This finding is a test of another Custom Resource Actions control after the action "Bind the action to the selected resource's stable identifier and verify organization and project scope before execution.". It would not demonstrate the required Create an Orchestrator Action outcome for the campus research cluster: A type-checked test invocation returns the expected object fields without runtime conversion errors.

This finding is a test of another Deploy resource types control after the action "Match the catalog resource type to the required VM-service lifecycle and select an authorized image and VM class.". It would not demonstrate the required Create an Orchestrator Action outcome for the campus research cluster: A type-checked test invocation returns the expected object fields without runtime conversion errors.

This finding is a test of another Blueprints for deployment control after the action "Expose constrained eligible placement and image inputs while enforcing organization project policy in the blueprint design.". It would not demonstrate the required Create an Orchestrator Action outcome for the campus research cluster: A type-checked test invocation returns the expected object fields without runtime conversion errors.

This finding is a test of another Organizational Content Libraries control after the action "Restrict organizational library content to approved scanned and versioned artifacts with required governance checks.". It would not demonstrate the required Blueprints for deployment outcome for the industrial automation provider: Requests within approved CPU limits deploy and out-of-range requests are rejected before consuming resources.

This finding is a test of another Custom Resources control after the action "Scope custom resource creation, viewing, and Day 2 entitlements to authorized projects and role groups.". It would not demonstrate the required Blueprints for deployment outcome for the industrial automation provider: Requests within approved CPU limits deploy and out-of-range requests are rejected before consuming resources.

This finding is a test of another Deploy resource types control after the action "Verify the target type's supported organization scope and consumer role before exposing it as an approved catalog service.". It would not demonstrate the required Blueprints for deployment outcome for the industrial automation provider: Requests within approved CPU limits deploy and out-of-range requests are rejected before consuming resources.

This would change a different control (Provider rights bundles and orchestrator access): Map automation service identities to the required narrowly scoped rights bundle before removing legacy rights. The fault being investigated at the industrial automation provider instead requires the stated Provider-level VCF Data Services remediation. The expected result is: Test provisioning lands in the permitted location and prohibited region selections are unavailable.

This would change a different control (Provider certificates): Verify key-certificate correspondence and supported import format before replacing the active management certificate. The fault being investigated at the industrial automation provider instead requires the stated Provider-level VCF Data Services remediation. The expected result is: Test provisioning lands in the permitted location and prohibited region selections are unavailable.

This would change a different control (Provider certificates): Replace the incomplete or stale chain with the approved ordered intermediates and validate it from representative external clients. The fault being investigated at the industrial automation provider instead requires the stated Provider-level VCF Data Services remediation. The expected result is: Test provisioning lands in the permitted location and prohibited region selections are unavailable.

This finding is a test of another Private Transit Gateway IP Blocks and IP Quotas control after the action "Inventory allocated gateway and VPC addresses before editing or retiring the block; perform a supported controlled reassignment where needed.". It would not demonstrate the required Organization certificates and secrets outcome for the operations test environment: Subsequent executions mask the value in logs, and the compromised secret no longer authenticates.

This finding is a test of another All Apps organization projects control after the action "Scope project membership to the approved group and validate direct and inherited permissions for the pilot.". It would not demonstrate the required Organization certificates and secrets outcome for the operations test environment: Subsequent executions mask the value in logs, and the compromised secret no longer authenticates.

This finding is a test of another All Apps organization projects control after the action "Associate appropriate Cloud Zones and permitted regions to the project before publishing a usable service catalog.". It would not demonstrate the required Organization certificates and secrets outcome for the operations test environment: Subsequent executions mask the value in logs, and the compromised secret no longer authenticates.

This would change a different control (Create an Orchestrator Action): Scope Action execution and workflow exposure to approved roles and use a least-privileged integration identity. The fault being investigated at the regulated finance tenant instead requires the stated Blueprints for deployment remediation. The expected result is: Published template source contains no usable password and the resource authenticates during provisioning.

This would change a different control (Create an Orchestrator Workflow): Add the approved reusable Action as a workflow element and pass its expected inputs through supported bindings. The fault being investigated at the regulated finance tenant instead requires the stated Blueprints for deployment remediation. The expected result is: Published template source contains no usable password and the resource authenticates during provisioning.

This would change a different control (Organizational Content Libraries): Validate library synchronization and pinned artifact versions before refreshing organization-level image consumers. The fault being investigated at the regulated finance tenant instead requires the stated Blueprints for deployment remediation. The expected result is: Published template source contains no usable password and the resource authenticates during provisioning.

This finding is a test of another Create an Orchestrator Action control after the action "Create a reusable Orchestrator Action with documented parameter and return types and call it from the affected workflows.". It would not demonstrate the required Deploy resource types outcome for the edge facility region: The resulting resource has an address in the intended VPC and no unintended public network interface.

This finding is a test of another Upload and manage Images control after the action "Apply consistent image version metadata and retire or restrict the older artifact under image governance.". It would not demonstrate the required Deploy resource types outcome for the edge facility region: The resulting resource has an address in the intended VPC and no unintended public network interface.

This finding is a test of another Deploy using blueprints in Service Catalog control after the action "Verify catalog sharing, project membership, and resource-level rights for the requested blueprint.". It would not demonstrate the required Deploy resource types outcome for the edge facility region: The resulting resource has an address in the intended VPC and no unintended public network interface.

This would change a different control (Deploy using blueprints in Service Catalog): Inspect the request's validation and placement errors, then correct the eligible zone, quota, or input selection. The fault being investigated at the managed infrastructure tenant instead requires the stated Deploy and configure Operations Orchestrator in All Apps remediation. The expected result is: A tenant author can edit only permitted workflows and cannot enumerate another organization's secrets.

This would change a different control (Components of an Orchestrator workflow): Place reusable logic in an Action, define workflow inputs and outputs explicitly, and access external systems through the supported plug-in objects. The fault being investigated at the managed infrastructure tenant instead requires the stated Deploy and configure Operations Orchestrator in All Apps remediation. The expected result is: A tenant author can edit only permitted workflows and cannot enumerate another organization's secrets.

This would change a different control (Day 2 deployment and resource actions): Use a controlled Day 2 retirement flow that preserves required data and releases only permitted resources. The fault being investigated at the managed infrastructure tenant instead requires the stated Deploy and configure Operations Orchestrator in All Apps remediation. The expected result is: A tenant author can edit only permitted workflows and cannot enumerate another organization's secrets.

This finding is a test of another Custom Resources control after the action "Implement or invoke supported delete and reconciliation lifecycle actions against the external resource, with retention safeguards.". It would not demonstrate the required Create an Orchestrator Action outcome for the regional support facility: Authorized operators can run the network change and general consumers are denied the operation.

This finding is a test of another Organizational Content Libraries control after the action "Validate library synchronization and pinned artifact versions before refreshing organization-level image consumers.". It would not demonstrate the required Create an Orchestrator Action outcome for the regional support facility: Authorized operators can run the network change and general consumers are denied the operation.

This finding is a test of another Blueprints for deployment control after the action "Use secure secret references and deployment-time retrieval rather than hardcoded sensitive values in the blueprint.". It would not demonstrate the required Create an Orchestrator Action outcome for the regional support facility: Authorized operators can run the network change and general consumers are denied the operation.

This would change a different control (Organization Orchestrator and Git integrations): Update and synchronize the organization's Git content reference to the approved branch or commit under change control. The fault being investigated at the shared application platform instead requires the stated All Apps organization access control remediation. The expected result is: A post-expiry sign-in cannot consume or modify tenant resources while an internal owner retains access.

This would change a different control (Organization Orchestrator and Git integrations): Validate the workflow dependencies and per-organization integration scope before publishing it to selected tenants. The fault being investigated at the shared application platform instead requires the stated All Apps organization access control remediation. The expected result is: A post-expiry sign-in cannot consume or modify tenant resources while an internal owner retains access.

This would change a different control (Organization certificates and secrets): Revoke and rotate the exposed secret, adjust workflow redaction and logging, and scope access to any retained incident evidence. The fault being investigated at the shared application platform instead requires the stated All Apps organization access control remediation. The expected result is: A post-expiry sign-in cannot consume or modify tenant resources while an internal owner retains access.

This would change a different control (Regions cloud zones quotas flavors and extensibility design): Separate approved custom inputs and extensibility hooks from secret storage and external integrations in the deployment design. The fault being investigated at the regulated finance tenant instead requires the stated VCFA tenancy deployment models remediation. The expected result is: Provider operators retain sanctioned control, while tenant administrators see only authorized organizations and their resources.

This would change a different control (All Apps versus VM Apps organization types): Match each organization's type to its actual consumption needs and document portal, networking, and feature availability before provisioning. The fault being investigated at the regulated finance tenant instead requires the stated VCFA tenancy deployment models remediation. The expected result is: Provider operators retain sanctioned control, while tenant administrators see only authorized organizations and their resources.

This would change a different control (All Apps versus VM Apps organization types): Validate the documented organization-type lifecycle and plan a supported organization or workload transition instead of assuming an arbitrary in-place conversion. The fault being investigated at the regulated finance tenant instead requires the stated VCFA tenancy deployment models remediation. The expected result is: Provider operators retain sanctioned control, while tenant administrators see only authorized organizations and their resources.

This would change a different control (Provider rights bundles and orchestrator access): Replace excess integration privileges with a rights bundle granting only needed observation or consumption access. The fault being investigated at the project release environment instead requires the stated Provider certificates remediation. The expected result is: Clients validate the portal hostname and certificate chain without a browser trust exception.

This would change a different control (Provider-level VCF Data Services): Inspect the data-service integration's own job logs, health, capacity, and API connectivity before attributing the failure to general VM provisioning. The fault being investigated at the project release environment instead requires the stated Provider certificates remediation. The expected result is: Clients validate the portal hostname and certificate chain without a browser trust exception.

This would change a different control (Organization branding in provider portal): Configure organization-specific branding at the provider-managed organization scope instead of changing the shared platform identity. The fault being investigated at the project release environment instead requires the stated Provider certificates remediation. The expected result is: Clients validate the portal hostname and certificate chain without a browser trust exception.