11/11 PCI FIXES VERIFIED · 12 TRANSACTION FINDINGS

az storage account update -n titanlive8909pub -g titan-live-20260419 --allow-blob-public-access false

az storage account update -n titanlive8909pub -g titan-live-20260419 --allow-blob-public-access true

{
  "accessTier": "Hot",
  "accountMigrationInProgress": null,
  "allowBlobPublicAccess": false,
  "allowCrossTenantReplication": false,
  "allowSharedKeyAccess": null,
  "allowedCopyScope": null,
  "azureFilesIdentityBasedAuthentication": null,
  "blobRestoreStatus": null,
  "creationTime": "2026-04-19T20:35:23.561469+00:00",
  "customDomain": null,
  "defaultToOAuthAuthentication": null,
  "dnsEndpointType": null,
  "dualStackEndpointPreference"

az storage account update -n titanlive8909pub -g titan-live-20260419 --min-tls-version TLS1_2

az storage account update -n titanlive8909pub -g titan-live-20260419 --min-tls-version TLS1_0

{
  "accessTier": "Hot",
  "accountMigrationInProgress": null,
  "allowBlobPublicAccess": false,
  "allowCrossTenantReplication": false,
  "allowSharedKeyAccess": null,
  "allowedCopyScope": null,
  "azureFilesIdentityBasedAuthentication": null,
  "blobRestoreStatus": null,
  "creationTime": "2026-04-19T20:35:23.561469+00:00",
  "customDomain": null,
  "defaultToOAuthAuthentication": null,
  "dnsEndpointType": null,
  "dualStackEndpointPreference"

az storage account update -n titanlive8909tls -g titan-live-20260419 --min-tls-version TLS1_2

az storage account update -n titanlive8909tls -g titan-live-20260419 --min-tls-version TLS1_0

{
  "accessTier": "Hot",
  "accountMigrationInProgress": null,
  "allowBlobPublicAccess": false,
  "allowCrossTenantReplication": false,
  "allowSharedKeyAccess": null,
  "allowedCopyScope": null,
  "azureFilesIdentityBasedAuthentication": null,
  "blobRestoreStatus": null,
  "creationTime": "2026-04-19T20:36:24.057441+00:00",
  "customDomain": null,
  "defaultToOAuthAuthentication": null,
  "dnsEndpointType": null,
  "dualStackEndpointPreference"

az network nsg rule update -g titan-live-20260419 --nsg-name nsg-titan-8909 -n allow-ssh-from-internet --source-address-prefixes 10.0.0.0/8

az network nsg rule update -g titan-live-20260419 --nsg-name nsg-titan-8909 -n allow-ssh-from-internet --source-address-prefixes '0.0.0.0/0'

{
  "access": "Allow",
  "destinationAddressPrefix": "*",
  "destinationAddressPrefixes": [],
  "destinationPortRange": "22",
  "destinationPortRanges": [],
  "direction": "Inbound",
  "etag": "W/\"6d8a94e3-3010-4811-816e-4b7bf896b1c8\"",
  "id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/titan-live-20260419/providers/Microsoft.Network/networkSecurityGroups/nsg-titan-8909/securityRules/allow-ssh-from-internet",
  "na

az storage account update -n titanlive8909nohttps -g titan-live-20260419 --min-tls-version TLS1_2

az storage account update -n titanlive8909nohttps -g titan-live-20260419 --min-tls-version TLS1_0

{
  "accessTier": "Hot",
  "accountMigrationInProgress": null,
  "allowBlobPublicAccess": false,
  "allowCrossTenantReplication": false,
  "allowSharedKeyAccess": null,
  "allowedCopyScope": null,
  "azureFilesIdentityBasedAuthentication": null,
  "blobRestoreStatus": null,
  "creationTime": "2026-04-19T20:37:19.927940+00:00",
  "customDomain": null,
  "defaultToOAuthAuthentication": null,
  "dnsEndpointType": null,
  "dualStackEndpointPreference"

aws s3api put-public-access-block --bucket titan-live-8909-patient-backups --public-access-block-configuration "BlockPublicAcls=true,BlockPublicPolicy=true,IgnorePublicAcls=true,RestrictPublicBuckets=true"

aws s3api delete-public-access-block --bucket titan-live-8909-patient-backups

(no stdout)

aws s3api delete-bucket-policy --bucket titan-live-8909-patient-backups

aws s3api put-bucket-policy --bucket titan-live-8909-patient-backups --policy '<backup-policy-json>'

(no stdout)

aws iam detach-user-policy --user-name titan-live-admin-8909 --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

aws iam attach-user-policy --user-name titan-live-admin-8909 --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

(no stdout)

aws iam delete-access-key --user-name titan-live-admin-8909 --access-key-id AKIAWRW7XUVSTZEXY4QF

(no rollback — re-create key if needed via create-access-key)

(no stdout)

aws ec2 revoke-security-group-ingress --region us-east-2 --group-id sg-0d117494ca7a9c594 --protocol tcp --port 5432 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress --region us-east-2 --group-id sg-0d117494ca7a9c594 --protocol tcp --port 5432 --cidr 0.0.0.0/0

{
    "Return": true,
    "RevokedSecurityGroupRules": [
        {
            "SecurityGroupRuleId": "sgr-08b4e6fc84ed4aa12",
            "GroupId": "sg-0d117494ca7a9c594",
            "IsEgress": false,
            "IpProtocol": "tcp",
            "FromPort": 5432,
            "ToPort": 5432,
            "CidrIpv4": "0.0.0.0/0"
        }
    ]
}

aws ec2 revoke-security-group-ingress --region us-east-2 --group-id sg-0d117494ca7a9c594 --protocol tcp --port 22 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress --region us-east-2 --group-id sg-0d117494ca7a9c594 --protocol tcp --port 22 --cidr 0.0.0.0/0

{
    "Return": true,
    "RevokedSecurityGroupRules": [
        {
            "SecurityGroupRuleId": "sgr-0c506a027e17cfeb0",
            "GroupId": "sg-0d117494ca7a9c594",
            "IsEgress": false,
            "IpProtocol": "tcp",
            "FromPort": 22,
            "ToPort": 22,
            "CidrIpv4": "0.0.0.0/0"
        }
    ]
}

file SAR within 30 days via FinCEN BSA E-Filing system referencing 31 CFR 1020.320(a)(2) structuring violation, freeze account:checking-882145 immediately, escalate to BSA officer for investigation

unfreeze account if BSA officer determines pattern is legitimate business activity with documented justification in compliance file

IMMEDIATE: Execute OFAC_BLOCK on wire-batch:20260418-WIRE, file SAR within 30 days via FinCEN BSA E-Filing for suspicious activity code 35 (transactions with countries subject to sanctions), freeze all accounts for party:global-trade-solutions-inc, and notify OFAC within 10 business days via OFAC reporting portal

If false positive confirmed by OFAC written determination, unfreeze accounts, release wire with OFAC license documentation, and file amended SAR noting resolution

Place temporary monitoring hold on customer:juan-rodriguez-pep-17281 and escalate to BSA Officer for immediate EDD initiation per 31 CFR 1010.610(b) - document PEP association category 1.3 in customer file within 24 hours

If PEP match is false positive, document verification evidence in customer file and remove monitoring hold with BSA Officer approval

IMMEDIATE: Block transaction txn:PAN-4521...3878, send decline code 05 to merchant mid:pyx-payments, create fraud case FR-$(date +%Y%m%d)-001 in fraud management system, notify cardholder via SMS/email of blocked transaction within 2 hours

If false positive confirmed by cardholder verification, unblock card and process original transaction with fraud override code, document in case file

hold ACH batch 20260419-ACH immediately and file SAR within 30 days via FinCEN BSA E-Filing citing synthetic identity fraud pattern with 47 suspicious SSNs and shared addresses

if investigation proves payees legitimate, release held batch with enhanced monitoring tags and document false positive analysis

Place immediate hold on account:checking-118422, freeze all outbound transactions, reverse pending $4,500 ACH if not yet settled, and escalate to Fraud Operations team for customer contact verification within 2 hours

Remove account hold and release ACH transaction only after documented customer verification and fraud team approval with supervisor sign-off

Suspend all account opening activities for onboarding:case-00284751 and initiate enhanced CDD collection requiring: (1) certified beneficial ownership certification form identifying all natural persons owning >=25% equity interest, (2) corporate structure chart with ownership percentages for all Luxembourg/Panama entities, (3) government-issued identification for each beneficial owner, (4) source of wealth documentation for each beneficial owner. Set 30-day collection deadline with automatic case closure if incomplete.

If documentation proves inadequate, escalate to BSA officer for suspicious activity evaluation and potential account rejection with written notice citing CDD deficiencies

Immediately move customer:coastal-crypto-exchange to enhanced KYC tier in onboarding system, require additional MSB documentation per 31 CFR 1022.210, and file SAR within 30 days via FinCEN BSA E-Filing for inadequate MSB monitoring

If enhanced tier classification is incorrect, revert to standard tier but maintain MSB designation and obtain BSA officer written approval with documented risk assessment

Execute remediation sequence: 1) Retrieve 17-Apr patch batch change-control docs from IT ticketing system and compile approval chain evidence for PCI-Q2-2026/6.4.5/, 2) Generate retrospective security event log review documentation for missing 11-day period with supervisor attestation for PCI-Q2-2026/10.6.1/, 3) Execute emergency internal vulnerability scan via authorized scanner and generate compliance report for PCI-Q2-2026/11.2.1/, 4) Schedule and conduct mandatory IR plan tabletop exercise within 72 hours with QSA-acceptable documentation for PCI-Q2-2026/12.10.2/

Maintain original evidence pack as PCI-Q2-2026-ORIGINAL, document any gaps as compensating controls with risk acceptance from senior management if remediation cannot be completed before QSA review

Immediately escalate 56 overdue user access reviews to respective business owners with 5-day completion deadline, document all review decisions in SOX compliance system with timestamped approvals/terminations, and prepare deficiency remediation memo for external auditors

If business owners cannot complete reviews in time, temporarily disable access for overdue users pending review completion and document emergency access procedures

Immediately initiate bulk privacy notice mailing via approved vendor using template GLBA-2026-ANNUAL stored in compliance repository, target all 312,804 active customer records in CRM system, track delivery confirmations, and file regulatory notification with primary federal regulator within 48 hours documenting remediation timeline

If mailing contains errors, issue corrective notice within 10 days and maintain documentation of both mailings for examination purposes

Initiate FFIEC CAT self-assessment update via ffieccat.gov portal within 30 days, incorporating AI-enabled phishing and supply-chain attack vectors into inherent risk profile, update cybersecurity maturity targets accordingly, and establish formal annual refresh policy with board oversight

Revert to previous CAT assessment baseline if new risk ratings trigger unplanned capital allocation or regulatory scrutiny before board approval