Measure, Share, Compare.

The Data at Rest scorecard examines the management of data at rest. This scorecard presents the encryption coverage of devices and data retention rates. High percentages of devices exempt from encryption policy or devices not fully encrypted increase the organization's exposure to data leakage. A long retention rate indicates the organization's need to ensure that policies, processes, and procedures safeguard data during the entire retention period.

The Patch Policy scorecard evaluates the efficiency of the automated patch management system. This scorecard examines the average time to patch and the percentage of hosts patched within policy. This scorecard also trends the percentage of patches successfully applied, and identifies risk exposure due to missing critical patches.

The Access Removal scorecard examines the efficiency of the account deprovisioning process. This scorecard presents Overall Process Time (from identification of the issue until closure) and Activity Time (support ticket duration). This information allows the organization to assess its incident response process in order to identify areas for improvement.

The Password Hygiene scorecard examines user adherence to the organization's password hygiene policies. The volume of perpetual passwords, their strength, and their age are analyzed in order to determine overall risk and exposure.

The Incident Response scorecard examines the efficiency of policies and procedures for security incident resolution. This scorecard presents the number of incidents closed within the Overall Process Time (identification of the issue until closure) and Activity Time (support ticket duration) policies. This information allows the organization to assess its incident response process and identify areas for improvement.

The Business Continuity Planning scorecard examines continuity plan coverage and the impact of interruptions. This scorecard presents the number of high value assets within the organization, the percentage covered by business continuity plan, the number of unplanned outages and the total downtime.

The Outage Incidents scorecard measures the frequency and duration of system outages, and examines how efficiently the organization recovers from outages. This scorecard presents the number of outages, the total downtime, the percentage of outages that were recovered from within policy, and the mean number of days between outages.

The Access Removal scorecard examines the efficiency of the account deprovisioning process. This scorecard presents Overall Process Time (from identification of the issue until closure) and Activity Time (support ticket duration). This information allows the organization to assess its incident response process in order to identify areas for improvement.

The Scan Configuration scorecard examines the frequency and coverage of vulnerability scanning. This scorecard presents the average time elapsed since the last scan and determines the number of hosts that were scanned within policy.

The Data at Rest scorecard examines the management of data at rest. This scorecard presents the encryption coverage of devices and data retention rates. High percentages of devices exempt from encryption policy or devices not fully encrypted increase the organization's exposure to data leakage. A long retention rate indicates the organization's need to ensure that policies, processes, and procedures safeguard data during the entire retention period.

The Data in Use scorecard examines the management of data in use. This scorecard presents the location of data and authorization of users to copy data. This information demonstrates the organization's awareness of sensitive data and confirms the deployment of controls to ensure that data cannot be inadvertently copied to unauthorized devices.

The Asset Portfolio Profile scorecard illustrates risk associated with assets managed by the organization. This scorecard identifies concentration of risk by examining the number and location of assets containing sensitive data.

The Physical Security of Assets scorecard examines the number, location, and user accessibility of critical assets under management. This scorecard addresses the requirement for assets to be located in a secure location with locks on doors and systems in place to limit access to these assets. In order to determine if assets reside in secure locations, it is critical to look at the number of assets under management by asset classification, then to see where the high value assets are located.

The Device Management scorecard examines the management of devices containing sensitive data. This scorecard demonstrates adherence to device decommission and removable media policies. This information allows the organization to determine if appropriate measures have been taken to safeguard devices that have a greater probability of being compromised. An organization can also use this scorecard to determine its exposure and forecast the likelihood of data breaches involving its devices.

The Logins scorecard counts attempts to access corporate information systems in order to identify unauthorized access attempts, identify accounts which may be candidates for removal, and ensure that current policies provide high availability.