Assessment Item Identifier Design

Every checklist item assessed by CYC Assess carries three distinct identifiers. Each serves a different audience and purpose. This three-layer design ensures customer-facing stability, internal traceability, and alignment with the upstream Microsoft Azure Review Checklists (ARC) framework.

The Three-ID Model

ID Type	Example	Owned by	Customer visible	Purpose
CYC ID	CYC-ALZ-NET-H-001	CYC	Yes — report, tables, support	Stable customer reference. Used in reports, executive summaries, support conversations, and drift tracking across assessment cycles.
ARC Short ID	B03.02 / 01.01.03	Microsoft	No — internal only	Human-readable debug reference. Maps to a section and item number in the Microsoft ARC checklist. Not present for all checklists (SAP items have no ARC short ID).
GUID	984a859c-773e-...	Microsoft	No — internal only	Machine-readable primary key. Used for graph query result matching. Present on all 805 items.

Important

The GUID is the authoritative machine key. Three ALZ items have duplicate ARC short IDs — confirming the GUID must be used for all programmatic operations.

CYC ID Format

CYC-{CHECKLIST}-{AREA}-{SEVERITY}-{SEQUENCE}

Segment	Values	Example
CYC	Always CYC	CYC
CHECKLIST	ALZ, AKS, AVD, SAP, CST, ADN, MLT	ALZ
AREA	See area code table below	NET
SEVERITY	H (High), M (Medium), L (Low)	H
SEQUENCE	Zero-padded 3-digit fixed sequence	001

Examples:

• CYC-ALZ-NET-H-001 → ALZ checklist, Networking, High severity, item 1
• CYC-AKS-OPS-M-012 → AKS checklist, Operations, Medium severity, item 12
• CYC-SAP-BCR-H-002 → SAP checklist, BC and DR, High severity, item 2

Checklist Codes and ID Ranges

Checklist	Code	Items	ID range
Azure Landing Zone	ALZ	255	CYC-ALZ-BIL-H-001 → CYC-ALZ-SEC-L-002
AKS	AKS	112	CYC-AKS-APP-M-001 → CYC-AKS-OPS-L-018
AVD	AVD	130	CYC-AVD-BCR-H-001 → CYC-AVD-STG-L-002
SAP	SAP	150	CYC-SAP-DEV-M-001 → CYC-SAP-SEC-L-005
Cost Optimization	CST	86	CYC-CST-CST-M-001 → CYC-CST-CST-M-086
App Delivery Networking	ADN	40	CYC-ADN-NET-H-001 → CYC-ADN-NET-L-004
Multitenancy	MLT	32	CYC-MLT-BIZ-H-001 → CYC-MLT-SEC-M-002
Total	—	805	—

Area Codes

Code	Full design area name
APP	Application Deployment (AKS)
BCR	Business Continuity and Disaster Recovery / BC and DR
BIL	Azure Billing and Microsoft Entra ID Tenants
BIZ	Business (Multitenancy)
CMP	Compute (AVD)
CST	Cost Governance / Cost Optimization
DEV	Platform Automation and DevOps / Automation
FND	Foundation (AVD)
GOV	Governance
IAM	Identity and Access Management / Identity
MGT	Management / Monitoring and Management
NET	Network Topology and Connectivity / Networking
OPS	Operations / Operational Excellence
PER	Performance Efficiency / Performant
RES	Resource Organization / Management Group and Subscriptions
SEC	Security / Security, Governance and Compliance
STG	Storage (AVD)

Internal Reference Format

The internal_ref field in the Assessment Engine findings JSON contains all three identifier components. This field is never rendered in any customer-facing output.

{
  "cyc_id": "CYC-ALZ-NET-H-001",
  "internal_ref": {
    "checklist": "ALZ",
    "arc_id":    "B03.02",
    "guid":      "984a859c-773e-47d2-9162-3a765a917e1f"
  }
}

arc_id is null for SAP items and any item without an ARC short ID.

ID Stability Contract

CYC IDs are stable across assessment versions. The sequence number is fixed at initial product setup.

Event	Action
Microsoft updates item text or metadata	GUID unchanged → no action required
Microsoft changes a GUID	Update internal_ref.guid in mapping table. Validate B1 graph query matching. CYC ID unchanged.
Microsoft adds a new item	Assign new CYC ID at end of relevant bucket. Never reorder existing IDs.
Microsoft removes an item	Mark CYC ID as deprecated in mapping table. Do not reassign sequence number. Deprecated items excluded from new assessments, retained in historical findings for drift.
CYC-proprietary items (future)	CYC ID assigned normally. arc_id and guid both null.

Source of truth

The cyc_id_mapping.json file generated during product setup is the authoritative mapping table. It must be stored in the CYC database as a static lookup and versioned with each checklist update cycle.