simpl.
로그인
사이버보안 GRC 14개 항목

External Attack Surface Management (EASM) Review

이 체크리스트는 영어로 제공됩니다.

Reviews an external attack surface management program covering continuous discovery, exposure identification, prioritization, and remediation of internet-facing assets.

NIST 800-53CISCISA

무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.

Discovery

  • Is the internet-facing asset inventory discovered continuously rather than periodically? *
  • Are unknown and shadow-IT assets (forgotten domains, cloud instances) identified? *
  • Are subsidiary, acquisition, and third-party-hosted assets included in scope?
  • Is asset ownership attributed so findings can be routed to the right team? *

Exposure Identification

  • Are exposed services, open ports, and admin interfaces identified? *
  • Are expired/misconfigured certificates and weak TLS detected? *
  • Are known vulnerabilities on exposed assets correlated (e.g., CISA KEV)? *
  • Are leaked credentials and exposed secrets monitored across external sources?

Prioritization

  • Are findings risk-prioritized by exploitability and business criticality? *
  • Are actively exploited exposures escalated for urgent remediation? *
  • Is attack surface size trended over time as a program metric?

Remediation

  • Are findings routed to owners with remediation SLAs? *
  • Is there a process to decommission unnecessary internet-facing exposure? *
  • Are EASM findings integrated with the vulnerability management and ticketing workflow?

External Attack Surface Management (EASM) Review 체크리스트 전체 다운로드

인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.