Subcontrol 14.6 about cis-controls-71-measures

[wmunyan]

Inputs:

• Access control configuration policy
• List of endpoints

Operations:

• Collect the "ground truth" access policy from each endpoint

Measures:

• M1 = number of endpoints with policy violations
• M2 = number of endpoints

Metrics:

• M1 > 0 is a fail for any given endpoint.
• M1/M2 = percentage of endpoints with policy violations

[apiperCIS]

Inputs

1. Endpoint inventory
2. Access control configuration policy

Operations

1. For each endpoint in Input 1, collect the "ground truth" access policy for that endpoint and compare it to the access control configuration policy in Input 2. Generate a list of endpoints which comply with the specified access control configuration policy (M1) and a list of endpoints that do not comply with the specified policy (M2)

Measures
M1 = List of endpoints that comply with access control configuration policy (compliant list)
M2 = List of endpoints that do not comply with access control configuration policy (non-compliant list)
M3 = Number of endpoints in M1 (number of compliant endpoints)
M4 = Number of endpoints in M2 (number of non-compliant endpoints)
M5 = Number of endpoints in Input 1 (total number of endpoints to check)

Metrics
Coverage: M3 / M5