Findings Impact of Delegated Security Controls

Companies identified as having delegated security controls are impacted in the following manner:

• Findings in assets with delegated controls are excluded from the risk vector grade depending on the type of delegated control.
• Findings that are excluded from the risk vector grade of an entity due to delegated controls are also excluded from the parent’s entity risk vector grade.
• Findings in assets without delegated controls continue to be included in the risk vector grade.
• Ratings may not necessarily improve. Both positively and negatively contributing findings are excluded from the risk vector grades.

Impact on Risk Vectors

Refer to the following table outlining how risk vectors are impacted by findings for each delegated control type:

Impact on Assets

The same set of assets (domains and IPs) continue to be attributed to the company and visible in the Bitsight applications, even if some of the assets are identified as having delegated security controls.

Refer to the Attribution and Assets tabs in the Infrastructure page of the Security Posture Management application to see which assets are classified as having (or not having) delegated controls.