7 Most Common LADMF
Assessment Findings
Table of Contents
ToggleRanked Residual Findings from Lazarus Alliance NTIS ACAB Assessments
Based on N = 18 completed assessments • January 2025 – June 2026
Across N = 18 assessments, 67% (12 of 18; 95% CI 44–84%) had at least one residual finding. When findings were present, the median was 2. Frequencies below use 95% Wilson score intervals (assessments may appear in more than one category):
| Rank | Area | Count | % of N = 18 | 95% CI |
|---|---|---|---|---|
| 1 | Restricted access / need-to-know | 8 | 44% | 25–66% |
| 2 | Secure storage / encryption | 7 | 39% | 20–61% |
| 3 | Disposal of LADMF information | 6 | 33% | 16–56% |
| 4 | Audit logging of DMF access | 5 | 28% | 12–51% |
| 5 | 5-year record-keeping | 5 | 28% | 12–51% |
| 6 | Personnel authorization / training | 4 | 22% | 9–45% |
| 7 | Unauthorized disclosure / incident procedures | 3 | 17% | 6–39% |
Most common LADMF finding: Restricted access / need-to-know — 44% (8 of 18).
Finding Frequency (N = 18)
Restricted access / need-to-know (44%)
DMF access not limited to authorized users; joiner/leaver evidence incomplete. Enterprise SSO is not sufficient without DMF-specific authorization.
Secure storage / encryption (39%)
Storage controls incomplete for all DMF copies, including extracts and derived files.
Disposal of LADMF information (33%)
Sanitization or destruction of DMF extracts not fully documented. Deletion without records does not satisfy Publication 100.
Audit logging of DMF access (28%)
Access to DMF not logged, or logs not reviewed on a defined cadence.
5-year record-keeping (28%)
Request, storage, and use records incomplete or below the required 5-year retention.
Personnel authorization / training (22%)
Authorized-user lists stale; awareness of permitted DMF-use restrictions weak.
Unauthorized disclosure / incident procedures (17%)
DMF-specific incident and notification procedures missing or generic.
Related Metrics (N = 18)
- First-time assessments were 56% more likely to have ≥1 finding than renewals (86% vs 55%)
- Median formal assessment: 16 business days
Full context: 2026 LADMF Certification Benchmark Report.
Peters, M. D. (2026). 7 Most Common LADMF Assessment Findings. Lazarus Alliance, Inc.
© 2026 Lazarus Alliance, Inc. NTIS-approved ACAB.
Data Source
This analysis is based on the 2026 LADMF Assessment Benchmark Report, Lazarus Alliance's aggregate analysis of 18 completed formal LADMF 3PAO assessments conducted between January 2025 and June 2026.
Additional Analysis
Talk with one of our experts
Our Lazarus Alliance Cybervisor™ teams have experience performing thousands of assessments for organizations providing services to clients around the world.
We're here to answer any questions you may have.