Technical Controls
Evidence for the controls you already run.
One record of the security tests you commission, the security tools you run and the assets each covers, where your logs are kept and who reviews them, and the certifications you hold, kept beside your assessment as evidence. Everything here is what you record: Vivid Risk runs no test, detects no tool, reads no log and verifies no certificate.
What it does
Security Testing Register
The penetration tests and exercises you commission or run: who carried them out, whether they were independent, the scope, the findings each report counted, how many of the findings you linked in the Vulnerability Hub are still open, the retest date, and when the next one is due. Vivid Risk performs, arranges and verifies no test.
Tool Coverage by Asset
The security tools you run (endpoint protection, backup, MFA, log management and the rest) and which of your recorded assets each covers, with the critical and high assets missing a kind of tool you already use. Coverage is what you record; nothing is detected.
Logging and Retention
Where each system's logs are kept, for how long, who reviews them and on what schedule, and the reviews people record, with the ones that are overdue. Vivid Risk collects, stores and reads no log.
Certifications
The certificates and attestation reports you hold or are working towards, such as ISO/IEC 27001 or Cyber Essentials: who issued each and who accredits them, the number, scope, expiry and next audit, with the ones expiring or due. Vivid Risk certifies no one and verifies no certificate.
Why it matters
- Cited where your regime asks for it: NIS2 Art. 21(2)(f) in the EU, DORA Art. 24 and RTS 2024/1774 Art. 12 for financial entities, the NCSC CAF in the UK.
- Findings from a test go to the Vulnerability Hub, typed in or imported from your scanner's export.
- Each asset can list the software it runs and the end-of-support date you record for it.