Measure, Share, Compare.

This scorecard assesses how well the organization adheres to access control policies relating to account provisioning and deprovisioning. This assessment uncovers areas in need of improvement in the account provisioning and deprovisioning process and in organizational guidelines.

This scorecard examines the volume and severity of alerts triggered by sensors from a Network Intrusion Prevention System (NIPS) or Network Intrusion Detection System (NIDS). The top 5 most active sensors are also displayed. This information allows the organization to assess the threats identified by the NIPS system and determine if changes to the NIPS or Firewall configuration are required.

The Asset Risk Assessment scorecard examines risk exposure. This scorecard focuses on the following indicators for high-value assets: percentage by secure location, percentage of technical vulnerabilities, and the overall risk score.

The Business Continuity Planning scorecard examines the effectiveness of the organization's continuity plan. This scorecard evaluates the number of high value assets within the organization, the percentage covered by the business continuity plan, the number of unplanned outages, and the total downtime.

This scorecard examines the management of data in use. It examines the location of data and authorization of users to copy data. This information demonstrates the organization's awareness of sensitive data and confirms the emplacement of controls to ensure that data cannot be inadvertently copied to unauthorized devices.

This scorecard examines the firewall coverage of assets and networks. It also displays the volume of inbound and outbound denied traffic. This information allows the organization to determine the effectiveness of the firewall configuration and network deployment.

This scorecard reports on the distribution of vulnerabilities across hosts. It examines the percentage of hosts in which vulnerabilities were identified and lists the hosts with the highest vulnerability scores. Vulnerability scores are calculated by weighing the number of identified vulnerabilities by their impact rating. These metrics identify concentrations of risk among asset groups and track overall host vulnerability.

This scorecard examines the coverage of assets and networks under management by a Network Intrusion Detection System (NIDS) or a Network Intrusion Prevention System (NIPS). The volume of signatures updated within policy and statistics on the number of days since last update are also presented. This information allows the organization to assess its risk associated with assets and networks not covered by an Intrusion Detection System as well as its risk associated with lax signature updates.

This scorecard examines the management of data at rest. It examines the encryption coverage of devices and data retention rates. High percentages of devices exempt from encryption policy or devices not fully encrypted increase the organization's exposure to data leakage. Likewise, a long retention rate indicates that organizations need to ensure that policies, processes, and procedures safeguard data during the entire retention period.

This scorecard examines the management of data at rest. It examines the encryption coverage of devices and data retention rates. High percentages of devices exempt from encryption policy or devices not fully encrypted increase the organization's exposure to data leakage. Likewise, a long retention rate indicates that organizations need to ensure that policies, processes, and procedures safeguard data during the entire retention period.

This scorecard focuses on the following indicators: percentage of synchronized accounts, percentage of accounts with passwords, frequency that passwords are changed, percentage of weak passwords.

The Personnel Termination scorecard examines the organization's exposure resulting from the termination of personnel. This scorecard focuses on the following indicators: the number of terminated employees, the percentage of terminated employees who returned all organizational assets, and percentage of accounts belonging to terminated employees deprovisioned within policy.

This scoreard assesses how well the organization covers its assets with its Vulnerability and Patching systems.

The System Resiliency scorecard examines the resiliency of mission critical assets within the organization. This scorecard evaluates the success rate of backups and the effectiveness of failover and failback operations.

This scorecard examines the volume of virus events that were detected and successfully remediated by an automated anti-virus system. In contrast, the volume of virus events successfully remediated by manual processes is also shown. Information provided allows the organization to assess how effectitive it is at preventing virus outbreaks and to examine the efficiencies gained by improving automatic remediation through reducing DAT file update latency.