Understanding Security Control Evaluation

Technical Controls

Evaluated automatically through integrations:

• Backup status and currency

• MFA enrollment

• Patch levels

• Encryption status

• EDR deployment

Procedural Controls

Require attestation or documentation:

• Security awareness training

• Incident response plans

• Access review frequency

• Vendor management

Physical Controls

Typically require manual verification:

• Data center access

• Hardware disposal

• Visitor logging

How Evaluations Work

1. **Data Collection** - Pull latest data from connected integrations

2. **Normalization** - Convert vendor-specific data to standard format

3. **Rule Application** - Apply control-specific evaluation rules

4. **Scoring** - Determine pass/fail and confidence level

5. **Evidence Capture** - Store supporting data for audit

Evaluation Frequency

|--------------|-------------------|

Determining Pass/Fail

Each control has defined criteria:

Example: CIS 11.2 (Automated Backups)

• **Pass**: Backup completed within last 24 hours

• **Fail**: No backup in 24+ hours

• **Partial**: Backup exists but older than policy

Example: CIS 6.3 (MFA for Admin)

• **Pass**: 100% of admin accounts have MFA

• **Fail**: Any admin account without MFA

• **N/A**: No admin accounts defined

Confidence Scores

Each evaluation includes confidence:

• **High (90%+)**: Direct API evidence

• **Medium (70-89%)**: Inferred from related data

• **Low (<70%)**: Limited evidence available

What Counts as Evidence

BrainstormMSP collects:

• Raw API responses (hashed for integrity)

• Timestamps of data collection

• Configuration snapshots

• Change detection logs

Evidence Retention

• Last 12 months retained by default

• Point-in-time queries for any date

• Export for auditor review

• Cryptographic integrity verification

Using Evidence

Evidence supports:

• Insurance attestations

• Audit responses

• Client reporting

• Dispute resolution