middle.network
Health check
Cyber security compliance

Cyber security compliance check

Whatever framework you answer to, the internet-facing evidence is the same: is email authenticated, is traffic encrypted, is DNS protected, what is exposed and who owns the domain. One run, mapped to ISO 27001, SOC 2 and NIST CSF.

Three frameworks, one run
ISO 27001, SOC 2 and NIST CSF 2.0 side by side.
For auditors and vendors
Check a supplier before you sign, or yourself before they ask.
Guides included
What each finding means for an audit, and what to ask for.
Options
Check
Test from
Finding the locations nearest you…
Starts with the locations nearest you. Tick more to compare.
Try:

What this check covers

Each check below is mapped to ISO 27001:2022, SOC 2 and NIST CSF 2.0.

Email sender authentication

SPF, DKIM and DMARC records, policy strength and alignment, BIMI

SPF checkDKIM checkDMARC checkBIMI check
ISO 27001A.5.14A.8.20
SOC 2CC6.6
NIST CSF 2.0PR.PS-01

Stops others sending email that claims to be you. A DMARC policy of quarantine or reject is the evidence; p=none is monitoring only.

Email in transit

MTA-STS, TLS-RPT, DANE and STARTTLS on every MX

MTA-STS checkTLS-RPT checkDANE / TLSASMTP test
ISO 27001A.5.14A.8.24
SOC 2CC6.7
NIST CSF 2.0PR.DS-02

Shows mail between servers is encrypted and can’t be quietly downgraded to plain text.

Web encryption

Certificate validity, chain, expiry, protocol versions and HSTS

SSL/TLS checkerCertificate transparencyHTTP/2, HTTP/3, IPv6 support
ISO 27001A.8.24
SOC 2CC6.7
NIST CSF 2.0PR.DS-02

Evidence that data to and from the website uses current, strong cryptography and that certificates are managed before they expire.

Website hardening

Security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy), redirects, HTTP to HTTPS

Security headersRedirect tracerHTTP check
ISO 27001A.8.9A.8.26
SOC 2CC6.6CC7.1
NIST CSF 2.0PR.PS-01

Secure configuration applied to the public face of the organisation, and a baseline to detect drift against.

DNS integrity

DNSSEC chain of trust, CAA records, lame or open nameservers

DNSSEC validationDNS health reportSingle record lookup
ISO 27001A.8.20A.8.24
SOC 2CC6.6
NIST CSF 2.0PR.DS-02

Protects the name everything else depends on from spoofing, and limits who can issue certificates for it.

Resilience

Nameserver count and diversity, SOA timers, MX redundancy, propagation from many regions

DNS health reportDNS propagationMX lookup
ISO 27001A.8.14A.5.30
SOC 2A1.2
NIST CSF 2.0PR.IR-03

One nameserver or one mail server is a single point of failure. Redundancy here supports continuity plans.

Exposed services

Common ports open to the internet, from outside the network

Port scannerPort check
ISO 27001A.8.20A.8.8
SOC 2CC6.6
NIST CSF 2.0ID.RA-01

Remote desktop, databases and admin panels facing the internet are the usual way in. Outside-in evidence the boundary does what the policy says.

Reputation

Domain and mail server IPs on spam and threat blocklists

Blacklist check
ISO 27001A.5.7
SOC 2CC7.2
NIST CSF 2.0ID.RA-02

A listing is often the first sign of a compromised mailbox or server.

Domain ownership

Registrar, expiry date, transfer lock, registrant privacy

WHOIS / RDAP (domain)Domain age and expiry
ISO 27001A.5.9A.5.19
SOC 2CC9.2
NIST CSF 2.0ID.AM-02

An expired or unlocked domain can be lost or hijacked. The registrar is a supplier like any other.

Attack surface

Subdomains seen in certificate logs and DNS, dangling records

Subdomain finderCertificate transparency
ISO 27001A.5.9A.8.8
SOC 2CC7.1
NIST CSF 2.0ID.AM-02

You can’t protect what isn’t on the asset register. Old subdomains pointing at deleted cloud resources can be taken over.

This maps what we can see from the internet to common controls, to help you gather evidence. It isn’t a certification, an audit opinion or legal advice. Your auditor, your scope and your Statement of Applicability decide what applies.

Guides for auditors

All guides
ISO 27001:2022 evidence you can collect from outside the network Which Annex A controls leave a trace on the internet, and how to evidence them in ten minutes. 8 min read · ISO 27001 auditors and ISMS owners
The ten-minute external security review: a checklist for auditors A repeatable outside-in review of any organisation’s domain, with what to record. 6 min read · Auditors and third-party risk teams
Auditing email authentication: SPF, DKIM and DMARC explained for auditors What each record proves, the five findings that matter, and the questions to ask. 7 min read · Auditors, GRC teams, IT managers
DNS and domain controls auditors overlook: DNSSEC, registrar lock and nameserver redundancy The domain itself is an asset. How to check it is owned, protected and resilient. 6 min read · Auditors and IT managers
Also:Domain auditDomain security auditISO 27001 domain compliance checkSOC 2 domain security check

Questions

One external check of a domain, mapped to ISO 27001:2022, SOC 2 and NIST CSF 2.0: email authentication, encryption, DNS integrity, exposed services, reputation and ownership.

Internal and external auditors, GRC and ISMS teams, MSPs preparing clients for certification, and anyone answering a vendor security questionnaire.

Yes. Everything we test is public, so you can check a supplier’s domain before onboarding them, and attach the result to your third-party risk assessment.

Essential Eight is about endpoints (patching, macros, admin rights, backups) and can’t be seen from outside. The ASD ISM’s email and web guidance, and Cyber Essentials’ firewall and secure configuration themes, line up with the email, TLS and exposed-port checks here.

Single tool runs aren’t stored. Health checks are kept so a domain’s history can be compared; recent public domains can show on our home page.