THE COLLECTOR: This evidence job must fail loudly when it cannot collect. The flaw is marked. Pick the patch that actually delivers that.
collectors/okta_mfa_evidence.py 1 │ try: 2 │ users = paginate(okta, "/api/v1/users?filter=status eq \"ACTIVE\"") 3 │ for u in users: 4 │ factors = okta.get(f"/api/v1/users/{u['id']}/factors") 5 │ findings.append({"user": u["profile"]["email"], "mfa": len(factors) > 0}) 6 │ except Exception: 7 │ pass 8 │ json.dump({"control": "CC6.2", "status": "PASS", "checked": len(findings)}, open(out_path, "w"))
PATCH 1 · catch, log, carry on- except Exception:- pass+ except Exception as e:+ log.warning("collector error: %s", e)
PATCH 2 · fail the job, fail the artifact- except Exception:- pass+ except OktaAPIError as e:+ json.dump({"control": "CC6.2", "status": "COLLECTION_FAILED", "error": str(e)}, open(out_path, "w"))+ raise CollectorError(f"CC6.2 evidence incomplete: {e}")
PATCH 3 · retry until it works- except Exception:- pass+ except Exception:+ for attempt in range(3):+ time.sleep(2 ** attempt)+ continue # retry the collection
grc@ctrl-f:~$