adammontville
commented
5 years ago NOTE: For now, I'm avoiding the "continuously monitor" language. What does that really mean? In practice, it can mean periodic monitoring rather than "all the time" monitoring.
Assumption:
- It is assumed that this sub-control is specific to host-based anti-malware solutions.
Inputs:
- List of deployed anti-malware software
- Endpoint inventory
Operations:
- For each deployed anti-malware solution, verify that it is centrally managed
- For each deployed anti-malware solution, enumerate the set of endpoints covered
- Union the set of covered endpoints
- Identify set of endpoints eligible for anti-malware coverage (i.e. network devices likely do not run anti-malware agents)
Measures:
- M1 - Base count of anti-malware solutions in use
- M2 - Count of anti-malware solutions that are centrally managed
- M3 - Total number of endpoints covered by anti-malware solutions
- M4 - Total number of endpoints eligible for anti-malware coverage
Metrics:
- M2 / M1 - Percentage of anti-malware solutions that are centrally managed
- M3 / M4 - Percentage of endpoints covered by anti-malware solutions
Utilize centrally managed antimalware software to continuously monitor and defend each of the organization's workstations and servers.
Measures
Metrics