Cybersecurity Fitness Scorecard Components

Component	Details	Points	Source
University Security Initiative Promulgation	Assessment of the organization's promulgation of key Information Security initiatives, such as Cardinal Key Adoption.	10	% of mandated users enforced with Cardinal Key 91% and above: 10 pts 81 - 90%: 9 pts 51 - 80%: 7 pts 31 - 50%: 5 pts 11 - 30%: 3 pts 0 - 10%: 0 pts
Endpoint Minimum Security Standards Adoption	Assessment of the organization’s compliance with endpoint security standards. This includes items such as endpoint encryption compliance and backup.	9	BI reports -- % of endpoints compliant 96 - 100%: 9 pts 90 - 95%: 7 pts 80 - 89%: 5 pts 51 - 79%: 3 pts 0 - 50%: 0 pts
Endpoint Minimum Security Standards Adoption		1	Backups -- % of end user laptops and desktops backed up to central service 90 - 100%: 1 pts 0 - 89%: 0 pts
Server Minimum Security Standards Adoption	Assessment of the organization’s compliance with server security standards regardless of server risk classification.	3	High Risk: Minsec adoption level > 99%: 3 pts 98 - 99%: 2 pts < 98%: 0 pts
		3	High Risk: Minsec inventory attested as being up to date Attestation completed: 3 pts Attestation not completed: 0 pts
		4	Low and Moderate Risk: Minsec inventory attested as being up to date Minsec inventory exists and is up to date: 4 pts Minsec inventory exists but not up to date: 2 pts Minsec inventory does not exist: 0 pts
Application Minimum Security Standards Adoption	Assessment of the organization’s compliance with application security standards regardless of application risk classification.	3	High Risk: Minsec adoption level > 99%: 3 pts 98 - 99%: 2 pts < 98%: 0 pts
		3	High Risk: Minsec inventory attested as being up to date Attestation completed: 3 pts Attestation not completed: 0 pts
		4	Low and Moderate Risk: Minsec inventory attested as being up to date Minsec inventory exists and is up to date: 4 pts Minsec inventory exists but not up to date: 2 pts Minsec inventory does not exist: 0 pts
Cloud Minimum Security Standards Adoption	Assessment of the organization’s awareness and adoption of Stanford’s cloud security standards. This is applicable to the SaaS, PaaS and/or IaaS services used by the organization.	10	Participation in Cloud Security Program Yes: 10 pts No: 0 pts
Attack Surface	Evaluation of the percentage of IP addresses assigned to an organization whose ports are exposed to the public internet which threat actors commonly abuse. The evaluated ports: 20, 21, 22, 23, 25, 53, 68, 69, 88, 110, 135, 137-139, 143, 161, 389, 445, 465, 636, 902, 1433, 1434, 1521, 3306, 3389, 4433, 4444, 5555, 6666, 7777, 8888, 9999, 5432, 5900, 6379, 9200, 27017, 27018.	8	Shodan report: % of hosts with commonly abused ports open to the world < 5%: 8 pts 6 - 10%: 6 pts 11 - 20%: 4 pts 21 - 35%: 2 pts > 36%: 0 pts
Attack Surface		2	Documented business need for opened ports on host(s) Yes: 2 pts No: 0 pts
Vulnerability Management	Evaluation of the organization’s ability to manage server and application vulnerabilities. This also factors in the age of identified vulnerabilities, the strength of the organization’s primary website cryptography and how quickly items are remediated that are found through the Stanford Bug Bounty program.	2	Based on Qualys reports, # of Severity 5 vulnerabilities not remediated within 30 days 0 vulnerabilities: 2 pts 1+ vulnerabilities: 0 pts
		7	% of vulnerabilities older than 6 months 0 - 10%: 7 pts > 10%: 0 pts
		1	Participation in Bug Bounty Program 3+ key department systems in scope: 1 pts < 2 key systems in scope: 0 pts
Security Incidents	Evaluation of the frequency and severity of security related incidents across the organization. This includes items such as compromised endpoints, servers, websites, exposed credentials, and lost or stolen devices.	7	Number of major or critical incidents resulting from MinSec non-compliance within the year 1+ critical incidents: 0 pts 3+ major incidents: 0 pts Otherwise: 7 pts
Security Incidents		3	Lost/stolen devices (incl. personally owned used for Stanford, Stanford owned, USB, mobile, laptop, desktop) 0 unencrypted devices: 3 pts 1+ unencrypted devices: 0 pts
Resistance to Social Engineering	Assessment of how susceptible users in the organization are to various forms of social engineering attacks. This includes data from the Stanford Phishing Awareness Program and security incidents related to social engineering attack patterns.	7	Average Phishing Awareness Program click rate over the last 6 months < 1%: 7 pts 1 - 5%: 5 pts 6 - 9%: 1 pt > 10%: 0 pts
Resistance to Social Engineering		3	Number of compromised accounts due to phishing 0 accounts: 3 pts 1+ accounts: 0 pts
Engagement with ISO	An assessment of how engaged the organization is with their primary ISO security partner and the attendance of the org’s IT contacts in ISO meetings, trainings, seminars and other functions.	10	Attends regularly scheduled meetings with assigned ISO rep (at least quarterly).