Vulnerability coverage
Coverage measures how much of the estate has been examined, not how exposed it is.
What the published 2016 guidance says
Coverage measures how much of the estate has been examined, not how exposed it is. The construct divides the systems assessed in the last quarter, or penetration tested in the last year, by all systems. The target is 1. Evidence is the assessment and test record. It is collected quarterly. Security analysts or a contracted third party own it, the analysts collect, and the security manager is the client. An aggregate pie chart and a pie chart per system group show the ratios, so that a well-covered core cannot hide an unexamined edge.
What it means in practice
Coverage measures how much of the estate has been looked at, not how vulnerable it is. Count systems assessed in the quarter or tested in the year against the total. Report by homogeneous group so that a well-covered core does not hide an unassessed edge.
Status of this record. For B.37, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the system inventory and the assessment and test reports. Count the systems assessed in the quarter or tested in the year against the total. Report by group. Record the plan for the unassessed systems.
Evidence an assessor asks for
- Vulnerability managementComplete system inventory as the denominator
- Technical complianceAssessment and test reports with dates per system
- Vulnerability managementAggregate and per-group pie charts
The question an assessor will ask
An assessor will ask for complete system inventory as the denominator. The test for B.37 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Total systems unknown, so coverage is overstated
- Assessments older than the quarter still counted
Before the next review
Before the next review, test this against one live record: total systems unknown, so coverage is overstated.
What to check when the revision publishes
When DIS 27004 is published, compare the B.37 Vulnerability coverage record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.