Overview
ZPA platform health check. Technical audit and advisory deliverable, written as a small-enterprise baseline.
Purpose: validate ZPA configuration, access enforcement, application connectivity, resilience, and monitoring against relevant Zscaler guidance. This is a practical configuration health check, not a HIPAA, PCI, or financial compliance audit.
Scope: Zscaler Private Access (ZPA).
Assessment at a glance
- Stage 1, technical audit: review settings, capture evidence, and conduct representative tests across six workstreams.
- Stage 2, advisory deliverable: summarize findings, rank remediation, assign owners, and document retest results.
- Suggested review sample: 1 recruiter, 1 HR user, 1 manager, 1 IT admin, 1 newly disabled account, 1 managed endpoint, and 1 noncompliant endpoint, where safe and applicable.
- Ratings: Pass, Partial, Fail, N/A, Not Reviewed. Priorities: High (a material access or control weakness), Medium (an operational or scoped issue).
Scope and applicability
Stage 1 compares each expected condition with the live tenant, verifies one or more representative scenarios, and records evidence in the companion Excel workbook. A design recommendation is not evidence of actual enforcement.
Stage 2 is completed after the technical audit. Keep the management readout to one page, supported by the detailed finding tracker in Excel.
Use the tenant features and subscriptions that are actually deployed. Mark an optional component that is absent as N/A. SCIM and LSS are conditional on licensing and design. MFA enforcement may be implemented in the IdP, not directly in the ZPA rule.
Principles
- A design recommendation is not evidence of actual enforcement.
- Ratings are Pass, Partial, Fail, N/A, and Not Reviewed.
- High means a material access or control weakness. Medium means an operational or scoped issue.
- Least privilege applies to private-application access and to admin RBAC.
- Do not deliberately disable production connectors or block active users without an approved change window.
- Do not treat an optional component that is not deployed as a failure. Mark it N/A.
Recommended configuration
For each row, compare the expected condition with the live tenant, verify one or more representative scenarios, and record the evidence.
Policy hierarchy and micro-segmentation
| ID | Priority | Audit check and target state | What to verify / evidence |
|---|---|---|---|
| IDP01 | PriorityHigh | Audit check and target stateAccess policy evaluation. Review rule order and overlapping allow and block rules. Confirm the intended rule wins. | What to verify / evidencePolicy export and sample effective-access tests |
| IDP02 | PriorityHigh | Audit check and target stateLeast-privilege group access. Recruiters, HR, IT, and managers get access only to necessary private applications. | What to verify / evidenceAccess matrix versus role memberships |
| IDP03 | PriorityHigh | Audit check and target stateNo catch-all broad allow. Review Any User / Any Application or other broad allow rules. An exception must have a documented business need. | What to verify / evidencePolicy rule screenshot, exception owner |
| IDP04 | PriorityMedium | Audit check and target stateTight application definitions. Application segments use specific FQDNs or IPs and the necessary TCP or UDP ports. Identify overlaps. | What to verify / evidenceApplication segment inventory |
| IDP05 | PriorityMedium | Audit check and target stateApplication ownership and cleanup. Each private app has an owner. Remove unused applications and rules. | What to verify / evidenceApp inventory and last-use evidence |
SAML / SCIM identity
| ID | Priority | Audit check and target state | What to verify / evidence |
|---|---|---|---|
| IDI01 | PriorityHigh | Audit check and target stateIdP SSO authentication. ZPA uses the approved corporate SAML IdP and the expected login flow. | What to verify / evidenceIdP configuration and sign-in test |
| IDI02 | PriorityHigh | Audit check and target stateMFA enforcement. MFA or conditional access is enforced for ZPA entry and for sensitive applications where appropriate. | What to verify / evidenceIdP conditional access and test evidence |
| IDI03 | PriorityHigh | Audit check and target stateTimely deprovisioning. Disabled or terminated users lose access promptly. Confirm the group sync or provisioning flow. | What to verify / evidenceOffboarding sample, IdP status, and ZPA user status |
| IDI04 | PriorityMedium | Audit check and target stateGroup attributes and sync. SAML or SCIM attributes map to the correct business groups. Stale or duplicate mappings are reviewed. | What to verify / evidenceIdP group mapping and SCIM status, if SCIM is used |
Traffic forwarding and Client Connector
| ID | Priority | Audit check and target state | What to verify / evidence |
|---|---|---|---|
| IDC01 | PriorityHigh | Audit check and target stateZPA enabled on managed devices. In-scope endpoints run a supported Zscaler Client Connector and the correct ZPA profile. | What to verify / evidenceClient Connector portal sample by department |
| IDC02 | PriorityHigh | Audit check and target stateTraffic forwarding actually works. Private-app DNS and traffic resolve and forward over the intended ZPA path. Test office and home. | What to verify / evidenceEndpoint diagnostics, synthetic connection tests |
| IDC03 | PriorityHigh | Audit check and target stateDevice posture for sensitive apps. Managed device, endpoint protection, or certificate posture is used where the risk warrants it. | What to verify / evidencePosture policy and allowed or blocked test devices |
| IDC04 | PriorityMedium | Audit check and target stateProfile assignment and bypasses. Review profile precedence, forwarding exclusions, and bypasses. Justify exceptions. | What to verify / evidenceProfile assignments and exception list |
| IDC05 | PriorityMedium | Audit check and target stateClient version and rollout. Supported connector build, a controlled pilot, an upgrade cadence, and a rollback method. | What to verify / evidenceVersion distribution and upgrade policy |
App Connectors and availability
| ID | Priority | Audit check and target state | What to verify / evidence |
|---|---|---|---|
| IDA01 | PriorityHigh | Audit check and target stateConnector health and redundancy. Multiple healthy App Connectors per production group. Avoid a single-connector dependency. | What to verify / evidenceConnector-group membership and health history |
| IDA02 | PriorityHigh | Audit check and target stateReachability and placement. Connectors can resolve and reach only the intended application destinations, over an adequate network path. | What to verify / evidenceServer group mapping, DNS, and port reachability |
| IDA03 | PriorityMedium | Audit check and target stateConnector lifecycle. OS or VM updated, supportable versions, sizing and capacity reviewed. | What to verify / evidenceHost inventory, maintenance schedule |
| IDA04 | PriorityMedium | Audit check and target stateResilience test. Validate failover with one connector unavailable during controlled maintenance. | What to verify / evidenceChange or test record and result |
LSS / SIEM and monitoring
| ID | Priority | Audit check and target state | What to verify / evidence |
|---|---|---|---|
| IDL01 | PriorityHigh | Audit check and target stateZPA access logs retained. Access and policy-deny activity is visible, with retention that fits operational needs. | What to verify / evidenceLog search and retention setting |
| IDL02 | PriorityMedium | Audit check and target stateLSS / SIEM integration, if deployed. The log receiver forwards the expected log types reliably. Verify that sample events arrive. | What to verify / evidenceLSS status, sample SIEM event |
| IDL03 | PriorityMedium | Audit check and target stateActionable alerts. Alert for connector outage, authentication failures, unexpected denies, or log interruptions. | What to verify / evidenceAlert definitions and a test notification |
Administration and operations
| ID | Priority | Audit check and target state | What to verify / evidence |
|---|---|---|---|
| IDG01 | PriorityHigh | Audit check and target stateAdmin access security. Admin RBAC is least privilege. MFA is enforced through the admin identity flow. | What to verify / evidenceAdmin roles, access review, sign-in policy |
| IDG02 | PriorityMedium | Audit check and target stateChange and incident procedures. Document ownership, standard changes, the break-glass and contact path, and rollback. | What to verify / evidenceRunbook and a recent change ticket |
| IDG03 | PriorityMedium | Audit check and target statePeriodic review. Review access, connectors, profile versions, and stale apps at least quarterly. | What to verify / evidenceReview owner, review date, and action items |
Executive summary template
Complete this after the technical audit. Keep the management readout to one page.
- Assessment date / reviewer: blank until the review is done
- Environment status: Healthy, Needs Improvement, or High Risk
- Controls: Pass / Partial / Fail / N/A / Not Reviewed, with the counts left blank
- Top three observations: left blank
- Overall recommendation and owners: left blank
Findings and remediation template
| Finding ID | Risk | Finding / evidence | Action / owner | Target / retest |
|---|---|---|---|---|
| Finding ID | Risk | Finding / evidence | Action / owner | Target / retest |
| Finding ID | Risk | Finding / evidence | Action / owner | Target / retest |
| Finding ID | Risk | Finding / evidence | Action / owner | Target / retest |
| Finding ID | Risk | Finding / evidence | Action / owner | Target / retest |
Validation checklist
Example acceptance tests
- A recruiter account can reach the approved recruiter applications, and cannot reach IT admin tools.
- An offboarded identity cannot establish a fresh permitted private-application session. Test carefully.
- A noncompliant or unmanaged test device is denied for applications that require device posture.
- During a planned App Connector outage, production application access remains available through an alternate connector.
- Access-deny and connector-health events can be found in ZPA, and in the SIEM if LSS is configured.
Suggested review sample, where safe and applicable: 1 recruiter, 1 HR user, 1 manager, 1 IT admin, 1 newly disabled account, 1 managed endpoint, and 1 noncompliant endpoint.
Common pitfalls
- Treating a design recommendation as evidence that the control is enforced.
- Disabling production connectors, or blocking active users, without an approved change window.
- Expecting MFA to be configured inside the ZPA rule when it is enforced in the IdP.
- Marking SCIM or LSS as a failure when licensing or the design does not include them. They are conditional.
- Following a click-path from a different ZPA UI version. Portal navigation differs by UI version.
- Counting an optional component that is not deployed as a failed control. Mark it N/A.
- Testing an offboarded identity without care. The acceptance test says to test that case carefully.