网络安全 GRC 14 项

External Attack Surface Management (EASM) Review

此检查清单为英文版。

Reviews an external attack surface management program covering continuous discovery, exposure identification, prioritization, and remediation of internet-facing assets.

NIST 800-53CISCISA

免费 PDF 或 Word · 输入邮箱即可下载。

Discovery

Is the internet-facing asset inventory discovered continuously rather than periodically? *
Are unknown and shadow-IT assets (forgotten domains, cloud instances) identified? *
Are subsidiary, acquisition, and third-party-hosted assets included in scope?
Is asset ownership attributed so findings can be routed to the right team? *

Exposure Identification

Are exposed services, open ports, and admin interfaces identified? *
Are expired/misconfigured certificates and weak TLS detected? *
Are known vulnerabilities on exposed assets correlated (e.g., CISA KEV)? *
Are leaked credentials and exposed secrets monitored across external sources?

Prioritization

Are findings risk-prioritized by exploitability and business criticality? *
Are actively exploited exposures escalated for urgent remediation? *
Is attack surface size trended over time as a program metric?

Remediation

Are findings routed to owners with remediation SLAs? *
Is there a process to decommission unnecessary internet-facing exposure? *
Are EASM findings integrated with the vulnerability management and ticketing workflow?

下载完整的External Attack Surface Management (EASM) Review检查清单

免费获取排版清晰、便于打印的 PDF，或可编辑的 Word 文档。