This finding is a test of another Components of an Orchestrator workflow control after the action "Place reusable logic in an Action, define workflow inputs and outputs explicitly, and access external systems through the supported plug-in objects.". It would not demonstrate the required Custom Property Groups outcome for the edge facility region: Catalog submission blocks missing owner values and created resources show the approved tag.

This finding is a test of another Deploy resource types control after the action "Identify the deployed resource type and use its supported lifecycle operations rather than a generic action meant for another target.". It would not demonstrate the required Custom Property Groups outcome for the edge facility region: Catalog submission blocks missing owner values and created resources show the approved tag.

This finding is a test of another Deploy using blueprints in Service Catalog control after the action "Supply the verified mandatory catalog inputs using the approved classification and policy rather than suppressing validation.". It would not demonstrate the required Custom Property Groups outcome for the edge facility region: Catalog submission blocks missing owner values and created resources show the approved tag.

This finding is a test of another Delete organizations control after the action "Use supported lifecycle inventory and dependency cleanup rather than bypassing platform management APIs with backend changes.". It would not demonstrate the required Provider rights bundles and orchestrator access outcome for the project release environment: A test user can inspect allowed run status but is denied privileged integration changes.

This finding is a test of another Provider certificates control after the action "Install a valid trusted provider-level certificate with the correct names and intermediate chain through supported certificate management.". It would not demonstrate the required Provider rights bundles and orchestrator access outcome for the project release environment: A test user can inspect allowed run status but is denied privileged integration changes.

This finding is a test of another Provider Content Libraries control after the action "Review library synchronization schedule, source reachability, and image distribution constraints; plan controlled synchronization during an approved window.". It would not demonstrate the required Provider rights bundles and orchestrator access outcome for the project release environment: A test user can inspect allowed run status but is denied privileged integration changes.

This would change a different control (All Apps organization projects): Reconcile project ownership, membership, active resource entitlements, and cost visibility in a controlled handover. The fault being investigated at the migration validation environment instead requires the stated All Apps organization access control remediation. The expected result is: Image assignment succeeds in the approved project and remains prohibited in the other project.

This would change a different control (Namespace Classes in All Apps organizations): Reconcile the Namespace Class with supported current VM classes and Supervisor capabilities before republishing it. The fault being investigated at the migration validation environment instead requires the stated All Apps organization access control remediation. The expected result is: Image assignment succeeds in the approved project and remains prohibited in the other project.

This would change a different control (All Apps organization identity providers): Align supported identity attributes and stable identifiers between the organization's IdP and automation integration before onboarding additional users. The fault being investigated at the migration validation environment instead requires the stated All Apps organization access control remediation. The expected result is: Image assignment succeeds in the approved project and remains prohibited in the other project.

This would change a different control (Provider rights bundles and orchestrator access): Replace excess integration privileges with a rights bundle granting only needed observation or consumption access. The fault being investigated at the enterprise data platform instead requires the stated Delete organizations remediation. The expected result is: The platform deletion operation completes cleanly with no broken organization references or unexplained errors.

This would change a different control (Provider Regions): Establish distinct operator-facing names and confirm stable underlying Region identifiers before changing catalog and placement mappings. The fault being investigated at the enterprise data platform instead requires the stated Delete organizations remediation. The expected result is: The platform deletion operation completes cleanly with no broken organization references or unexplained errors.

This would change a different control (Provider-level VCF Data Services): Configure the supported VCF Data Services provider integration and its prerequisites before exposing the service for organization consumption. The fault being investigated at the enterprise data platform instead requires the stated Delete organizations remediation. The expected result is: The platform deletion operation completes cleanly with no broken organization references or unexplained errors.

This finding is a test of another Provider portal identity provider control after the action "Update or refresh supported identity-provider trust metadata and validate certificate rollover before disabling emergency access.". It would not demonstrate the required Provider-level VCF Data Services outcome for the campus research cluster: A pilot provisioning request completes against the registered data-services infrastructure and reports a healthy resource.

This finding is a test of another Provider Regions control after the action "Establish distinct operator-facing names and confirm stable underlying Region identifiers before changing catalog and placement mappings.". It would not demonstrate the required Provider-level VCF Data Services outcome for the campus research cluster: A pilot provisioning request completes against the registered data-services infrastructure and reports a healthy resource.

This finding is a test of another Provider Consumption Organization PCO control after the action "Inventory PCO deployments and internal automation references; migrate or retire them safely before changing PCO enablement.". It would not demonstrate the required Provider-level VCF Data Services outcome for the campus research cluster: A pilot provisioning request completes against the registered data-services infrastructure and reports a healthy resource.

This finding is a test of another Provider certificates control after the action "Reissue and install a provider certificate covering every supported management hostname and verify each expected FQDN.". It would not demonstrate the required Provider portal identity provider outcome for the central service management environment: New SSO assertions validate with the current signing key and a monitored break-glass access path remains available.

This finding is a test of another Provider Management portal configuration control after the action "Reconcile the provider inventory identifier with the correct infrastructure endpoint and approved naming convention before enabling use in policies.". It would not demonstrate the required Provider portal identity provider outcome for the central service management environment: New SSO assertions validate with the current signing key and a monitored break-glass access path remains available.

This finding is a test of another Create organizations in provider portal control after the action "Create the appropriate organization with verified type, region eligibility, delegated ownership, and onboarding controls.". It would not demonstrate the required Provider portal identity provider outcome for the central service management environment: New SSO assertions validate with the current signing key and a monitored break-glass access path remains available.

This would change a different control (Upload and manage Images): Remove embedded secrets, re-image with approved hardening, and keep runtime secrets in protected organization storage. The fault being investigated at the pilot organization instead requires the stated Blueprints for deployment remediation. The expected result is: The network is created or selected before the VM interface attaches and the request completes consistently.

This would change a different control (Organizational Content Libraries): Create or associate the supported organizational content library and configure permitted project visibility. The fault being investigated at the pilot organization instead requires the stated Blueprints for deployment remediation. The expected result is: The network is created or selected before the VM interface attaches and the request completes consistently.

This would change a different control (Deploy resource types): Deploy through the supported resource type and catalog inputs that attach the workload to the approved project VPC. The fault being investigated at the pilot organization instead requires the stated Blueprints for deployment remediation. The expected result is: The network is created or selected before the VM interface attaches and the request completes consistently.

This finding is a test of another Private Transit Gateway IP Blocks and IP Quotas control after the action "Set organization and project PTG IP quotas from approved allocation budgets and capacity forecasts.". It would not demonstrate the required All Apps organization access control outcome for the managed infrastructure tenant: A review report demonstrates approved role sources and removal of unjustified overlapping permissions.

This finding is a test of another Governance policies in All Apps organizations control after the action "Use a controlled negative test and inspect evaluation results to validate effective policy enforcement at the resource scope.". It would not demonstrate the required All Apps organization access control outcome for the managed infrastructure tenant: A review report demonstrates approved role sources and removal of unjustified overlapping permissions.

This finding is a test of another VPCs and connectivity profiles control after the action "Validate effective connectivity-profile routing, firewall policy, and actual traffic through the supported VPC path.". It would not demonstrate the required All Apps organization access control outcome for the managed infrastructure tenant: A review report demonstrates approved role sources and removal of unjustified overlapping permissions.

This would change a different control (Provider rights bundles and orchestrator access): Correct the organization-level rights bundle mapping and test cross-tenant separation of workflow operations. The fault being investigated at the enterprise data platform instead requires the stated Provider Management portal configuration remediation. The expected result is: The provider portal shows the intended registered resources and a delegated tenant cannot change provider-only settings.

This would change a different control (Organization branding in provider portal): Replace the branding asset with a supported format and dimensions and preview its presentation before publishing. The fault being investigated at the enterprise data platform instead requires the stated Provider Management portal configuration remediation. The expected result is: The provider portal shows the intended registered resources and a delegated tenant cannot change provider-only settings.

This would change a different control (Provider Content Libraries): Validate supported artifact format and target compatibility before marking the image available for tenant self-service. The fault being investigated at the enterprise data platform instead requires the stated Provider Management portal configuration remediation. The expected result is: The provider portal shows the intended registered resources and a delegated tenant cannot change provider-only settings.

This would change a different control (Provider Regions): Inventory dependent organizations, projects, and deployments; migrate or retire them through supported lifecycle actions before Region removal. The fault being investigated at the provider North Region instead requires the stated Organization branding in provider portal remediation. The expected result is: The portal's support link resolves only to the documented approved endpoint over HTTPS.

This would change a different control (Provider Regions): Restrict organization and project Region availability based on approved location and residency policy rather than user preference alone. The fault being investigated at the provider North Region instead requires the stated Organization branding in provider portal remediation. The expected result is: The portal's support link resolves only to the documented approved endpoint over HTTPS.

This would change a different control (Delete organizations): Use supported lifecycle inventory and dependency cleanup rather than bypassing platform management APIs with backend changes. The fault being investigated at the provider North Region instead requires the stated Organization branding in provider portal remediation. The expected result is: The portal's support link resolves only to the documented approved endpoint over HTTPS.

This finding is a test of another VPCs and connectivity profiles control after the action "Choose a compatible connectivity profile for the target Region and confirm NSX and Supervisor backing requirements.". It would not demonstrate the required Namespace Classes in All Apps organizations outcome for the public utility tenancy: A request using the class creates a namespace with the expected quotas and allowed services.

This finding is a test of another Private Transit Gateway IP Blocks and IP Quotas control after the action "Reconcile actual consumption, reclaim unused allocations, and extend only with approved nonoverlapping capacity instead of bypassing quotas.". It would not demonstrate the required Namespace Classes in All Apps organizations outcome for the public utility tenancy: A request using the class creates a namespace with the expected quotas and allowed services.

This finding is a test of another Private Transit Gateway IP Blocks and IP Quotas control after the action "Inventory allocated gateway and VPC addresses before editing or retiring the block; perform a supported controlled reassignment where needed.". It would not demonstrate the required Namespace Classes in All Apps organizations outcome for the public utility tenancy: A request using the class creates a namespace with the expected quotas and allowed services.