An emergency-management Windows image includes Controlled Folder Access. What should a purple team plan first for authorized validation of that surface?

Controlled Folder Access (CFA) is a specific Microsoft Defender feature surface that restricts untrusted apps from modifying protected folders. For an emergency-management Windows image, a purple team should first identify CFA as that named surface and design scoped lab tests under written rules of engagement. The plan maps which processes, folders, and expected outcomes belong in the validation, keeps production emergency workstations intact during preparation, and produces evidence about whether CFA behaves as configured—without turning the exercise into uncontrolled destruction.

Removing CFA from every production emergency workstation before testing destroys the control under review and increases real risk to life-safety systems. Treating CFA as irrelevant because 'only firewalls matter' ignores host ransomware and unauthorized-modification defenses that CFA specifically addresses. Asking AI to generate production ransomware to 'prove' failure is unethical, out of scope for civic ROE, and unnecessary when benign or approved lab samples can exercise the same allow/block decisions.

Exam caveat: authorized validation planning starts with identifying the feature surface and scoping lab tests under ROE—not disabling the control in production, dismissing it, or generating real ransomware against live emergency images.

Operational check: inventory CFA status and protected folders on a representative emergency-ops lab image, write ROE that lists allowed test artifacts and success criteria, execute only on isolated lab endpoints, and capture Defender events showing allow versus block. Feed results into hardening recommendations for the municipal emergency Windows baseline.