BigFix

Removing Unnecessary Functionality (2.2.5)

Developing Configuration Standards for All System Components (2.2)

Compliance Scorecard performs and/or contracts with third parties to perform vulnerability scans & penetration tests at least annually. Issues, if any, are routed through incident and risk management processes for resolution.

ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established

RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging

System Monitoring - Are organization systems monitored for events or issues with an alerting or notification system?

Practice - Asset List - Provide a full asset list for practice owned computing devices and owned or leased network devices.

Remediation Documentation - Provide documentation of planned or on-going remediation from recent assessments. This may include Corrective Action Plans, remediation plans, or checklists that address identified vulnerabilities found in recent SRAs.

Encourages participation in threat intel sharing.