e/psutil-7.2.2-cp36-abi3-macosx_10_9_x86_64.whl", hash = "sha256:ed0cace939114f62738d808fdcecd4c869222507e266e574799e9c0faa17d486", size = 129090, upload-time = "2026-01-28T18:15:22.168Z" },
     { url = "https://files.pythonhosted.org/packages/80/c4/f5af4c1ca8c1eeb2e92ccca14ce8effdeec651d5ab6053c589b074eda6e1/psutil-7.2.2-cp36-abi3-macosx_11_0_arm64.whl", hash = "sha256:1a7b04c10f32cc88ab39cbf606e117fd74721c831c98a27dc04578deb0c16979", size = 129859, upload-time = "2026-01-28T18:15:23.795Z" },
     { url = "https://files.pythonhosted.org/packages/b5/70/5d8df3b09e25bce090399cf48e452d25c935ab72dad19406c77f4e828045/psutil-7.2.2-cp36-abi3-manylinux2010_x86_64.manylinux_2_12_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:076a2d2f923fd4821644f5ba89f059523da90dc9014e85f8e45a5774ca5bc6f9", size = 155560, upload-time = "2026-01-28T18:15:25.976Z" },
@@ -3476,14 +3760,14 @@ wheels = [
 
 [[package]]
 name = "py-iam-expand"
-version = "0.1.0"
+version = "0.3.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "iamdata" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/22/99/8d31a30b37825577275bb3663885b55075fba80257fcd6813b85d3aaffa8/py_iam_expand-0.1.0.tar.gz", hash = "sha256:5a2884dc267ac59a02c3a80fefc0b34c309dac681baa0f87c436067c6cf53a96", size = 10228, upload-time = "2025-04-30T07:15:35.304Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a3/08/f6e11a029b81f0bec4b7b1f18704aadf509a882cc386c90ef1ac043c18cc/py_iam_expand-0.3.0.tar.gz", hash = "sha256:4ccfe25f40ba0633a152c4f86b49cde8972ee3d4b6009b017a4310cc4b9e64c7", size = 10234, upload-time = "2026-02-24T09:47:47.772Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/79/19/482c2e0768cda7afaed07918e4fbd951e2418255fb5d1d9b35b284871716/py_iam_expand-0.1.0-py3-none-any.whl", hash = "sha256:b845ce7b50ac895b02b4f338e09c62a68ea51849794f76e189b02009bd388510", size = 12522, upload-time = "2025-04-30T07:15:33.799Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/dd/4056d0bc3d6317039d2dd2ee7cd6a5389575603e270399a8f9f20e11e721/py_iam_expand-0.3.0-py3-none-any.whl", hash = "sha256:94c0a1e9dd60316ce60ddc0cdc9a046119bde335b5bb9593ee29224857860d5a", size = 12527, upload-time = "2026-02-24T09:47:45.602Z" },
 ]
 
 [[package]]
@@ -3554,6 +3838,17 @@ version = "3.23.0"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/c9/85/e24bf90972a30b0fcd16c73009add1d7d7cd9140c2498a68252028899e41/pycryptodomex-3.23.0.tar.gz", hash = "sha256:71909758f010c82bc99b0abf4ea12012c98962fbf0583c2164f8b84533c2e4da", size = 4922157, upload-time = "2025-05-17T17:23:41.434Z" }
 wheels = [
+    { url = "https://files.pythonhosted.org/packages/2e/00/10edb04777069a42490a38c137099d4b17ba6e36a4e6e28bdc7470e9e853/pycryptodomex-3.23.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:7b37e08e3871efe2187bc1fd9320cc81d87caf19816c648f24443483005ff886", size = 2498764, upload-time = "2025-05-17T17:22:21.453Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/3f/2872a9c2d3a27eac094f9ceaa5a8a483b774ae69018040ea3240d5b11154/pycryptodomex-3.23.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:91979028227543010d7b2ba2471cf1d1e398b3f183cb105ac584df0c36dac28d", size = 1643012, upload-time = "2025-05-17T17:22:23.702Z" },
+    { url = "https://files.pythonhosted.org/packages/70/af/774c2e2b4f6570fbf6a4972161adbb183aeeaa1863bde31e8706f123bf92/pycryptodomex-3.23.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6b8962204c47464d5c1c4038abeadd4514a133b28748bcd9fa5b6d62e3cec6fa", size = 2187643, upload-time = "2025-05-17T17:22:26.37Z" },
+    { url = "https://files.pythonhosted.org/packages/de/a3/71065b24cb889d537954cedc3ae5466af00a2cabcff8e29b73be047e9a19/pycryptodomex-3.23.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a33986a0066860f7fcf7c7bd2bc804fa90e434183645595ae7b33d01f3c91ed8", size = 2273762, upload-time = "2025-05-17T17:22:28.313Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/0b/ff6f43b7fbef4d302c8b981fe58467b8871902cdc3eb28896b52421422cc/pycryptodomex-3.23.0-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7947ab8d589e3178da3d7cdeabe14f841b391e17046954f2fbcd941705762b5", size = 2313012, upload-time = "2025-05-17T17:22:30.57Z" },
+    { url = "https://files.pythonhosted.org/packages/02/de/9d4772c0506ab6da10b41159493657105d3f8bb5c53615d19452afc6b315/pycryptodomex-3.23.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:c25e30a20e1b426e1f0fa00131c516f16e474204eee1139d1603e132acffc314", size = 2186856, upload-time = "2025-05-17T17:22:32.819Z" },
+    { url = "https://files.pythonhosted.org/packages/28/ad/8b30efcd6341707a234e5eba5493700a17852ca1ac7a75daa7945fcf6427/pycryptodomex-3.23.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:da4fa650cef02db88c2b98acc5434461e027dce0ae8c22dd5a69013eaf510006", size = 2347523, upload-time = "2025-05-17T17:22:35.386Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/02/16868e9f655b7670dbb0ac4f2844145cbc42251f916fc35c414ad2359849/pycryptodomex-3.23.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:58b851b9effd0d072d4ca2e4542bf2a4abcf13c82a29fd2c93ce27ee2a2e9462", size = 2272825, upload-time = "2025-05-17T17:22:37.632Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/18/4ca89ac737230b52ac8ffaca42f9c6f1fd07c81a6cd821e91af79db60632/pycryptodomex-3.23.0-cp313-cp313t-win32.whl", hash = "sha256:a9d446e844f08299236780f2efa9898c818fe7e02f17263866b8550c7d5fb328", size = 1772078, upload-time = "2025-05-17T17:22:40Z" },
+    { url = "https://files.pythonhosted.org/packages/73/34/13e01c322db027682e00986873eca803f11c56ade9ba5bbf3225841ea2d4/pycryptodomex-3.23.0-cp313-cp313t-win_amd64.whl", hash = "sha256:bc65bdd9fc8de7a35a74cab1c898cab391a4add33a8fe740bda00f5976ca4708", size = 1803656, upload-time = "2025-05-17T17:22:42.139Z" },
+    { url = "https://files.pythonhosted.org/packages/54/68/9504c8796b1805d58f4425002bcca20f12880e6fa4dc2fc9a668705c7a08/pycryptodomex-3.23.0-cp313-cp313t-win_arm64.whl", hash = "sha256:c885da45e70139464f082018ac527fdaad26f1657a99ee13eecdce0f0ca24ab4", size = 1707172, upload-time = "2025-05-17T17:22:44.704Z" },
     { url = "https://files.pythonhosted.org/packages/dd/9c/1a8f35daa39784ed8adf93a694e7e5dc15c23c741bbda06e1d45f8979e9e/pycryptodomex-3.23.0-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:06698f957fe1ab229a99ba2defeeae1c09af185baa909a31a5d1f9d42b1aaed6", size = 2499240, upload-time = "2025-05-17T17:22:46.953Z" },
     { url = "https://files.pythonhosted.org/packages/7a/62/f5221a191a97157d240cf6643747558759126c76ee92f29a3f4aee3197a5/pycryptodomex-3.23.0-cp37-abi3-macosx_10_9_x86_64.whl", hash = "sha256:b2c2537863eccef2d41061e82a881dcabb04944c5c06c5aa7110b577cc487545", size = 1644042, upload-time = "2025-05-17T17:22:49.098Z" },
     { url = "https://files.pythonhosted.org/packages/8c/fd/5a054543c8988d4ed7b612721d7e78a4b9bf36bc3c5ad45ef45c22d0060e/pycryptodomex-3.23.0-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:43c446e2ba8df8889e0e16f02211c25b4934898384c1ec1ec04d7889c0333587", size = 2186227, upload-time = "2025-05-17T17:22:51.139Z" },
@@ -3637,6 +3932,20 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/49/3b/774f2b5cd4192d5ab75870ce4381fd89cf218af999515baf07e7206753f0/pydantic_core-2.41.5-cp312-cp312-win32.whl", hash = "sha256:b74557b16e390ec12dca509bce9264c3bbd128f8a2c376eaa68003d7f327276d", size = 1985908, upload-time = "2025-11-04T13:40:19.309Z" },
     { url = "https://files.pythonhosted.org/packages/86/45/00173a033c801cacf67c190fef088789394feaf88a98a7035b0e40d53dc9/pydantic_core-2.41.5-cp312-cp312-win_amd64.whl", hash = "sha256:1962293292865bca8e54702b08a4f26da73adc83dd1fcf26fbc875b35d81c815", size = 2020145, upload-time = "2025-11-04T13:40:21.548Z" },
     { url = "https://files.pythonhosted.org/packages/f9/22/91fbc821fa6d261b376a3f73809f907cec5ca6025642c463d3488aad22fb/pydantic_core-2.41.5-cp312-cp312-win_arm64.whl", hash = "sha256:1746d4a3d9a794cacae06a5eaaccb4b8643a131d45fbc9af23e353dc0a5ba5c3", size = 1976179, upload-time = "2025-11-04T13:40:23.393Z" },
+    { url = "https://files.pythonhosted.org/packages/87/06/8806241ff1f70d9939f9af039c6c35f2360cf16e93c2ca76f184e76b1564/pydantic_core-2.41.5-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:941103c9be18ac8daf7b7adca8228f8ed6bb7a1849020f643b3a14d15b1924d9", size = 2120403, upload-time = "2025-11-04T13:40:25.248Z" },
+    { url = "https://files.pythonhosted.org/packages/94/02/abfa0e0bda67faa65fef1c84971c7e45928e108fe24333c81f3bfe35d5f5/pydantic_core-2.41.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:112e305c3314f40c93998e567879e887a3160bb8689ef3d2c04b6cc62c33ac34", size = 1896206, upload-time = "2025-11-04T13:40:27.099Z" },
+    { url = "https://files.pythonhosted.org/packages/15/df/a4c740c0943e93e6500f9eb23f4ca7ec9bf71b19e608ae5b579678c8d02f/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0cbaad15cb0c90aa221d43c00e77bb33c93e8d36e0bf74760cd00e732d10a6a0", size = 1919307, upload-time = "2025-11-04T13:40:29.806Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/e3/6324802931ae1d123528988e0e86587c2072ac2e5394b4bc2bc34b61ff6e/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:03ca43e12fab6023fc79d28ca6b39b05f794ad08ec2feccc59a339b02f2b3d33", size = 2063258, upload-time = "2025-11-04T13:40:33.544Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/d4/2230d7151d4957dd79c3044ea26346c148c98fbf0ee6ebd41056f2d62ab5/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:dc799088c08fa04e43144b164feb0c13f9a0bc40503f8df3e9fde58a3c0c101e", size = 2214917, upload-time = "2025-11-04T13:40:35.479Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/9f/eaac5df17a3672fef0081b6c1bb0b82b33ee89aa5cec0d7b05f52fd4a1fa/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:97aeba56665b4c3235a0e52b2c2f5ae9cd071b8a8310ad27bddb3f7fb30e9aa2", size = 2332186, upload-time = "2025-11-04T13:40:37.436Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/4e/35a80cae583a37cf15604b44240e45c05e04e86f9cfd766623149297e971/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:406bf18d345822d6c21366031003612b9c77b3e29ffdb0f612367352aab7d586", size = 2073164, upload-time = "2025-11-04T13:40:40.289Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/e3/f6e262673c6140dd3305d144d032f7bd5f7497d3871c1428521f19f9efa2/pydantic_core-2.41.5-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b93590ae81f7010dbe380cdeab6f515902ebcbefe0b9327cc4804d74e93ae69d", size = 2179146, upload-time = "2025-11-04T13:40:42.809Z" },
+    { url = "https://files.pythonhosted.org/packages/75/c7/20bd7fc05f0c6ea2056a4565c6f36f8968c0924f19b7d97bbfea55780e73/pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:01a3d0ab748ee531f4ea6c3e48ad9dac84ddba4b0d82291f87248f2f9de8d740", size = 2137788, upload-time = "2025-11-04T13:40:44.752Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/8d/34318ef985c45196e004bc46c6eab2eda437e744c124ef0dbe1ff2c9d06b/pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:6561e94ba9dacc9c61bce40e2d6bdc3bfaa0259d3ff36ace3b1e6901936d2e3e", size = 2340133, upload-time = "2025-11-04T13:40:46.66Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/59/013626bf8c78a5a5d9350d12e7697d3d4de951a75565496abd40ccd46bee/pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:915c3d10f81bec3a74fbd4faebe8391013ba61e5a1a8d48c4455b923bdda7858", size = 2324852, upload-time = "2025-11-04T13:40:48.575Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/d9/c248c103856f807ef70c18a4f986693a46a8ffe1602e5d361485da502d20/pydantic_core-2.41.5-cp313-cp313-win32.whl", hash = "sha256:650ae77860b45cfa6e2cdafc42618ceafab3a2d9a3811fcfbd3bbf8ac3c40d36", size = 1994679, upload-time = "2025-11-04T13:40:50.619Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/8b/341991b158ddab181cff136acd2552c9f35bd30380422a639c0671e99a91/pydantic_core-2.41.5-cp313-cp313-win_amd64.whl", hash = "sha256:79ec52ec461e99e13791ec6508c722742ad745571f234ea6255bed38c6480f11", size = 2019766, upload-time = "2025-11-04T13:40:52.631Z" },
+    { url = "https://files.pythonhosted.org/packages/73/7d/f2f9db34af103bea3e09735bb40b021788a5e834c81eedb541991badf8f5/pydantic_core-2.41.5-cp313-cp313-win_arm64.whl", hash = "sha256:3f84d5c1b4ab906093bdc1ff10484838aca54ef08de4afa9de0f5f14d69639cd", size = 1981005, upload-time = "2025-11-04T13:40:54.734Z" },
     { url = "https://files.pythonhosted.org/packages/11/72/90fda5ee3b97e51c494938a4a44c3a35a9c96c19bba12372fb9c634d6f57/pydantic_core-2.41.5-graalpy311-graalpy242_311_native-macosx_10_12_x86_64.whl", hash = "sha256:b96d5f26b05d03cc60f11a7761a5ded1741da411e7fe0909e27a5e6a0cb7b034", size = 2115441, upload-time = "2025-11-04T13:42:39.557Z" },
     { url = "https://files.pythonhosted.org/packages/1f/53/8942f884fa33f50794f119012dc6a1a02ac43a56407adaac20463df8e98f/pydantic_core-2.41.5-graalpy311-graalpy242_311_native-macosx_11_0_arm64.whl", hash = "sha256:634e8609e89ceecea15e2d61bc9ac3718caaaa71963717bf3c8f38bfde64242c", size = 1930291, upload-time = "2025-11-04T13:42:42.169Z" },
     { url = "https://files.pythonhosted.org/packages/79/c8/ecb9ed9cd942bce09fc888ee960b52654fbdbede4ba6c2d6e0d3b1d8b49c/pydantic_core-2.41.5-graalpy311-graalpy242_311_native-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:93e8740d7503eb008aa2df04d3b9735f845d43ae845e6dcd2be0b55a2da43cd2", size = 1948632, upload-time = "2025-11-04T13:42:44.564Z" },
@@ -3711,14 +4020,14 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.12.1"
+version = "2.13.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c2/27/a3b6e5bf6ff856d2509292e95c8f57f0df7017cf5394921fc4e4ef40308a/pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b", size = 102564, upload-time = "2026-03-13T19:27:37.25Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
 ]
 
 [package.optional-dependencies]
@@ -3774,7 +4083,7 @@ version = "26.2.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/1a/51/27a5ad5f939d08f690a326ef9582cda7140555180db71695f6fb747d6a36/pyopenssl-26.2.0.tar.gz", hash = "sha256:8c6fcecd1183a7fc897548dfe388b0cdb7f37e018200d8409cf33959dbe35387", size = 182195, upload-time = "2026-05-04T23:06:09.72Z" }
 wheels = [
@@ -3792,7 +4101,7 @@ wheels = [
 
 [[package]]
 name = "pytest"
-version = "8.3.5"
+version = "9.0.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -3800,11 +4109,12 @@ dependencies = [
     { name = "iniconfig" },
     { name = "packaging" },
     { name = "pluggy" },
+    { name = "pygments" },
     { name = "tomli", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ae/3c/c9d525a414d506893f0cd8a8d0de7706446213181570cdbd766691164e40/pytest-8.3.5.tar.gz", hash = "sha256:f4efe70cc14e511565ac476b57c279e12a855b11f48f212af1080ef2263d3845", size = 1450891, upload-time = "2025-03-02T12:54:54.503Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/30/3d/64ad57c803f1fa1e963a7946b6e0fea4a70df53c1a7fed304586539c2bac/pytest-8.3.5-py3-none-any.whl", hash = "sha256:c69214aa47deac29fad6c2a4f590b9c4a9fdb16a403176fe154b79c0b4d4d820", size = 343634, upload-time = "2025-03-02T12:54:52.069Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
 ]
 
 [[package]]
@@ -3870,6 +4180,35 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
 ]
 
+[[package]]
+name = "pytokens"
+version = "0.4.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b6/34/b4e015b99031667a7b960f888889c5bd34ef585c85e1cb56a594b92836ac/pytokens-0.4.1.tar.gz", hash = "sha256:292052fe80923aae2260c073f822ceba21f3872ced9a68bb7953b348e561179a", size = 23015, upload-time = "2026-01-30T01:03:45.924Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/42/24/f206113e05cb8ef51b3850e7ef88f20da6f4bf932190ceb48bd3da103e10/pytokens-0.4.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:2a44ed93ea23415c54f3face3b65ef2b844d96aeb3455b8a69b3df6beab6acc5", size = 161522, upload-time = "2026-01-30T01:02:50.393Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/e9/06a6bf1b90c2ed81a9c7d2544232fe5d2891d1cd480e8a1809ca354a8eb2/pytokens-0.4.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:add8bf86b71a5d9fb5b89f023a80b791e04fba57960aa790cc6125f7f1d39dfe", size = 246945, upload-time = "2026-01-30T01:02:52.399Z" },
+    { url = "https://files.pythonhosted.org/packages/69/66/f6fb1007a4c3d8b682d5d65b7c1fb33257587a5f782647091e3408abe0b8/pytokens-0.4.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:670d286910b531c7b7e3c0b453fd8156f250adb140146d234a82219459b9640c", size = 259525, upload-time = "2026-01-30T01:02:53.737Z" },
+    { url = "https://files.pythonhosted.org/packages/04/92/086f89b4d622a18418bac74ab5db7f68cf0c21cf7cc92de6c7b919d76c88/pytokens-0.4.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:4e691d7f5186bd2842c14813f79f8884bb03f5995f0575272009982c5ac6c0f7", size = 262693, upload-time = "2026-01-30T01:02:54.871Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/7b/8b31c347cf94a3f900bdde750b2e9131575a61fdb620d3d3c75832262137/pytokens-0.4.1-cp310-cp310-win_amd64.whl", hash = "sha256:27b83ad28825978742beef057bfe406ad6ed524b2d28c252c5de7b4a6dd48fa2", size = 103567, upload-time = "2026-01-30T01:02:56.414Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/92/790ebe03f07b57e53b10884c329b9a1a308648fc083a6d4a39a10a28c8fc/pytokens-0.4.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:d70e77c55ae8380c91c0c18dea05951482e263982911fc7410b1ffd1dadd3440", size = 160864, upload-time = "2026-01-30T01:02:57.882Z" },
+    { url = "https://files.pythonhosted.org/packages/13/25/a4f555281d975bfdd1eba731450e2fe3a95870274da73fb12c40aeae7625/pytokens-0.4.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4a58d057208cb9075c144950d789511220b07636dd2e4708d5645d24de666bdc", size = 248565, upload-time = "2026-01-30T01:02:59.912Z" },
+    { url = "https://files.pythonhosted.org/packages/17/50/bc0394b4ad5b1601be22fa43652173d47e4c9efbf0044c62e9a59b747c56/pytokens-0.4.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b49750419d300e2b5a3813cf229d4e5a4c728dae470bcc89867a9ad6f25a722d", size = 260824, upload-time = "2026-01-30T01:03:01.471Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/54/3e04f9d92a4be4fc6c80016bc396b923d2a6933ae94b5f557c939c460ee0/pytokens-0.4.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:d9907d61f15bf7261d7e775bd5d7ee4d2930e04424bab1972591918497623a16", size = 264075, upload-time = "2026-01-30T01:03:04.143Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/1b/44b0326cb5470a4375f37988aea5d61b5cc52407143303015ebee94abfd6/pytokens-0.4.1-cp311-cp311-win_amd64.whl", hash = "sha256:ee44d0f85b803321710f9239f335aafe16553b39106384cef8e6de40cb4ef2f6", size = 103323, upload-time = "2026-01-30T01:03:05.412Z" },
+    { url = "https://files.pythonhosted.org/packages/41/5d/e44573011401fb82e9d51e97f1290ceb377800fb4eed650b96f4753b499c/pytokens-0.4.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:140709331e846b728475786df8aeb27d24f48cbcf7bcd449f8de75cae7a45083", size = 160663, upload-time = "2026-01-30T01:03:06.473Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/e6/5bbc3019f8e6f21d09c41f8b8654536117e5e211a85d89212d59cbdab381/pytokens-0.4.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6d6c4268598f762bc8e91f5dbf2ab2f61f7b95bdc07953b602db879b3c8c18e1", size = 255626, upload-time = "2026-01-30T01:03:08.177Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/3c/2d5297d82286f6f3d92770289fd439956b201c0a4fc7e72efb9b2293758e/pytokens-0.4.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:24afde1f53d95348b5a0eb19488661147285ca4dd7ed752bbc3e1c6242a304d1", size = 269779, upload-time = "2026-01-30T01:03:09.756Z" },
+    { url = "https://files.pythonhosted.org/packages/20/01/7436e9ad693cebda0551203e0bf28f7669976c60ad07d6402098208476de/pytokens-0.4.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5ad948d085ed6c16413eb5fec6b3e02fa00dc29a2534f088d3302c47eb59adf9", size = 268076, upload-time = "2026-01-30T01:03:10.957Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/df/533c82a3c752ba13ae7ef238b7f8cdd272cf1475f03c63ac6cf3fcfb00b6/pytokens-0.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:3f901fe783e06e48e8cbdc82d631fca8f118333798193e026a50ce1b3757ea68", size = 103552, upload-time = "2026-01-30T01:03:12.066Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/dc/08b1a080372afda3cceb4f3c0a7ba2bde9d6a5241f1edb02a22a019ee147/pytokens-0.4.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:8bdb9d0ce90cbf99c525e75a2fa415144fd570a1ba987380190e8b786bc6ef9b", size = 160720, upload-time = "2026-01-30T01:03:13.843Z" },
+    { url = "https://files.pythonhosted.org/packages/64/0c/41ea22205da480837a700e395507e6a24425151dfb7ead73343d6e2d7ffe/pytokens-0.4.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5502408cab1cb18e128570f8d598981c68a50d0cbd7c61312a90507cd3a1276f", size = 254204, upload-time = "2026-01-30T01:03:14.886Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/d2/afe5c7f8607018beb99971489dbb846508f1b8f351fcefc225fcf4b2adc0/pytokens-0.4.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:29d1d8fb1030af4d231789959f21821ab6325e463f0503a61d204343c9b355d1", size = 268423, upload-time = "2026-01-30T01:03:15.936Z" },
+    { url = "https://files.pythonhosted.org/packages/68/d4/00ffdbd370410c04e9591da9220a68dc1693ef7499173eb3e30d06e05ed1/pytokens-0.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:970b08dd6b86058b6dc07efe9e98414f5102974716232d10f32ff39701e841c4", size = 266859, upload-time = "2026-01-30T01:03:17.458Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/c9/c3161313b4ca0c601eeefabd3d3b576edaa9afdefd32da97210700e47652/pytokens-0.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:9bd7d7f544d362576be74f9d5901a22f317efc20046efe2034dced238cbbfe78", size = 103520, upload-time = "2026-01-30T01:03:18.652Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/78/397db326746f0a342855b81216ae1f0a32965deccfd7c830a2dbc66d2483/pytokens-0.4.1-py3-none-any.whl", hash = "sha256:26cef14744a8385f35d0e095dc8b3a7583f6c953c2e3d269c7f82484bf5ad2de", size = 13729, upload-time = "2026-01-30T01:03:45.029Z" },
+]
+
 [[package]]
 name = "pytz"
 version = "2025.1"
@@ -3893,6 +4232,9 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/e7/ab/01ea1943d4eba0f850c3c61e78e8dd59757ff815ff3ccd0a84de5f541f42/pywin32-311-cp312-cp312-win32.whl", hash = "sha256:750ec6e621af2b948540032557b10a2d43b0cee2ae9758c54154d711cc852d31", size = 8706543, upload-time = "2025-07-14T20:13:20.765Z" },
     { url = "https://files.pythonhosted.org/packages/d1/a8/a0e8d07d4d051ec7502cd58b291ec98dcc0c3fff027caad0470b72cfcc2f/pywin32-311-cp312-cp312-win_amd64.whl", hash = "sha256:b8c095edad5c211ff31c05223658e71bf7116daa0ecf3ad85f3201ea3190d067", size = 9495040, upload-time = "2025-07-14T20:13:22.543Z" },
     { url = "https://files.pythonhosted.org/packages/ba/3a/2ae996277b4b50f17d61f0603efd8253cb2d79cc7ae159468007b586396d/pywin32-311-cp312-cp312-win_arm64.whl", hash = "sha256:e286f46a9a39c4a18b319c28f59b61de793654af2f395c102b4f819e584b5852", size = 8710102, upload-time = "2025-07-14T20:13:24.682Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/be/3fd5de0979fcb3994bfee0d65ed8ca9506a8a1260651b86174f6a86f52b3/pywin32-311-cp313-cp313-win32.whl", hash = "sha256:f95ba5a847cba10dd8c4d8fefa9f2a6cf283b8b88ed6178fa8a6c1ab16054d0d", size = 8705700, upload-time = "2025-07-14T20:13:26.471Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/28/e0a1909523c6890208295a29e05c2adb2126364e289826c0a8bc7297bd5c/pywin32-311-cp313-cp313-win_amd64.whl", hash = "sha256:718a38f7e5b058e76aee1c56ddd06908116d35147e133427e59a3983f703a20d", size = 9494700, upload-time = "2025-07-14T20:13:28.243Z" },
+    { url = "https://files.pythonhosted.org/packages/04/bf/90339ac0f55726dce7d794e6d79a18a91265bdf3aa70b6b9ca52f35e022a/pywin32-311-cp313-cp313-win_arm64.whl", hash = "sha256:7b4075d959648406202d92a2310cb990fea19b535c7f4a78d3f5e10b926eeb8a", size = 8709318, upload-time = "2025-07-14T20:13:30.348Z" },
 ]
 
 [[package]]
@@ -3929,6 +4271,16 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/74/93/7baea19427dcfbe1e5a372d81473250b379f04b1bd3c4c5ff825e2327202/pyyaml-6.0.3-cp312-cp312-win32.whl", hash = "sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5", size = 137658, upload-time = "2025-09-25T21:32:20.209Z" },
     { url = "https://files.pythonhosted.org/packages/86/bf/899e81e4cce32febab4fb42bb97dcdf66bc135272882d1987881a4b519e9/pyyaml-6.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b", size = 154003, upload-time = "2025-09-25T21:32:21.167Z" },
     { url = "https://files.pythonhosted.org/packages/1a/08/67bd04656199bbb51dbed1439b7f27601dfb576fb864099c7ef0c3e55531/pyyaml-6.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd", size = 140344, upload-time = "2025-09-25T21:32:22.617Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/11/0fd08f8192109f7169db964b5707a2f1e8b745d4e239b784a5a1dd80d1db/pyyaml-6.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8", size = 181669, upload-time = "2025-09-25T21:32:23.673Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/16/95309993f1d3748cd644e02e38b75d50cbc0d9561d21f390a76242ce073f/pyyaml-6.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1", size = 173252, upload-time = "2025-09-25T21:32:25.149Z" },
+    { url = "https://files.pythonhosted.org/packages/50/31/b20f376d3f810b9b2371e72ef5adb33879b25edb7a6d072cb7ca0c486398/pyyaml-6.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c", size = 767081, upload-time = "2025-09-25T21:32:26.575Z" },
+    { url = "https://files.pythonhosted.org/packages/49/1e/a55ca81e949270d5d4432fbbd19dfea5321eda7c41a849d443dc92fd1ff7/pyyaml-6.0.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5", size = 841159, upload-time = "2025-09-25T21:32:27.727Z" },
+    { url = "https://files.pythonhosted.org/packages/74/27/e5b8f34d02d9995b80abcef563ea1f8b56d20134d8f4e5e81733b1feceb2/pyyaml-6.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6", size = 801626, upload-time = "2025-09-25T21:32:28.878Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/11/ba845c23988798f40e52ba45f34849aa8a1f2d4af4b798588010792ebad6/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6", size = 753613, upload-time = "2025-09-25T21:32:30.178Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/e0/7966e1a7bfc0a45bf0a7fb6b98ea03fc9b8d84fa7f2229e9659680b69ee3/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be", size = 794115, upload-time = "2025-09-25T21:32:31.353Z" },
+    { url = "https://files.pythonhosted.org/packages/de/94/980b50a6531b3019e45ddeada0626d45fa85cbe22300844a7983285bed3b/pyyaml-6.0.3-cp313-cp313-win32.whl", hash = "sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26", size = 137427, upload-time = "2025-09-25T21:32:32.58Z" },
+    { url = "https://files.pythonhosted.org/packages/97/c9/39d5b874e8b28845e4ec2202b5da735d0199dbe5b8fb85f91398814a9a46/pyyaml-6.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c", size = 154090, upload-time = "2025-09-25T21:32:33.659Z" },
+    { url = "https://files.pythonhosted.org/packages/73/e8/2bdf3ca2090f68bb3d75b44da7bbc71843b19c9f2b9cb9b0f4ab7a5a4329/pyyaml-6.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb", size = 140246, upload-time = "2025-09-25T21:32:34.663Z" },
 ]
 
 [[package]]
@@ -3938,7 +4290,7 @@ source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "attrs" },
     { name = "rpds-py" },
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/2f/db/98b5c277be99dd18bfd91dd04e1b759cad18d1a338188c936e92f921c7e2/referencing-0.36.2.tar.gz", hash = "sha256:df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa", size = 74744, upload-time = "2025-01-25T08:48:16.138Z" }
 wheels = [
@@ -4000,6 +4352,38 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c3/1c/bdcc98f9a4af4fdd166c74941174619ccff4726d3ce32faa8e9a2ecd38dd/regex-2026.5.9-cp312-cp312-win32.whl", hash = "sha256:164eba9b755ea6f244b0d881196fbc1fac09714e9782c9e2732b813142033c8e", size = 266699, upload-time = "2026-05-09T23:12:59.14Z" },
     { url = "https://files.pythonhosted.org/packages/78/87/240d36864f9e48ace85f72e79ced97ceb7f27ce87739a947dcb834b4e6bc/regex-2026.5.9-cp312-cp312-win_amd64.whl", hash = "sha256:86f40a5d6444db30a125c9c9177e6b25dad981cbc37451fd838f145e6edac92e", size = 277783, upload-time = "2026-05-09T23:13:00.789Z" },
     { url = "https://files.pythonhosted.org/packages/4f/b5/7b30f312b0669dff5beebe5b0989dc2d1a312b1a44fab852199c387a5b96/regex-2026.5.9-cp312-cp312-win_arm64.whl", hash = "sha256:96f5f58b54a063d7ea9dca08e1cf57bfe10499c4d579ee672da284f57f5f0070", size = 270513, upload-time = "2026-05-09T23:13:02.426Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/da/797e91ecec6f84135da778ddce78c20e0af5d2a15c26f87a81bc3eadb6db/regex-2026.5.9-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:d626b84406444b165fc0ba981604edea39f0588ff1f92baa23fe50799ea9afdb", size = 490303, upload-time = "2026-05-09T23:13:04.382Z" },
+    { url = "https://files.pythonhosted.org/packages/44/da/bf30abaaa737b58f4a4b8c4a03659e02fd92092c822e0197ed9e0daab917/regex-2026.5.9-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:d7bdc0ab8f3dd7e1b4f9ab88634e13374669db86bb3c72e8292f07ae313f539f", size = 292019, upload-time = "2026-05-09T23:13:06.022Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/e7/d0eaf5713828417b9e5648cf81fa9bacd4961f6ab98c380c2034f8716e35/regex-2026.5.9-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a8820737949116ffff55fe18f9fc644530063ba6ebfcb8314239416e78f1347c", size = 289468, upload-time = "2026-05-09T23:13:08.214Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/9b/b3fdd62b003baa1a9b593cd8c8699c9651c2e80cc21a5c715707983c42d7/regex-2026.5.9-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:aa0fbdbac82cb3e4450d0ccde7d7a35607f4cb2dd9fba4b8b69bfaf8c9fa6aed", size = 796749, upload-time = "2026-05-09T23:13:10.573Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/30/66ab84588765f5b4b271a9ca09ef7ce2b87caa95176ec3d2ad65d7bc4902/regex-2026.5.9-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:57e8915c7986aa33d25e4d3629cef711cd2863f2961b10409f0c04cb8b7d9020", size = 865445, upload-time = "2026-05-09T23:13:12.523Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/89/f05169e8588aac365f35ffc7f3bc3184f095ef4cfded7cfaa3c7fd5dbd89/regex-2026.5.9-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:508f56a89ba9cb26e4168cbc37dbd60a28d82430a9e18ad1d25fe0883c314ca2", size = 912322, upload-time = "2026-05-09T23:13:14.281Z" },
+    { url = "https://files.pythonhosted.org/packages/30/e1/c93444052cf41581f3c884ab3fb5823daf0992f11cd4388d4275ca610558/regex-2026.5.9-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b6d189041f15691cfa2b6c4290448ec221244d225b3f5fe9e7771b34ffcdf6e2", size = 801269, upload-time = "2026-05-09T23:13:16.569Z" },
+    { url = "https://files.pythonhosted.org/packages/50/fe/0cf96b882f540e62e8b9956599798203d599c44cf4c77917ca27400ff69b/regex-2026.5.9-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e82db382b44d0111b22601c509c89f64434816c9e0eef9d1989cda8cc6ff1c04", size = 777085, upload-time = "2026-05-09T23:13:18.675Z" },
+    { url = "https://files.pythonhosted.org/packages/23/5c/d78d4924e7fc875557b9e9b768423925fdfaac5549d06da7810019a9bd26/regex-2026.5.9-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:2acfb48634f64996b57f90f39afa692ff362162722581921fe92239a59960f3c", size = 785153, upload-time = "2026-05-09T23:13:20.525Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/e0/5214774090e7b4524dcea3e3c4aa74141d43043f8beb49c1599db1c8b53a/regex-2026.5.9-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:d29eebfc9525db68cad3c97eedd7f754fa265aa5cd0cf4f863b2421e1b48fc9f", size = 860164, upload-time = "2026-05-09T23:13:22.263Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/e1/4a57a83350319b1271f0d7a249b8672513ed928b237a741631270de6caea/regex-2026.5.9-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:debb893095e944091c16e641a6e33c1b0f4cb61ab945ec5afbf53ce7068834d8", size = 765731, upload-time = "2026-05-09T23:13:24.277Z" },
+    { url = "https://files.pythonhosted.org/packages/12/f4/499e74a20c156fc75836ee04a72a38d1a063978f600937f9760467beb1b0/regex-2026.5.9-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:d659eee77986549c9ea45b861c7567e44d6287c3dc9a4565478853f7b9fe2ff6", size = 852062, upload-time = "2026-05-09T23:13:26.125Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/92/7eebc0d0a01e78629695f342ba17e0deaff8fb45e79cc0d7b98287da6e3e/regex-2026.5.9-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2efa205e6d98b24d1f3ab395c11aa15cdf10935bca283d0285e0499c284fba21", size = 789577, upload-time = "2026-05-09T23:13:27.814Z" },
+    { url = "https://files.pythonhosted.org/packages/05/a4/018e71f7d2ad48c1ebe6d3ae0026f9b7cb4802fd15c7cc02fdf724355102/regex-2026.5.9-cp313-cp313-win32.whl", hash = "sha256:f3844f134e834076677dd369976e9f5068679fcb8e50102fdf6b7ac96a3ec127", size = 266691, upload-time = "2026-05-09T23:13:29.549Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/1d/861a93719fb9ee7dbfc3761b3797b7a3e112a5d42c6129459d2d741be9b5/regex-2026.5.9-cp313-cp313-win_amd64.whl", hash = "sha256:3527bb4942d2c14552155406cdedd906567456821848aed1cb4933a391bf5eca", size = 277747, upload-time = "2026-05-09T23:13:31.859Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/c6/0a2436ae4da1ba76e51cb98943c6838a9a721faa40ebe2dce07694ae34e3/regex-2026.5.9-cp313-cp313-win_arm64.whl", hash = "sha256:56a33f191f17d8c417f99945ebdc1e691d3af9605d86ec68c7e54a57e3e17af6", size = 270500, upload-time = "2026-05-09T23:13:33.525Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/e9/d21346f7b60ed58789371358ed66b09d00f832e1bd7c06e55d9da5679882/regex-2026.5.9-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:01f28d868834624c934b8d2e0aa1c8341337e37831f4a012f18a5afcba4cbaf3", size = 494172, upload-time = "2026-05-09T23:13:35.935Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/43/fd1177a2032037c681baecdb3422ee4e1424aec4e4f470ef47793d325274/regex-2026.5.9-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:48036f6374aaa79eb3b754ec29c61d1c6b1606749d705a13f8854fa2539671f6", size = 293952, upload-time = "2026-05-09T23:13:38.307Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/7d/9fbf919768368d3f8a4f6c692cf2aa61e482b2b81ec6a298ace4cbf02480/regex-2026.5.9-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:b96350aa424e79d4fd6b567b344dcbe2b2d6bfc48dfe7717587e1fa6d43da6ff", size = 292314, upload-time = "2026-05-09T23:13:40.353Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/6c/e41bfeecb589716843e7c4df09ba46ff2a42961457afece19059d85caeef/regex-2026.5.9-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8f3af7a4903c5c04a11a196a5aa75cdd7dd3f8508132f9fb3259d9f5908e3b88", size = 811681, upload-time = "2026-05-09T23:13:42.543Z" },
+    { url = "https://files.pythonhosted.org/packages/87/83/a5c1c525fba0aa656e88ad0face0b1829788ef4c2fb6b26df58aa1151b84/regex-2026.5.9-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7e87577720152d2caae19fe2baaf1f8d5ca12091e9e229f03915c37d1e4b9178", size = 871135, upload-time = "2026-05-09T23:13:44.326Z" },
+    { url = "https://files.pythonhosted.org/packages/18/d4/80882e799e440dd878b0979cbebf8fa4d54624a332c83037c7a701649e3f/regex-2026.5.9-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c8b9b9d294cfea3cd19c718ade7cc93492b2c4991abd9a68d0b3477ae6d8e100", size = 917265, upload-time = "2026-05-09T23:13:47.295Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/ff/8db60211e2286e396aad7dc7725356c502bff0901ea05bd6cdc2e1a042b9/regex-2026.5.9-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:728d8bfd28a8845c8b6bc5dc7ce010453d206396786c0765c2740cb65f37791e", size = 816311, upload-time = "2026-05-09T23:13:49.885Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/47/742ef579c61730f8d268e5cf1f9ce0e37e2ea041ad0f5644724f2378e463/regex-2026.5.9-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7e30b874d341fac767d7df5a0870540541c2c054b80cfaac116e8d367a8a7ff2", size = 785498, upload-time = "2026-05-09T23:13:52.25Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/ab/cb0999802dcb0fb95b1ab005e8d4163d8afdd67efc2cb6b6630ac13f8cb1/regex-2026.5.9-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:fd190e88a895a8901325fad284a3f74ea52b1da8525b76cc811fa9b1edf0ce2b", size = 801348, upload-time = "2026-05-09T23:13:54.127Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/62/8ca59a24c55bc34d166eefaf3717bd77772f329fdbf984d86581e0a3571c/regex-2026.5.9-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:8e76e8161ad00694cfce6767d5dea860c6391ac5b83e5c3a39661e696f11fc7e", size = 866493, upload-time = "2026-05-09T23:13:56.067Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/3d/30f2ae62cef3278bb5bb821f467277a55fb73f01032cf85997e15e8289a8/regex-2026.5.9-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:ddda5340e6c01a293027dd46232fa79eaff1b48058ce7a98f572b6445b088041", size = 772811, upload-time = "2026-05-09T23:13:57.867Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/ae/7d2089bcd78ad0c0161bc684339df50032acb438a7bd3305e7ddb1193cec/regex-2026.5.9-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:205109e96b3cf5adf8f4cd62bedde9487feb282b9497a3535451e5a24cd706a0", size = 856584, upload-time = "2026-05-09T23:13:59.679Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/29/92ff47f75990131ea4f24ba17819e5a9d141e10819807e09addd73409af6/regex-2026.5.9-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:dfbe4579b9f08036aa7d101d1835437a20783574ac66327e6b29b4018a138081", size = 803453, upload-time = "2026-05-09T23:14:01.978Z" },
+    { url = "https://files.pythonhosted.org/packages/04/99/eff29f1037dcab36702c9ee5d6858cf1ce2336ea8ea2987f64245b99ea5e/regex-2026.5.9-cp313-cp313t-win32.whl", hash = "sha256:ed2c9e8068b614c574d8d30e543d617cf5379b0535d46f97ef00e904745a08b5", size = 269951, upload-time = "2026-05-09T23:14:03.661Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/9d/8870b8981d27b22cda77bb26a5ac7ebfa9c7d9e0dea195a834a82380e748/regex-2026.5.9-cp313-cp313t-win_amd64.whl", hash = "sha256:b46b0f094dc1d3b90356c85a0bd2c9bafc4a6a190b9d6f8ddd5a033b6e088ed4", size = 281240, upload-time = "2026-05-09T23:14:05.56Z" },
+    { url = "https://files.pythonhosted.org/packages/72/b1/3379415e8f135c13ac551353397cc4fe97b4978f3cac73c5fcbcded548b8/regex-2026.5.9-cp313-cp313t-win_arm64.whl", hash = "sha256:872acc074bd29ffc9913ecdfedf6ea77502312ca44a4aa0d3779089c6069d8de", size = 272383, upload-time = "2026-05-09T23:14:07.843Z" },
 ]
 
 [[package]]
@@ -4149,6 +4533,35 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/6f/ab/d5d5e3bcedb0a77f4f613706b750e50a5a3ba1c15ccd3665ecc636c968fd/rpds_py-0.30.0-cp312-cp312-win32.whl", hash = "sha256:1ab5b83dbcf55acc8b08fc62b796ef672c457b17dbd7820a11d6c52c06839bdf", size = 223782, upload-time = "2025-11-30T20:22:37.271Z" },
     { url = "https://files.pythonhosted.org/packages/39/3b/f786af9957306fdc38a74cef405b7b93180f481fb48453a114bb6465744a/rpds_py-0.30.0-cp312-cp312-win_amd64.whl", hash = "sha256:a090322ca841abd453d43456ac34db46e8b05fd9b3b4ac0c78bcde8b089f959b", size = 240463, upload-time = "2025-11-30T20:22:39.021Z" },
     { url = "https://files.pythonhosted.org/packages/f3/d2/b91dc748126c1559042cfe41990deb92c4ee3e2b415f6b5234969ffaf0cc/rpds_py-0.30.0-cp312-cp312-win_arm64.whl", hash = "sha256:669b1805bd639dd2989b281be2cfd951c6121b65e729d9b843e9639ef1fd555e", size = 230868, upload-time = "2025-11-30T20:22:40.493Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/dc/d61221eb88ff410de3c49143407f6f3147acf2538c86f2ab7ce65ae7d5f9/rpds_py-0.30.0-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:f83424d738204d9770830d35290ff3273fbb02b41f919870479fab14b9d303b2", size = 374887, upload-time = "2025-11-30T20:22:41.812Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/32/55fb50ae104061dbc564ef15cc43c013dc4a9f4527a1f4d99baddf56fe5f/rpds_py-0.30.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e7536cd91353c5273434b4e003cbda89034d67e7710eab8761fd918ec6c69cf8", size = 358904, upload-time = "2025-11-30T20:22:43.479Z" },
+    { url = "https://files.pythonhosted.org/packages/58/70/faed8186300e3b9bdd138d0273109784eea2396c68458ed580f885dfe7ad/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2771c6c15973347f50fece41fc447c054b7ac2ae0502388ce3b6738cd366e3d4", size = 389945, upload-time = "2025-11-30T20:22:44.819Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/a8/073cac3ed2c6387df38f71296d002ab43496a96b92c823e76f46b8af0543/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:0a59119fc6e3f460315fe9d08149f8102aa322299deaa5cab5b40092345c2136", size = 407783, upload-time = "2025-11-30T20:22:46.103Z" },
+    { url = "https://files.pythonhosted.org/packages/77/57/5999eb8c58671f1c11eba084115e77a8899d6e694d2a18f69f0ba471ec8b/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:76fec018282b4ead0364022e3c54b60bf368b9d926877957a8624b58419169b7", size = 515021, upload-time = "2025-11-30T20:22:47.458Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/af/5ab4833eadc36c0a8ed2bc5c0de0493c04f6c06de223170bd0798ff98ced/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:692bef75a5525db97318e8cd061542b5a79812d711ea03dbc1f6f8dbb0c5f0d2", size = 414589, upload-time = "2025-11-30T20:22:48.872Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/de/f7192e12b21b9e9a68a6d0f249b4af3fdcdff8418be0767a627564afa1f1/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9027da1ce107104c50c81383cae773ef5c24d296dd11c99e2629dbd7967a20c6", size = 394025, upload-time = "2025-11-30T20:22:50.196Z" },
+    { url = "https://files.pythonhosted.org/packages/91/c4/fc70cd0249496493500e7cc2de87504f5aa6509de1e88623431fec76d4b6/rpds_py-0.30.0-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:9cf69cdda1f5968a30a359aba2f7f9aa648a9ce4b580d6826437f2b291cfc86e", size = 408895, upload-time = "2025-11-30T20:22:51.87Z" },
+    { url = "https://files.pythonhosted.org/packages/58/95/d9275b05ab96556fefff73a385813eb66032e4c99f411d0795372d9abcea/rpds_py-0.30.0-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:a4796a717bf12b9da9d3ad002519a86063dcac8988b030e405704ef7d74d2d9d", size = 422799, upload-time = "2025-11-30T20:22:53.341Z" },
+    { url = "https://files.pythonhosted.org/packages/06/c1/3088fc04b6624eb12a57eb814f0d4997a44b0d208d6cace713033ff1a6ba/rpds_py-0.30.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:5d4c2aa7c50ad4728a094ebd5eb46c452e9cb7edbfdb18f9e1221f597a73e1e7", size = 572731, upload-time = "2025-11-30T20:22:54.778Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/42/c612a833183b39774e8ac8fecae81263a68b9583ee343db33ab571a7ce55/rpds_py-0.30.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ba81a9203d07805435eb06f536d95a266c21e5b2dfbf6517748ca40c98d19e31", size = 599027, upload-time = "2025-11-30T20:22:56.212Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/60/525a50f45b01d70005403ae0e25f43c0384369ad24ffe46e8d9068b50086/rpds_py-0.30.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:945dccface01af02675628334f7cf49c2af4c1c904748efc5cf7bbdf0b579f95", size = 563020, upload-time = "2025-11-30T20:22:58.2Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/5d/47c4655e9bcd5ca907148535c10e7d489044243cc9941c16ed7cd53be91d/rpds_py-0.30.0-cp313-cp313-win32.whl", hash = "sha256:b40fb160a2db369a194cb27943582b38f79fc4887291417685f3ad693c5a1d5d", size = 223139, upload-time = "2025-11-30T20:23:00.209Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/e1/485132437d20aa4d3e1d8b3fb5a5e65aa8139f1e097080c2a8443201742c/rpds_py-0.30.0-cp313-cp313-win_amd64.whl", hash = "sha256:806f36b1b605e2d6a72716f321f20036b9489d29c51c91f4dd29a3e3afb73b15", size = 240224, upload-time = "2025-11-30T20:23:02.008Z" },
+    { url = "https://files.pythonhosted.org/packages/24/95/ffd128ed1146a153d928617b0ef673960130be0009c77d8fbf0abe306713/rpds_py-0.30.0-cp313-cp313-win_arm64.whl", hash = "sha256:d96c2086587c7c30d44f31f42eae4eac89b60dabbac18c7669be3700f13c3ce1", size = 230645, upload-time = "2025-11-30T20:23:03.43Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/1b/b10de890a0def2a319a2626334a7f0ae388215eb60914dbac8a3bae54435/rpds_py-0.30.0-cp313-cp313t-macosx_10_12_x86_64.whl", hash = "sha256:eb0b93f2e5c2189ee831ee43f156ed34e2a89a78a66b98cadad955972548be5a", size = 364443, upload-time = "2025-11-30T20:23:04.878Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/bf/27e39f5971dc4f305a4fb9c672ca06f290f7c4e261c568f3dea16a410d47/rpds_py-0.30.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:922e10f31f303c7c920da8981051ff6d8c1a56207dbdf330d9047f6d30b70e5e", size = 353375, upload-time = "2025-11-30T20:23:06.342Z" },
+    { url = "https://files.pythonhosted.org/packages/40/58/442ada3bba6e8e6615fc00483135c14a7538d2ffac30e2d933ccf6852232/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cdc62c8286ba9bf7f47befdcea13ea0e26bf294bda99758fd90535cbaf408000", size = 383850, upload-time = "2025-11-30T20:23:07.825Z" },
+    { url = "https://files.pythonhosted.org/packages/14/14/f59b0127409a33c6ef6f5c1ebd5ad8e32d7861c9c7adfa9a624fc3889f6c/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:47f9a91efc418b54fb8190a6b4aa7813a23fb79c51f4bb84e418f5476c38b8db", size = 392812, upload-time = "2025-11-30T20:23:09.228Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/66/e0be3e162ac299b3a22527e8913767d869e6cc75c46bd844aa43fb81ab62/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1f3587eb9b17f3789ad50824084fa6f81921bbf9a795826570bda82cb3ed91f2", size = 517841, upload-time = "2025-11-30T20:23:11.186Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/55/fa3b9cf31d0c963ecf1ba777f7cf4b2a2c976795ac430d24a1f43d25a6ba/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:39c02563fc592411c2c61d26b6c5fe1e51eaa44a75aa2c8735ca88b0d9599daa", size = 408149, upload-time = "2025-11-30T20:23:12.864Z" },
+    { url = "https://files.pythonhosted.org/packages/60/ca/780cf3b1a32b18c0f05c441958d3758f02544f1d613abf9488cd78876378/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:51a1234d8febafdfd33a42d97da7a43f5dcb120c1060e352a3fbc0c6d36e2083", size = 383843, upload-time = "2025-11-30T20:23:14.638Z" },
+    { url = "https://files.pythonhosted.org/packages/82/86/d5f2e04f2aa6247c613da0c1dd87fcd08fa17107e858193566048a1e2f0a/rpds_py-0.30.0-cp313-cp313t-manylinux_2_31_riscv64.whl", hash = "sha256:eb2c4071ab598733724c08221091e8d80e89064cd472819285a9ab0f24bcedb9", size = 396507, upload-time = "2025-11-30T20:23:16.105Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/9a/453255d2f769fe44e07ea9785c8347edaf867f7026872e76c1ad9f7bed92/rpds_py-0.30.0-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:6bdfdb946967d816e6adf9a3d8201bfad269c67efe6cefd7093ef959683c8de0", size = 414949, upload-time = "2025-11-30T20:23:17.539Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/31/622a86cdc0c45d6df0e9ccb6becdba5074735e7033c20e401a6d9d0e2ca0/rpds_py-0.30.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:c77afbd5f5250bf27bf516c7c4a016813eb2d3e116139aed0096940c5982da94", size = 565790, upload-time = "2025-11-30T20:23:19.029Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/5d/15bbf0fb4a3f58a3b1c67855ec1efcc4ceaef4e86644665fff03e1b66d8d/rpds_py-0.30.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:61046904275472a76c8c90c9ccee9013d70a6d0f73eecefd38c1ae7c39045a08", size = 590217, upload-time = "2025-11-30T20:23:20.885Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/61/21b8c41f68e60c8cc3b2e25644f0e3681926020f11d06ab0b78e3c6bbff1/rpds_py-0.30.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:4c5f36a861bc4b7da6516dbdf302c55313afa09b81931e8280361a4f6c9a2d27", size = 555806, upload-time = "2025-11-30T20:23:22.488Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/39/7e067bb06c31de48de3eb200f9fc7c58982a4d3db44b07e73963e10d3be9/rpds_py-0.30.0-cp313-cp313t-win32.whl", hash = "sha256:3d4a69de7a3e50ffc214ae16d79d8fbb0922972da0356dcf4d0fdca2878559c6", size = 211341, upload-time = "2025-11-30T20:23:24.449Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/4d/222ef0b46443cf4cf46764d9c630f3fe4abaa7245be9417e56e9f52b8f65/rpds_py-0.30.0-cp313-cp313t-win_amd64.whl", hash = "sha256:f14fc5df50a716f7ece6a80b6c78bb35ea2ca47c499e422aa4463455dd96d56d", size = 225768, upload-time = "2025-11-30T20:23:25.908Z" },
     { url = "https://files.pythonhosted.org/packages/69/71/3f34339ee70521864411f8b6992e7ab13ac30d8e4e3309e07c7361767d91/rpds_py-0.30.0-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:c2262bdba0ad4fc6fb5545660673925c2d2a5d9e2e0fb603aad545427be0fc58", size = 372292, upload-time = "2025-11-30T20:24:16.537Z" },
     { url = "https://files.pythonhosted.org/packages/57/09/f183df9b8f2d66720d2ef71075c59f7e1b336bec7ee4c48f0a2b06857653/rpds_py-0.30.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:ee6af14263f25eedc3bb918a3c04245106a42dfd4f5c2285ea6f997b1fc3f89a", size = 362128, upload-time = "2025-11-30T20:24:18.086Z" },
     { url = "https://files.pythonhosted.org/packages/7a/68/5c2594e937253457342e078f0cc1ded3dd7b2ad59afdbf2d354869110a02/rpds_py-0.30.0-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3adbb8179ce342d235c31ab8ec511e66c73faa27a47e076ccc92421add53e2bb", size = 391542, upload-time = "2025-11-30T20:24:20.092Z" },
@@ -4294,6 +4707,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/08/51/2201164d7bfacf47539888c735f10f6320c188252384957aa1b23121a210/stackit_iaas-1.4.0-py3-none-any.whl", hash = "sha256:3f4a32321b57ac238f73e5d660c6428186b92cc0425c1f0783ba801e377149d9", size = 316588, upload-time = "2026-05-13T09:43:14.943Z" },
 ]
 
+[[package]]
+name = "stackit-objectstorage"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dateutil" },
+    { name = "requests" },
+    { name = "stackit-core" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/90/80/b790756af40a5c6d979dd688b2557394ac54b594eb4c08edc33157ba890f/stackit_objectstorage-1.4.0.tar.gz", hash = "sha256:4a3812b4de102b199f061706a802909f9e53ae9b0858769d5bd720f814c8bdbe", size = 31814, upload-time = "2026-05-13T09:43:05.027Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/68/f1/ffa8d5e2ec9f818c72a6f045691364eb4e927ee86641993a70882d00205a/stackit_objectstorage-1.4.0-py3-none-any.whl", hash = "sha256:1a3285c6840d95cff591d84fd21803575cb0d010c398e6575ed92987b9c39866", size = 65061, upload-time = "2026-05-13T09:43:04.13Z" },
+]
+
 [[package]]
 name = "stackit-resourcemanager"
 version = "0.8.0"
@@ -4387,6 +4815,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d6/2f/4a3c322f22c5c66c4b836ec58211641a4067364f5dcdd7b974b4c5da300c/tomli-2.4.1-cp312-cp312-win32.whl", hash = "sha256:da25dc3563bff5965356133435b757a795a17b17d01dbc0f42fb32447ddfd917", size = 98141, upload-time = "2026-03-25T20:21:28.492Z" },
     { url = "https://files.pythonhosted.org/packages/24/22/4daacd05391b92c55759d55eaee21e1dfaea86ce5c571f10083360adf534/tomli-2.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:52c8ef851d9a240f11a88c003eacb03c31fc1c9c4ec64a99a0f922b93874fda9", size = 108847, upload-time = "2026-03-25T20:21:29.386Z" },
     { url = "https://files.pythonhosted.org/packages/68/fd/70e768887666ddd9e9f5d85129e84910f2db2796f9096aa02b721a53098d/tomli-2.4.1-cp312-cp312-win_arm64.whl", hash = "sha256:f758f1b9299d059cc3f6546ae2af89670cb1c4d48ea29c3cacc4fe7de3058257", size = 95088, upload-time = "2026-03-25T20:21:30.677Z" },
+    { url = "https://files.pythonhosted.org/packages/07/06/b823a7e818c756d9a7123ba2cda7d07bc2dd32835648d1a7b7b7a05d848d/tomli-2.4.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:36d2bd2ad5fb9eaddba5226aa02c8ec3fa4f192631e347b3ed28186d43be6b54", size = 155866, upload-time = "2026-03-25T20:21:31.65Z" },
+    { url = "https://files.pythonhosted.org/packages/14/6f/12645cf7f08e1a20c7eb8c297c6f11d31c1b50f316a7e7e1e1de6e2e7b7e/tomli-2.4.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:eb0dc4e38e6a1fd579e5d50369aa2e10acfc9cace504579b2faabb478e76941a", size = 149887, upload-time = "2026-03-25T20:21:33.028Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/e0/90637574e5e7212c09099c67ad349b04ec4d6020324539297b634a0192b0/tomli-2.4.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c7f2c7f2b9ca6bdeef8f0fa897f8e05085923eb091721675170254cbc5b02897", size = 243704, upload-time = "2026-03-25T20:21:34.51Z" },
+    { url = "https://files.pythonhosted.org/packages/10/8f/d3ddb16c5a4befdf31a23307f72828686ab2096f068eaf56631e136c1fdd/tomli-2.4.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f3c6818a1a86dd6dca7ddcaaf76947d5ba31aecc28cb1b67009a5877c9a64f3f", size = 251628, upload-time = "2026-03-25T20:21:36.012Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/f1/dbeeb9116715abee2485bf0a12d07a8f31af94d71608c171c45f64c0469d/tomli-2.4.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d312ef37c91508b0ab2cee7da26ec0b3ed2f03ce12bd87a588d771ae15dcf82d", size = 247180, upload-time = "2026-03-25T20:21:37.136Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/74/16336ffd19ed4da28a70959f92f506233bd7cfc2332b20bdb01591e8b1d1/tomli-2.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:51529d40e3ca50046d7606fa99ce3956a617f9b36380da3b7f0dd3dd28e68cb5", size = 251674, upload-time = "2026-03-25T20:21:38.298Z" },
+    { url = "https://files.pythonhosted.org/packages/16/f9/229fa3434c590ddf6c0aa9af64d3af4b752540686cace29e6281e3458469/tomli-2.4.1-cp313-cp313-win32.whl", hash = "sha256:2190f2e9dd7508d2a90ded5ed369255980a1bcdd58e52f7fe24b8162bf9fedbd", size = 97976, upload-time = "2026-03-25T20:21:39.316Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/1e/71dfd96bcc1c775420cb8befe7a9d35f2e5b1309798f009dca17b7708c1e/tomli-2.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:8d65a2fbf9d2f8352685bc1364177ee3923d6baf5e7f43ea4959d7d8bc326a36", size = 108755, upload-time = "2026-03-25T20:21:40.248Z" },
+    { url = "https://files.pythonhosted.org/packages/83/7a/d34f422a021d62420b78f5c538e5b102f62bea616d1d75a13f0a88acb04a/tomli-2.4.1-cp313-cp313-win_arm64.whl", hash = "sha256:4b605484e43cdc43f0954ddae319fb75f04cc10dd80d830540060ee7cd0243cd", size = 95265, upload-time = "2026-03-25T20:21:41.219Z" },
     { url = "https://files.pythonhosted.org/packages/7b/61/cceae43728b7de99d9b847560c262873a1f6c98202171fd5ed62640b494b/tomli-2.4.1-py3-none-any.whl", hash = "sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe", size = 14583, upload-time = "2026-03-25T20:22:03.012Z" },
 ]
 
@@ -4540,6 +4977,28 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ec/9f/b750b3692ed2ef4705cb305bd68858e73010492b80e43d2a4faa5573cbe7/wrapt-2.1.2-cp312-cp312-win32.whl", hash = "sha256:eba8155747eb2cae4a0b913d9ebd12a1db4d860fc4c829d7578c7b989bd3f2f0", size = 58198, upload-time = "2026-03-06T02:53:37.732Z" },
     { url = "https://files.pythonhosted.org/packages/8e/b2/feecfe29f28483d888d76a48f03c4c4d8afea944dbee2b0cd3380f9df032/wrapt-2.1.2-cp312-cp312-win_amd64.whl", hash = "sha256:1c51c738d7d9faa0b3601708e7e2eda9bf779e1b601dce6c77411f2a1b324a63", size = 60441, upload-time = "2026-03-06T02:52:47.138Z" },
     { url = "https://files.pythonhosted.org/packages/44/e1/e328f605d6e208547ea9fd120804fcdec68536ac748987a68c47c606eea8/wrapt-2.1.2-cp312-cp312-win_arm64.whl", hash = "sha256:c8e46ae8e4032792eb2f677dbd0d557170a8e5524d22acc55199f43efedd39bf", size = 58836, upload-time = "2026-03-06T02:53:22.053Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/7a/d936840735c828b38d26a854e85d5338894cda544cb7a85a9d5b8b9c4df7/wrapt-2.1.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:787fd6f4d67befa6fe2abdffcbd3de2d82dfc6fb8a6d850407c53332709d030b", size = 61259, upload-time = "2026-03-06T02:53:41.922Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/88/9a9b9a90ac8ca11c2fdb6a286cb3a1fc7dd774c00ed70929a6434f6bc634/wrapt-2.1.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:4bdf26e03e6d0da3f0e9422fd36bcebf7bc0eeb55fdf9c727a09abc6b9fe472e", size = 61851, upload-time = "2026-03-06T02:52:48.672Z" },
+    { url = "https://files.pythonhosted.org/packages/03/a9/5b7d6a16fd6533fed2756900fc8fc923f678179aea62ada6d65c92718c00/wrapt-2.1.2-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:bbac24d879aa22998e87f6b3f481a5216311e7d53c7db87f189a7a0266dafffb", size = 121446, upload-time = "2026-03-06T02:54:14.013Z" },
+    { url = "https://files.pythonhosted.org/packages/45/bb/34c443690c847835cfe9f892be78c533d4f32366ad2888972c094a897e39/wrapt-2.1.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:16997dfb9d67addc2e3f41b62a104341e80cac52f91110dece393923c0ebd5ca", size = 123056, upload-time = "2026-03-06T02:54:10.829Z" },
+    { url = "https://files.pythonhosted.org/packages/93/b9/ff205f391cb708f67f41ea148545f2b53ff543a7ac293b30d178af4d2271/wrapt-2.1.2-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:162e4e2ba7542da9027821cb6e7c5e068d64f9a10b5f15512ea28e954893a267", size = 117359, upload-time = "2026-03-06T02:53:03.623Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/3d/1ea04d7747825119c3c9a5e0874a40b33594ada92e5649347c457d982805/wrapt-2.1.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f29c827a8d9936ac320746747a016c4bc66ef639f5cd0d32df24f5eacbf9c69f", size = 121479, upload-time = "2026-03-06T02:53:45.844Z" },
+    { url = "https://files.pythonhosted.org/packages/78/cc/ee3a011920c7a023b25e8df26f306b2484a531ab84ca5c96260a73de76c0/wrapt-2.1.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:a9dd9813825f7ecb018c17fd147a01845eb330254dff86d3b5816f20f4d6aaf8", size = 116271, upload-time = "2026-03-06T02:54:46.356Z" },
+    { url = "https://files.pythonhosted.org/packages/98/fd/e5ff7ded41b76d802cf1191288473e850d24ba2e39a6ec540f21ae3b57cb/wrapt-2.1.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6f8dbdd3719e534860d6a78526aafc220e0241f981367018c2875178cf83a413", size = 120573, upload-time = "2026-03-06T02:52:50.163Z" },
+    { url = "https://files.pythonhosted.org/packages/47/c5/242cae3b5b080cd09bacef0591691ba1879739050cc7c801ff35c8886b66/wrapt-2.1.2-cp313-cp313-win32.whl", hash = "sha256:5c35b5d82b16a3bc6e0a04349b606a0582bc29f573786aebe98e0c159bc48db6", size = 58205, upload-time = "2026-03-06T02:53:47.494Z" },
+    { url = "https://files.pythonhosted.org/packages/12/69/c358c61e7a50f290958809b3c61ebe8b3838ea3e070d7aac9814f95a0528/wrapt-2.1.2-cp313-cp313-win_amd64.whl", hash = "sha256:f8bc1c264d8d1cf5b3560a87bbdd31131573eb25f9f9447bb6252b8d4c44a3a1", size = 60452, upload-time = "2026-03-06T02:53:30.038Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/66/c8a6fcfe321295fd8c0ab1bd685b5a01462a9b3aa2f597254462fc2bc975/wrapt-2.1.2-cp313-cp313-win_arm64.whl", hash = "sha256:3beb22f674550d5634642c645aba4c72a2c66fb185ae1aebe1e955fae5a13baf", size = 58842, upload-time = "2026-03-06T02:52:52.114Z" },
+    { url = "https://files.pythonhosted.org/packages/da/55/9c7052c349106e0b3f17ae8db4b23a691a963c334de7f9dbd60f8f74a831/wrapt-2.1.2-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:0fc04bc8664a8bc4c8e00b37b5355cffca2535209fba1abb09ae2b7c76ddf82b", size = 63075, upload-time = "2026-03-06T02:53:19.108Z" },
+    { url = "https://files.pythonhosted.org/packages/09/a8/ce7b4006f7218248dd71b7b2b732d0710845a0e49213b18faef64811ffef/wrapt-2.1.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:a9b9d50c9af998875a1482a038eb05755dfd6fe303a313f6a940bb53a83c3f18", size = 63719, upload-time = "2026-03-06T02:54:33.452Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/e5/2ca472e80b9e2b7a17f106bb8f9df1db11e62101652ce210f66935c6af67/wrapt-2.1.2-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:2d3ff4f0024dd224290c0eabf0240f1bfc1f26363431505fb1b0283d3b08f11d", size = 152643, upload-time = "2026-03-06T02:52:42.721Z" },
+    { url = "https://files.pythonhosted.org/packages/36/42/30f0f2cefca9d9cbf6835f544d825064570203c3e70aa873d8ae12e23791/wrapt-2.1.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3278c471f4468ad544a691b31bb856374fbdefb7fee1a152153e64019379f015", size = 158805, upload-time = "2026-03-06T02:54:25.441Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/67/d08672f801f604889dcf58f1a0b424fe3808860ede9e03affc1876b295af/wrapt-2.1.2-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a8914c754d3134a3032601c6984db1c576e6abaf3fc68094bb8ab1379d75ff92", size = 145990, upload-time = "2026-03-06T02:53:57.456Z" },
+    { url = "https://files.pythonhosted.org/packages/68/a7/fd371b02e73babec1de6ade596e8cd9691051058cfdadbfd62a5898f3295/wrapt-2.1.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:ff95d4264e55839be37bafe1536db2ab2de19da6b65f9244f01f332b5286cfbf", size = 155670, upload-time = "2026-03-06T02:54:55.309Z" },
+    { url = "https://files.pythonhosted.org/packages/86/2d/9fe0095dfdb621009f40117dcebf41d7396c2c22dca6eac779f4c007b86c/wrapt-2.1.2-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:76405518ca4e1b76fbb1b9f686cff93aebae03920cc55ceeec48ff9f719c5f67", size = 144357, upload-time = "2026-03-06T02:54:24.092Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/b6/ec7b4a254abbe4cde9fa15c5d2cca4518f6b07d0f1b77d4ee9655e30280e/wrapt-2.1.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:c0be8b5a74c5824e9359b53e7e58bef71a729bacc82e16587db1c4ebc91f7c5a", size = 150269, upload-time = "2026-03-06T02:53:31.268Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/6b/2fabe8ebf148f4ee3c782aae86a795cc68ffe7d432ef550f234025ce0cfa/wrapt-2.1.2-cp313-cp313t-win32.whl", hash = "sha256:f01277d9a5fc1862f26f7626da9cf443bebc0abd2f303f41c5e995b15887dabd", size = 59894, upload-time = "2026-03-06T02:54:15.391Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/fb/9ba66fc2dedc936de5f8073c0217b5d4484e966d87723415cc8262c5d9c2/wrapt-2.1.2-cp313-cp313t-win_amd64.whl", hash = "sha256:84ce8f1c2104d2f6daa912b1b5b039f331febfeee74f8042ad4e04992bd95c8f", size = 63197, upload-time = "2026-03-06T02:54:41.943Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/1c/012d7423c95d0e337117723eb8ecf73c622ce15a97847e84cf3f8f26cd7e/wrapt-2.1.2-cp313-cp313t-win_arm64.whl", hash = "sha256:a93cd767e37faeddbe07d8fc4212d5cba660af59bdb0f6372c93faaa13e6e679", size = 60363, upload-time = "2026-03-06T02:54:48.093Z" },
     { url = "https://files.pythonhosted.org/packages/1a/c7/8528ac2dfa2c1e6708f647df7ae144ead13f0a31146f43c7264b4942bf12/wrapt-2.1.2-py3-none-any.whl", hash = "sha256:b8fd6fa2b2c4e7621808f8c62e8317f4aae56e59721ad933bac5239d913cf0e8", size = 43993, upload-time = "2026-03-06T02:53:12.905Z" },
 ]
 
@@ -4626,6 +5085,42 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/69/7f/cd5ef733f2550de6241bd8bd8c3febc78158b9d75f197d9c7baa113436af/yarl-1.23.0-cp312-cp312-win32.whl", hash = "sha256:fffc45637bcd6538de8b85f51e3df3223e4ad89bccbfca0481c08c7fc8b7ed7d", size = 82359, upload-time = "2026-03-01T22:05:36.811Z" },
     { url = "https://files.pythonhosted.org/packages/f5/be/25216a49daeeb7af2bec0db22d5e7df08ed1d7c9f65d78b14f3b74fd72fc/yarl-1.23.0-cp312-cp312-win_amd64.whl", hash = "sha256:f69f57305656a4852f2a7203efc661d8c042e6cc67f7acd97d8667fb448a426e", size = 87674, upload-time = "2026-03-01T22:05:38.171Z" },
     { url = "https://files.pythonhosted.org/packages/d2/35/aeab955d6c425b227d5b7247eafb24f2653fedc32f95373a001af5dfeb9e/yarl-1.23.0-cp312-cp312-win_arm64.whl", hash = "sha256:6e87a6e8735b44816e7db0b2fbc9686932df473c826b0d9743148432e10bb9b9", size = 81879, upload-time = "2026-03-01T22:05:40.006Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/4b/a0a6e5d0ee8a2f3a373ddef8a4097d74ac901ac363eea1440464ccbe0898/yarl-1.23.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:16c6994ac35c3e74fb0ae93323bf8b9c2a9088d55946109489667c510a7d010e", size = 123796, upload-time = "2026-03-01T22:05:41.412Z" },
+    { url = "https://files.pythonhosted.org/packages/67/b6/8925d68af039b835ae876db5838e82e76ec87b9782ecc97e192b809c4831/yarl-1.23.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4a42e651629dafb64fd5b0286a3580613702b5809ad3f24934ea87595804f2c5", size = 86547, upload-time = "2026-03-01T22:05:42.841Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/50/06d511cc4b8e0360d3c94af051a768e84b755c5eb031b12adaaab6dec6e5/yarl-1.23.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:7c6b9461a2a8b47c65eef63bb1c76a4f1c119618ffa99ea79bc5bb1e46c5821b", size = 85854, upload-time = "2026-03-01T22:05:44.85Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/f4/4e30b250927ffdab4db70da08b9b8d2194d7c7b400167b8fbeca1e4701ca/yarl-1.23.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2569b67d616eab450d262ca7cb9f9e19d2f718c70a8b88712859359d0ab17035", size = 98351, upload-time = "2026-03-01T22:05:46.836Z" },
+    { url = "https://files.pythonhosted.org/packages/86/fc/4118c5671ea948208bdb1492d8b76bdf1453d3e73df051f939f563e7dcc5/yarl-1.23.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e9d9a4d06d3481eab79803beb4d9bd6f6a8e781ec078ac70d7ef2dcc29d1bea5", size = 92711, upload-time = "2026-03-01T22:05:48.316Z" },
+    { url = "https://files.pythonhosted.org/packages/56/11/1ed91d42bd9e73c13dc9e7eb0dd92298d75e7ac4dd7f046ad0c472e231cd/yarl-1.23.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f514f6474e04179d3d33175ed3f3e31434d3130d42ec153540d5b157deefd735", size = 106014, upload-time = "2026-03-01T22:05:50.028Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/c9/74e44e056a23fbc33aca71779ef450ca648a5bc472bdad7a82339918f818/yarl-1.23.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:fda207c815b253e34f7e1909840fd14299567b1c0eb4908f8c2ce01a41265401", size = 105557, upload-time = "2026-03-01T22:05:51.416Z" },
+    { url = "https://files.pythonhosted.org/packages/66/fe/b1e10b08d287f518994f1e2ff9b6d26f0adeecd8dd7d533b01bab29a3eda/yarl-1.23.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:34b6cf500e61c90f305094911f9acc9c86da1a05a7a3f5be9f68817043f486e4", size = 101559, upload-time = "2026-03-01T22:05:52.872Z" },
+    { url = "https://files.pythonhosted.org/packages/72/59/c5b8d94b14e3d3c2a9c20cb100119fd534ab5a14b93673ab4cc4a4141ea5/yarl-1.23.0-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:d7504f2b476d21653e4d143f44a175f7f751cd41233525312696c76aa3dbb23f", size = 100502, upload-time = "2026-03-01T22:05:54.954Z" },
+    { url = "https://files.pythonhosted.org/packages/77/4f/96976cb54cbfc5c9fd73ed4c51804f92f209481d1fb190981c0f8a07a1d7/yarl-1.23.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:578110dd426f0d209d1509244e6d4a3f1a3e9077655d98c5f22583d63252a08a", size = 98027, upload-time = "2026-03-01T22:05:56.409Z" },
+    { url = "https://files.pythonhosted.org/packages/63/6e/904c4f476471afdbad6b7e5b70362fb5810e35cd7466529a97322b6f5556/yarl-1.23.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:609d3614d78d74ebe35f54953c5bbd2ac647a7ddb9c30a5d877580f5e86b22f2", size = 95369, upload-time = "2026-03-01T22:05:58.141Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/40/acfcdb3b5f9d68ef499e39e04d25e141fe90661f9d54114556cf83be8353/yarl-1.23.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:4966242ec68afc74c122f8459abd597afd7d8a60dc93d695c1334c5fd25f762f", size = 105565, upload-time = "2026-03-01T22:06:00.286Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/c6/31e28f3a6ba2869c43d124f37ea5260cac9c9281df803c354b31f4dd1f3c/yarl-1.23.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:e0fd068364a6759bc794459f0a735ab151d11304346332489c7972bacbe9e72b", size = 99813, upload-time = "2026-03-01T22:06:01.712Z" },
+    { url = "https://files.pythonhosted.org/packages/08/1f/6f65f59e72d54aa467119b63fc0b0b1762eff0232db1f4720cd89e2f4a17/yarl-1.23.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:39004f0ad156da43e86aa71f44e033de68a44e5a31fc53507b36dd253970054a", size = 105632, upload-time = "2026-03-01T22:06:03.188Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/c4/18b178a69935f9e7a338127d5b77d868fdc0f0e49becd286d51b3a18c61d/yarl-1.23.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:e5723c01a56c5028c807c701aa66722916d2747ad737a046853f6c46f4875543", size = 101895, upload-time = "2026-03-01T22:06:04.651Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/54/f5b870b5505663911dba950a8e4776a0dbd51c9c54c0ae88e823e4b874a0/yarl-1.23.0-cp313-cp313-win32.whl", hash = "sha256:1b6b572edd95b4fa8df75de10b04bc81acc87c1c7d16bcdd2035b09d30acc957", size = 82356, upload-time = "2026-03-01T22:06:06.04Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/84/266e8da36879c6edcd37b02b547e2d9ecdfea776be49598e75696e3316e1/yarl-1.23.0-cp313-cp313-win_amd64.whl", hash = "sha256:baaf55442359053c7d62f6f8413a62adba3205119bcb6f49594894d8be47e5e3", size = 87515, upload-time = "2026-03-01T22:06:08.107Z" },
+    { url = "https://files.pythonhosted.org/packages/00/fd/7e1c66efad35e1649114fa13f17485f62881ad58edeeb7f49f8c5e748bf9/yarl-1.23.0-cp313-cp313-win_arm64.whl", hash = "sha256:fb4948814a2a98e3912505f09c9e7493b1506226afb1f881825368d6fb776ee3", size = 81785, upload-time = "2026-03-01T22:06:10.181Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/fc/119dd07004f17ea43bb91e3ece6587759edd7519d6b086d16bfbd3319982/yarl-1.23.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:aecfed0b41aa72b7881712c65cf764e39ce2ec352324f5e0837c7048d9e6daaa", size = 130719, upload-time = "2026-03-01T22:06:11.708Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/0d/9f2348502fbb3af409e8f47730282cd6bc80dec6630c1e06374d882d6eb2/yarl-1.23.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:a41bcf68efd19073376eb8cf948b8d9be0af26256403e512bb18f3966f1f9120", size = 89690, upload-time = "2026-03-01T22:06:13.429Z" },
+    { url = "https://files.pythonhosted.org/packages/50/93/e88f3c80971b42cfc83f50a51b9d165a1dbf154b97005f2994a79f212a07/yarl-1.23.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:cde9a2ecd91668bcb7f077c4966d8ceddb60af01b52e6e3e2680e4cf00ad1a59", size = 89851, upload-time = "2026-03-01T22:06:15.53Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/07/61c9dd8ba8f86473263b4036f70fb594c09e99c0d9737a799dfd8bc85651/yarl-1.23.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5023346c4ee7992febc0068e7593de5fa2bf611848c08404b35ebbb76b1b0512", size = 95874, upload-time = "2026-03-01T22:06:17.553Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/e9/f9ff8ceefba599eac6abddcfb0b3bee9b9e636e96dbf54342a8577252379/yarl-1.23.0-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d1009abedb49ae95b136a8904a3f71b342f849ffeced2d3747bf29caeda218c4", size = 88710, upload-time = "2026-03-01T22:06:19.004Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/78/0231bfcc5d4c8eec220bc2f9ef82cb4566192ea867a7c5b4148f44f6cbcd/yarl-1.23.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a8d00f29b42f534cc8aa3931cfe773b13b23e561e10d2b26f27a8d309b0e82a1", size = 101033, upload-time = "2026-03-01T22:06:21.203Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/9b/30ea5239a61786f18fd25797151a17fbb3be176977187a48d541b5447dd4/yarl-1.23.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:95451e6ce06c3e104556d73b559f5da6c34a069b6b62946d3ad66afcd51642ea", size = 100817, upload-time = "2026-03-01T22:06:22.738Z" },
+    { url = "https://files.pythonhosted.org/packages/62/e2/a4980481071791bc83bce2b7a1a1f7adcabfa366007518b4b845e92eeee3/yarl-1.23.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:531ef597132086b6cf96faa7c6c1dcd0361dd5f1694e5cc30375907b9b7d3ea9", size = 97482, upload-time = "2026-03-01T22:06:24.21Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/1e/304a00cf5f6100414c4b5a01fc7ff9ee724b62158a08df2f8170dfc72a2d/yarl-1.23.0-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:88f9fb0116fbfcefcab70f85cf4b74a2b6ce5d199c41345296f49d974ddb4123", size = 95949, upload-time = "2026-03-01T22:06:25.697Z" },
+    { url = "https://files.pythonhosted.org/packages/68/03/093f4055ed4cae649ac53bca3d180bd37102e9e11d048588e9ab0c0108d0/yarl-1.23.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:e7b0460976dc75cb87ad9cc1f9899a4b97751e7d4e77ab840fc9b6d377b8fd24", size = 95839, upload-time = "2026-03-01T22:06:27.309Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/28/4c75ebb108f322aa8f917ae10a8ffa4f07cae10a8a627b64e578617df6a0/yarl-1.23.0-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:115136c4a426f9da976187d238e84139ff6b51a20839aa6e3720cd1026d768de", size = 90696, upload-time = "2026-03-01T22:06:29.048Z" },
+    { url = "https://files.pythonhosted.org/packages/23/9c/42c2e2dd91c1a570402f51bdf066bfdb1241c2240ba001967bad778e77b7/yarl-1.23.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:ead11956716a940c1abc816b7df3fa2b84d06eaed8832ca32f5c5e058c65506b", size = 100865, upload-time = "2026-03-01T22:06:30.525Z" },
+    { url = "https://files.pythonhosted.org/packages/74/05/1bcd60a8a0a914d462c305137246b6f9d167628d73568505fce3f1cb2e65/yarl-1.23.0-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:fe8f8f5e70e6dbdfca9882cd9deaac058729bcf323cf7a58660901e55c9c94f6", size = 96234, upload-time = "2026-03-01T22:06:32.692Z" },
+    { url = "https://files.pythonhosted.org/packages/90/b2/f52381aac396d6778ce516b7bc149c79e65bfc068b5de2857ab69eeea3b7/yarl-1.23.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:a0e317df055958a0c1e79e5d2aa5a5eaa4a6d05a20d4b0c9c3f48918139c9fc6", size = 100295, upload-time = "2026-03-01T22:06:34.268Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/e8/638bae5bbf1113a659b2435d8895474598afe38b4a837103764f603aba56/yarl-1.23.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:6f0fd84de0c957b2d280143522c4f91a73aada1923caee763e24a2b3fda9f8a5", size = 97784, upload-time = "2026-03-01T22:06:35.864Z" },
+    { url = "https://files.pythonhosted.org/packages/80/25/a3892b46182c586c202629fc2159aa13975d3741d52ebd7347fd501d48d5/yarl-1.23.0-cp313-cp313t-win32.whl", hash = "sha256:93a784271881035ab4406a172edb0faecb6e7d00f4b53dc2f55919d6c9688595", size = 88313, upload-time = "2026-03-01T22:06:37.39Z" },
+    { url = "https://files.pythonhosted.org/packages/43/68/8c5b36aa5178900b37387937bc2c2fe0e9505537f713495472dcf6f6fccc/yarl-1.23.0-cp313-cp313t-win_amd64.whl", hash = "sha256:dd00607bffbf30250fe108065f07453ec124dbf223420f57f5e749b04295e090", size = 94932, upload-time = "2026-03-01T22:06:39.579Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/cc/d79ba8292f51f81f4dc533a8ccfb9fc6992cabf0998ed3245de7589dc07c/yarl-1.23.0-cp313-cp313t-win_arm64.whl", hash = "sha256:ac09d42f48f80c9ee1635b2fcaa819496a44502737660d3c0f2ade7526d29144", size = 84786, upload-time = "2026-03-01T22:06:41.988Z" },
     { url = "https://files.pythonhosted.org/packages/69/68/c8739671f5699c7dc470580a4f821ef37c32c4cb0b047ce223a7f115757f/yarl-1.23.0-py3-none-any.whl", hash = "sha256:a2df6afe50dea8ae15fa34c9f824a3ee958d785fd5d089063d960bae1daa0a3f", size = 48288, upload-time = "2026-03-01T22:07:51.388Z" },
 ]
 
@@ -4681,6 +5176,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/bb/43/3a16ff0a8c913bb9825379db1bd533c75c57c2d2f31dd9111aa9b53711f4/zstd-1.5.7.3-cp312-cp312-win32.whl", hash = "sha256:cbf48c53461e224ffc2490cfe5120a1ff40d14c84d2b512c6d6d99fc91685cf3", size = 150367, upload-time = "2026-01-08T17:03:40.178Z" },
     { url = "https://files.pythonhosted.org/packages/46/83/b85875d7428e63dfa9247e41d17fac611443c774f7892f8643bd4164a6b2/zstd-1.5.7.3-cp312-cp312-win_amd64.whl", hash = "sha256:943a189910f2fea997462e3e4d7fbf727a06d231ef801ebee557b1c87568981c", size = 167604, upload-time = "2026-01-08T17:03:41.355Z" },
     { url = "https://files.pythonhosted.org/packages/37/42/cf291e26804de2f55500cdac93f5e9fa6267cf315def8aa402529bae3a87/zstd-1.5.7.3-cp312-cp312-win_arm64.whl", hash = "sha256:85c4d508f8109afa7c51c4960626c3325af2cf1e442c6c36ebfea15d04757e3f", size = 157241, upload-time = "2026-01-08T16:47:34.615Z" },
+    { url = "https://files.pythonhosted.org/packages/21/7c/f2fe6e09b9d064873ebd384f2692b9fcad3d8e9412298dfb09a935aec77d/zstd-1.5.7.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:b2455e56f1d265dacbd450510b8c2f632a5d8d92c23282e7723fb04af37001a2", size = 268133, upload-time = "2026-01-08T17:31:54.616Z" },
+    { url = "https://files.pythonhosted.org/packages/14/8d/0a1e49844ed82c7ab0f66dce5e0dd822742fc7e9d04f147032db33740840/zstd-1.5.7.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3486dc4f1b4e52bb059f8eec1f31daa3e540062c0f522f221782cf132a8bc9a8", size = 231005, upload-time = "2026-01-08T17:31:55.885Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/24/0ab682096da2411f83236a10c89423f26859a65431660e460e2d637b5628/zstd-1.5.7.3-cp313-cp313-manylinux_2_14_i686.whl", hash = "sha256:1cb47bf10ffcb6a782edacfe758da2c94879f7e89c6628feb3f1254daf8cc596", size = 300230, upload-time = "2026-01-08T16:30:52.654Z" },
+    { url = "https://files.pythonhosted.org/packages/36/2e/3ff0d28ea8d6b9bd931af7477fad082b99633cb7901cdd657dcb7ecfee11/zstd-1.5.7.3-cp313-cp313-manylinux_2_14_x86_64.whl", hash = "sha256:07b1378d1230ddeea8773f99d7518a3060e6468c76edd502057cb795fe278d7e", size = 297097, upload-time = "2026-01-08T16:49:41.211Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/ef/25c15570fb6b06a4a03bd054afa2d084df687ac10e336b703139acc77182/zstd-1.5.7.3-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1ee34317f013e3405108f5baea53502159809cfc4510598d614257525500c70d", size = 2162274, upload-time = "2026-01-08T17:35:24.464Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/24/fd16ba9e9be877a2194f05462ae77dcb62c8f90c4ecc186d9ee71e9bdc9f/zstd-1.5.7.3-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c19127ca2c79855376a34a2d7a6969408094b25c1f44485b0373eba4be851b98", size = 2201877, upload-time = "2026-01-08T17:35:28.596Z" },
+    { url = "https://files.pythonhosted.org/packages/85/ef/73c37a81ac36429bb1bbb69c8ac43f3a154cfab739dce6424d28f95301c3/zstd-1.5.7.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:2e79cae70dd08cb247391312463085c624c0302e8c860d13f87f4c76502d8202", size = 2096535, upload-time = "2026-01-08T17:35:30.001Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/1f/859a8049634e444feb6855347d5e558c1280d87b0bc6385f13cd3d95dbe6/zstd-1.5.7.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:0e83e91e5daf89037c737f5529da0f80da80a78a6ad0b1d70a09860eb267dea4", size = 2125473, upload-time = "2026-01-08T17:35:26.596Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/5c/e7b8aa8eea46f032891ecef187f1d469e20f9ddf0d10607e9523b3d306a1/zstd-1.5.7.3-cp313-cp313-win32.whl", hash = "sha256:2283f3bb910c028e1b9fe76b834016012ab021025a0ea197e27a1333f85e3031", size = 150370, upload-time = "2026-01-08T17:18:12.899Z" },
+    { url = "https://files.pythonhosted.org/packages/50/2b/ba558ff87ba7f6c29e3a9b1c3b3e95338146aee7250b10807229d412a9c4/zstd-1.5.7.3-cp313-cp313-win_amd64.whl", hash = "sha256:3ad5fe4c36bab5dfa5a4b8d050bd07c50c1e69f94d381bc65337ab14cd69e5b1", size = 167602, upload-time = "2026-01-08T17:18:13.858Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/7d/4a5c9813fafad2949d42deee3857d7ecc8caf369bbf82a88b60519200083/zstd-1.5.7.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e878172b0eb69ac2edc6576eb862e00747c7c25e638fb354630a1ea7cfddf49", size = 157239, upload-time = "2026-01-08T16:42:28.885Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/67/5fcec6bbf8aab4aeb26e3cbe8cc9fa2f323dd143d066e313b134b8c28dc8/zstd-1.5.7.3-cp313-cp313t-manylinux_2_14_x86_64.whl", hash = "sha256:7e0a7e94d5b63b4cacf2396079ca9584d11f49f87cb4e5aa21f126a8f6b83446", size = 297302, upload-time = "2026-01-08T16:36:49.027Z" },
     { url = "https://files.pythonhosted.org/packages/64/ad/f6588943c9fde34a28f1b0448a8ac824b2ebe341f7af56ff035d0489338d/zstd-1.5.7.3-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:2b9ec4d5ba8c170d3fdf21ae5da3c15eaea2beef9c419a5f3274a6f9e03c412a", size = 260091, upload-time = "2026-01-08T17:14:18.143Z" },
     { url = "https://files.pythonhosted.org/packages/7a/6a/6d2d3b9b7bad0124c684b7b77621ee6bdc3fc220a580f002014cf0a8f558/zstd-1.5.7.3-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:a7ab69fc4d90eeb64b98a567751f8e48373f4bcf301597fca344b8e8342e1d5e", size = 221149, upload-time = "2026-01-08T17:14:17.168Z" },
     { url = "https://files.pythonhosted.org/packages/90/8d/ad4d3c24293c70d8ae9c80e06b2da2922048933f9a00f35d18df5166346a/zstd-1.5.7.3-pp310-pypy310_pp73-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:da70f0918bf739bc75d7770410c9b94ea0dcb6f02d7ef70598b464bd5fcb193a", size = 326792, upload-time = "2026-01-08T17:12:35.38Z" },