Texas DIR Control Standards compliance: what passes the audit and what attackers find afterward
Geert WarmenbolApril 29, 2026
Key takeaways
Texas DIR Control Standards audits routinely approve Active Directory environments without inspecting Group Policy Objects. Rogue GPOs that disable SMB signing, grant excessive privileges, or suppress security agent telemetry are invisible to policy-level review and exploitable from any compromised workstation.
The average time from vulnerability disclosure to detection in Vulnox assessments of Texas DIR client environments is 78 days -- the window during which known, patched vulnerabilities are being actively exploited against unpatched systems that passed their last compliance audit.
Texas DIR Control Standard AT-1 mandates periodic penetration testing but specifies neither scope nor methodology. Organizations regularly satisfy this requirement with assessments that exclude IoT device API endpoints, which are the most common initial access vector in Vulnox assessments of Texas public sector environments.
Post-breach, Texas DIR regulators request incident timelines in CSV format with precise timestamps, affected systems, user accounts, and specific data elements -- not PDF summary reports. Organizations that have not pre-built this evidence format spend 60 to 90 days reconstructing data that should have been logged in real time.
Remediating application-level vulnerabilities before implementing network segmentation produces rework. A flat network means any application hardening effort can be bypassed by pivoting from a single compromised endpoint. Segmentation first is not a preference -- it is the sequence that makes everything else hold.
SMBv1 was present and active in 32% of Texas DIR client environments assessed by Vulnox in 2024, despite being disabled by default in Windows Server 2016 and later. It was re-enabled, in most cases, by legacy software compatibility requirements that were addressed years earlier and never reversed.
TL;DR
Texas DIR Control Standards audits are designed to verify that documented controls exist. Attackers do not read documentation -- they probe the actual environment. The gap between what an audit approves and what a real assessment finds is consistent and specific: Group Policy Objects that auditors never inspect, patch pipelines that tool owners assume are automated, penetration tests scoped to exclude the attack surface that matters, and incident evidence that does not exist in the format regulators will demand. Passing the audit is not the goal. The goal is making the audit meaningless because the environment is actually secure.
All green, two weeks before ransomware
A Texas county IT director walked Vulnox through their last DIR audit results before the engagement started. Every control area was green. Access control policies documented. MFA enforced on privileged accounts. Patch management process in place. Incident response plan current. The auditors had reviewed the policy documents, sampled a set of user accounts to confirm MFA status, and confirmed that the patching tool -- Qualys -- was deployed and running. The audit took two days. Two weeks after the results were delivered, ransomware encrypted half their servers. The initial access vector was a service account that had been granted domain admin privileges via a Group Policy Object six months earlier, when a legacy application required elevated access during a migration. The migration was complete. The GPO was never reversed. The service account still had domain admin rights. The auditor had not pulled the GPO list.
The audit had confirmed that access control policies required least-privilege principles. It had not confirmed that the actual GPO configuration enforced those principles. Those are two different checks. The documentation described the intended state. The GPO reflected the operational state. In environments where both exist, attackers read the GPOs.
What Active Directory hygiene means in a DIR audit context and why auditors skip it
Texas DIR Control Standards AC-1 and IA-2 address access control policies and multi-factor authentication. An auditor satisfying these controls will review the documented access control policy, confirm it exists and is current, sample a set of privileged user accounts to verify MFA enrollment, and confirm that account creation and deprovisioning procedures are documented. This takes a few hours and produces a defensible audit record. What it does not produce is any visibility into the Group Policy Object configuration that actually governs how access control settings are applied across the domain. GPOs sit between policy documentation and actual system behavior. A policy that says 'disable SMB signing is prohibited' has no enforcement mechanism other than the GPO configuration. If a GPO exists that disables SMB signing -- because someone enabled it for a compatibility reason, because a legacy scanner required it, because a vendor's deployment script set it -- the policy document is accurate and the environment is exploitable. These two things coexist routinely.
Example
In Vulnox assessments, the GPO findings that matter most are not novel configurations. They are reversals of security defaults: SMB signing disabled, NTLM authentication enabled where Kerberos should be enforced, Windows Defender exclusions applied to directories that contain production data, and telemetry suppressed for endpoint detection agents. Each of these has a plausible origin -- a compatibility requirement, a vendor instruction, a performance complaint -- and each was never reversed when the originating need passed. The auditor approved the policy. The GPO recorded the reality.
Validating Active Directory security hygiene against Texas DIR requirements requires pulling and reviewing the complete GPO list, not sampling. It requires checking GPO precedence -- which GPO wins when multiple apply to the same object -- and verifying that security-relevant settings in higher-precedence GPOs are not overridden by lower ones. This takes several hours in a medium-size environment. It is not part of a standard compliance audit workflow because standard compliance audit workflows are built around document review, not configuration inspection.
What the environment looks like after the audit approves it
Assessment base: Vulnox Texas DIR Control Standards assessments and post-incident analyses, 2023-2025, covering county governments, state agencies, and DIR-covered vendors across Texas
SMBv1 active on Windows Server environments that passed DIR audits
In 32% of Texas DIR client environments assessed by Vulnox in 2024, SMBv1 was active on at least one Windows Server. In every case, the server was running Windows Server 2016 or later -- a version where SMBv1 is disabled by default. In every case, SMBv1 had been re-enabled. The most common reason: a legacy application or network scanner that required SMBv1 had been replaced or decommissioned, but the protocol re-enablement had never been reversed. The DIR audit had not checked protocol-level configuration. The patch management documentation was current. The protocol that EternalBlue exploits was running.
SMBv1 is not a nuanced risk. It is a categorically deprecated protocol with publicly available exploit code that has been used in every major ransomware campaign since 2017. An environment running SMBv1 that passes a DIR audit has a documentation-to-reality gap that an attacker will close in minutes. The fix is a single PowerShell command. The detection requires checking the actual configuration, not the policy.
Patch management pipelines where tool deployment is confused for tool operation
The most consistent patch management finding across Texas DIR assessments is not the absence of a patching tool. It is the assumption that deploying a patching tool produces patching. In the specific case documented above, Qualys was deployed, licensed, and scanning. Scan results were generated and accessible. The process for translating scan results into patching tickets, assigning ownership, and tracking remediation to completion did not exist in any documented or operational form. The security team believed Qualys automated remediation. It does not. It automates discovery. Remediation requires a separate process.
The average time from vulnerability disclosure to detection in these environments was 78 days -- the period between a CVE being published and a Vulnox assessment finding it unpatched in a production system. In most cases, exploitation tooling for those CVEs was publicly available within two weeks of disclosure. The 78-day window is the period of maximum attacker advantage against a target that has documentation proving it takes patch management seriously.
Penetration test scopes that exclude the attack surface attackers use
Texas DIR AT-1 requires periodic penetration testing. The standard does not specify scope or methodology. In Vulnox assessments where we reviewed prior penetration test reports, the scope was consistently defined as 'internal network' or 'external perimeter,' with an asset list provided by the organization. IoT devices -- building management systems, access control panels, environmental monitors, networked printers, HVAC controllers -- were excluded from the scope in every case, either because they were not included in the asset list or because the test was scoped to exclude non-server infrastructure. These devices run embedded operating systems with long vulnerability windows, expose management interfaces on the network, and are frequently located on the same network segment as servers.
A penetration test that excludes IoT management interfaces is a test that excludes the attack surface that generates the most initial access findings in Vulnox assessments. The organization has a compliant penetration testing cadence. The compliance evidence does not capture whether the test scope was meaningful. AT-1 is satisfied by the existence of the test report. The security gap is in the scope.
Incident evidence that exists in the wrong format for regulatory response
Post-breach, Texas DIR regulators request incident timelines in structured formats -- CSV or Excel -- with precise timestamps, affected system hostnames, user account identifiers, data elements accessed, and a chronological reconstruction of attacker actions. In Vulnox assessments following incidents at DIR-covered organizations, the evidence that existed was in PDF reports, email threads, and ticket notes. The structured timeline did not exist because no logging architecture had been designed to produce it. Reconstructing it from available log sources took between 60 and 90 days of analyst time.
The 60-to-90-day reconstruction period delays regulatory response, extends the period of regulatory scrutiny, and produces a timeline that is acknowledged as reconstructed rather than contemporaneous. Regulators treat reconstructed timelines differently from real-time logs. The evidence quality question compounds the original incident. The fix is a logging architecture decision made before the incident, not after it.
The organizations that invest most in application hardening are sometimes the most exposed
Common belief
Organizations that have invested heavily in application security -- WAFs, code scanning, dependency updates, secure development training -- feel protected. The application layer is where the investment went, so the application layer is where the protection is. Network-level controls feel like a lower priority because the applications are hardened.
What we found
In the ransomware incident described above, the affected county had implemented MFA, endpoint detection, and documented patch management. The ransomware propagated via the compromised domain admin service account, which had network-level access to all servers because no segmentation policy restricted service account lateral movement. Every security investment the county had made was bypassed by a flat network and a GPO that had never been cleaned up. The segmentation that would have contained the incident to a single network segment had been deferred because the application security project was the current priority.
Application hardening is valuable and genuinely reduces attack surface. It does not change the blast radius of a compromised endpoint if the network is flat. An attacker who gains initial access through a phishing email, a compromised vendor credential, or an unpatched IoT device on the network does not need to attack the hardened application directly. They need to reach it from the compromised endpoint. On a flat network with no segmentation, that path is open. The application hardening that took a year of engineering effort is bypassed by a single pivot from any other system on the same network segment. Segmentation is not an alternative to application hardening -- it is the control that makes application hardening matter. Without it, application security reduces the probability of direct exploitation. It does not reduce the consequence of any other exploitation path.
What DIR-covered organizations believe before the gap assessment
'We passed our last audit. Everything was green. We should be fine for the next cycle.'
Root cause:Passing a DIR audit confirms that documentation exists, that sampled controls appear to function, and that the auditor's scope did not surface obvious failures. It does not confirm that the actual configuration matches the documented policy, that controls function under real attack conditions rather than audit conditions, or that the scope of the audit covered the attack surface attackers will use. Green audit results are evidence that the audit process ran. They are not evidence that the environment is secure. The distinction is not semantic -- in the case documented above, it was the difference between a passed audit and a ransomware incident separated by two weeks.
'We have Qualys deployed across the environment. Vulnerability management is covered.'
Root cause:Qualys is a vulnerability discovery tool. It identifies and reports vulnerabilities. It does not patch them, create tickets for them, assign ownership, track remediation, or verify that patches were successfully applied. An organization with Qualys deployed and no process connecting scan results to remediation actions has vulnerability discovery, not vulnerability management. The DIR standard requires the management, not just the discovery. The distinction is operationally significant: 78 days of unpatched exposure in an environment with Qualys deployed and no remediation workflow is the documented consequence.
'Our penetration test came back with only minor findings. We must be in good shape.'
Root cause:The quality of a penetration test result depends entirely on the scope. A test scoped to the external perimeter and a defined set of internal servers will find vulnerabilities within that scope. It will not find the IoT device on the building management VLAN running a three-year-old firmware version with a publicly available remote code execution exploit. It will not find the GPO that disables SMB signing. It will not test whether a compromised workstation can reach the domain controller directly. Minor findings from a penetration test indicate that the defined scope was in reasonable shape. They indicate nothing about the systems that were outside the scope.
Where DIR compliance pressure develops as the standards evolve
Texas DIR will add explicit IoT and OT device coverage to Control Standards 2.0 within 24 months, driven by at least one significant incident at a DIR-covered organization where initial access was achieved through a networked building management or physical access control system.
The IoT gap in AT-1 penetration testing scope is documented, consistent, and publicly known in the security assessment community. The DIR standards' silence on IoT methodology means organizations self-define scope in ways that exclude the most vulnerable infrastructure. State-level incidents traced to IoT initial access have occurred in other jurisdictions and will occur in Texas. The regulatory response to a significant incident will include scope expansion for penetration testing requirements. The absence of explicit guidance creates the conditions for the incident that will produce it.
Confidence: highA published Texas DIR Control Standards update adding explicit IoT device coverage to assessment scope requirements, or an official DIR advisory following a documented incident tracing to IoT initial access, before May 2028.Within two years, the most common finding in Texas DIR post-incident regulatory inquiries will be the absence of pre-built structured incident timelines, and at least one DIR-covered organization will receive an enforcement action citing inadequate incident evidence preservation rather than the underlying breach itself.
The pattern of organizations spending 60 to 90 days reconstructing incident timelines post-breach is consistent. Regulators who have experienced this delay repeatedly will eventually treat evidence preparation as a compliance obligation in its own right, separate from the incident. The legal standard for 'reasonable' incident response includes the ability to produce contemporaneous records. An organization that cannot do so because it never built the logging infrastructure to support it has a defensible inadequacy that enforcement can target without resolving the technical questions about the breach itself.
Confidence: mediumA published Texas DIR enforcement action or formal finding against a covered organization citing inadequate incident evidence preservation as a primary compliance failure, before May 2028.
The audit methodology is the problem, not the auditors
This is a stated opinion. Texas DIR audits produce the results they are designed to produce: confirmation that documented controls exist. They are not designed to verify that the documented controls match the actual configuration, and they cannot do so within a standard audit timeline and fee structure. A thorough Active Directory hygiene review for a mid-size county government takes two to three days of technical work. A DIR audit covering the full control set takes two days for the entire engagement. The math does not allow for configuration-level inspection across all control areas. The result is that DIR audits are structurally optimized to find documentation gaps, which are the least important category of compliance failure. Configuration gaps -- the GPOs, the disabled defaults, the protocol re-enablements that never got reversed -- are invisible to document review and are precisely what attackers find. This is not a criticism of individual auditors. It is a criticism of an audit methodology that treats policy existence as evidence of policy implementation.
Counterargument
The strongest counterargument is that a compliance audit is not designed to be a penetration test, that DIR sets minimum standards rather than aspirational ones, and that organizations seeking security guarantees beyond what audits provide should be conducting their own continuous assessments. That argument is correct as a description of what DIR audits are. It does not address the problem that organizations treat passing a DIR audit as a security guarantee -- and DIR's framing of the audit as a compliance verification mechanism contributes to that misunderstanding. The county IT director who told us everything was green was not describing fraudulent results. They were describing accurate results from a process that does not measure what they needed measured.
One technical check that the audit did not run
Before the next audit cycle, pull the complete GPO list from your domain controller and filter for GPOs that modify any of the following settings: SMB signing requirements, NTLM authentication policies, Windows Defender exclusions, and security agent telemetry settings. For each GPO that touches these areas, trace its origin -- when it was created, what it was created for, and whether that original need still exists. GPOs created for temporary compatibility requirements that were resolved years ago and never reversed are the single most consistent finding in Vulnox assessments of DIR-covered environments. They are not in the audit scope. They are in the attack path.
Further Reading
Gap Analysis
framework gap analysisDigital Footprint
digital footprint analysisNIST Cybersecurity Framework 2.0
NIST Cybersecurity FrameworkNIST Vulnerability Assessment Definition
NIST vulnerability assessment definitionUnderstanding Compliance Gap Analysis
compliance gap analysis guide
Frequently Asked Questions
What does a Texas DIR Control Standards compliance audit actually check?
Texas DIR audits verify that documented security controls exist and that sampled implementations appear to function as documented. Auditors review access control policies, confirm MFA enrollment on sampled accounts, verify patch management tools are deployed, and confirm incident response plans are current. They do not typically inspect Group Policy Object configurations, validate that patch management tools are connected to remediation workflows, or assess penetration testing scope adequacy. The audit confirms documentation quality, not configuration reality.
Why do Texas DIR-compliant environments still get ransomware?
The most consistent factor in post-incident assessments of DIR-compliant environments is a GPO configuration that contradicts the documented security policy. GPOs that disable SMB signing, grant excessive service account privileges, or suppress endpoint detection agent telemetry are invisible to policy-level audit review. They are the first thing an attacker with any domain foothold will exploit. Passing a DIR audit confirms that access control policies are documented. It does not confirm that the GPO configuration enforces those policies.
What format does Texas DIR require for incident evidence after a breach?
Post-breach, Texas DIR regulators request incident timelines in structured formats -- CSV or Excel -- with precise timestamps, affected system identifiers, user account names, data elements accessed, and a chronological reconstruction of attacker movement. Organizations that have not pre-built logging architecture to produce this format spend 60 to 90 days reconstructing it from PDF reports and email threads. Regulators treat reconstructed timelines differently from contemporaneous logs. The logging architecture decision needs to be made before the incident.
What does Texas DIR AT-1 require for penetration testing?
Texas DIR Control Standard AT-1 requires periodic penetration testing but does not specify scope or methodology. Organizations satisfy this requirement with assessments whose scope is self-defined. In Vulnox assessments, IoT devices -- building management systems, access control panels, networked printers, environmental monitors -- are excluded from penetration test scope in the majority of cases. These devices are the most common initial access vector in Texas DIR environment assessments. The standard is satisfied. The attack surface is untested.
How does network segmentation interact with Texas DIR compliance?
Texas DIR Control Standards address network segmentation under access control requirements, but the standard does not prescribe a specific segmentation architecture. The operational consequence of absent segmentation is that application-level hardening investments are bypassed by any attacker who achieves initial access through any other vector. An attacker on a flat network can pivot from a compromised workstation to domain controllers, database servers, and backup infrastructure without crossing any access control boundary. Segmentation is the control that limits blast radius. Application hardening reduces the probability of direct exploitation. Both are necessary, and segmentation should be implemented before application hardening for this reason.
What is the most common misconfiguration in Texas DIR assessments?
SMBv1 active on Windows Server environments that passed DIR audits is the most consistent finding in Vulnox Texas DIR assessments. SMBv1 is disabled by default in Windows Server 2016 and later, but was present in 32% of DIR client environments assessed in 2024. In every case it had been re-enabled for a legacy compatibility requirement that had since been resolved. The audits had not checked protocol-level configuration. The remediation is a single PowerShell command. The detection requires inspecting the actual configuration rather than the documented policy.
Does deploying Qualys satisfy Texas DIR patch management requirements?
No. Texas DIR patch management requirements cover the full vulnerability management lifecycle: discovery, prioritization, remediation, and verification. Qualys automates discovery and reporting. It does not create remediation tickets, assign ownership, apply patches, or verify that patches were successfully deployed. An organization with Qualys deployed and no process connecting scan results to remediation actions has automated vulnerability discovery and manual -- or absent -- vulnerability management. The average gap between vulnerability disclosure and detection in Vulnox assessments of environments with this configuration is 78 days.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.