ScubaGear: Automation to assess the state of your M365 tenant against CISA's baselines , CISA (GitHub, cisagov)
Thanks for explaining that verification is often required before withdrawal. That clarifies a lot.