Subcontrol 7.1 about cis-controls-71-measures

[wmunyan]

Organizations could inventory for unallowed software, but that falls under a different control (2.1, 2.2, 2.6). Metrics for sub-control 3.5 should also measure that software's patch levels.

[apiperCIS]

For Controls team: We need to decide if the 'ideally' piece of this sub-control is a requirement or just a bonus. If it is a requirement, suggest that we rephrase to make that clear.

For Controls team: As mentioned in Bill's comment above, there is actually a lot of overlap between 7.1 and Control 2 sub-controls. We need to think about what this sub-control is mandating that the other sub-controls don't already. Breaking it down, I'm not sure that there is anything here that isn't already covered by other sub-controls...

[wmunyan]

Confirmed in 6/12 meeting that this sub-control metric is basically a combination of 2.2 and 2.6.