사이버보안 GRC 15개 항목
Endpoint Detection & Response (EDR) Program Review
이 체크리스트는 영어로 제공됩니다.
Reviews endpoint protection coverage, detection efficacy, and response capabilities of the EDR/XDR deployment across managed devices.
CIS v8NIST 800-53MITRE ATT&CK
무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.
Coverage & Deployment
- Is an EDR agent deployed on all servers, workstations, and laptops? *
- What percentage of the endpoint inventory has a healthy, reporting EDR agent?
- Are alerts generated for endpoints missing or with disabled EDR agents? *
- Is anti-malware signature and engine content updated automatically? *
Detection Capability
- Does the EDR provide behavioral and heuristic detection beyond signatures? *
- Are detections mapped to MITRE ATT&CK techniques?
- Is detection efficacy validated with atomic tests or purple-team exercises? *
- Are exclusions reviewed and approved to prevent detection blind spots? *
Response & Containment
- Can analysts remotely isolate a compromised endpoint from the console? *
- Are automated response playbooks configured for high-fidelity detections?
- Is endpoint telemetry retained long enough to support investigations? *
- Is the EDR integrated with the SIEM or SOAR for correlation? *
Monitoring & Threat Hunting
- Is the EDR console monitored 24x7 by internal staff or an MDR provider? *
- Are proactive threat hunts conducted using EDR telemetry?
- Are mean time to detect and respond metrics tracked and reviewed? *
Endpoint Detection & Response (EDR) Program Review 체크리스트 전체 다운로드
인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.