Risk Vector Grading with Insufficient Data

Default:

Having SPF records for all domains (including SMTP servers and those that aren’t configured to send email) is best practice. If a company does not intend to send email from a domain, an attacker can still use that domain to spoof email.

Only domains that are sending email and don’t have SPF records are affected.

❖ If there are no findings and we are temporarily unable to collect data, the most recent grade is assigned for up to 400 days before being assigned the default grade.

Default:

Without DKIM records, we cannot verify that a company is effectively preventing email from being spoofed from its domains. This is set in the center of the grading scale for computing into security ratings.

❖ If there are no findings and we are temporarily unable to collect data, the most recent grade is assigned for up to 400 days before being assigned the default grade. If the most recent grade is lower than the default grade, the default grade is assigned.

Default:

This is set in the center of the grading scale for computing into Bitsight Security Ratings.

Some findings cannot be traced back to specific companies due to the use of third party systems; such as web filters and Content Delivery Networks (CDN), that are capable of redirecting and encapsulating network traffic. Some firewalls might also be detecting and blocking external data gathering tools from getting any data.

❖ If there are no findings and we are temporarily unable to collect data, the most recent grade is assigned for up to 400 days before being assigned the default grade. If the most recent grade is lower than the default grade, the default grade is assigned.

Default:

This is set in the center of the grading scale for computing into Bitsight Security Ratings.

Some findings cannot be traced back to specific companies due to the use of third party systems, such as web filters and Content Delivery Networks (CDN) that are capable of redirecting and encapsulating network traffic. Some firewalls might also be detecting and blocking external data gathering tools from getting any data.

❖ If there are no findings and we are temporarily unable to collect data, the most recent grade is assigned for up to 400 days before being assigned the default grade. If the most recent grade is lower than the default grade, the default grade is assigned.

Default:

Companies are not required to run open port services. The rating is positively impacted if there are no findings for this risk vector.

Default:

Some findings cannot be traced back to specific companies due to the use of third party systems; such as web filters and Content Delivery Networks (CDN), that are capable of redirecting and encapsulating network traffic. Some firewalls might also be detecting and blocking external scanning tools from getting any data. This is set in the center of the grading scale for computing into security ratings.

❖ If there are no findings and we are temporarily unable to collect data, the most recent grade is assigned for up to 400 days before being assigned the default grade. If the most recent grade is lower than the default grade, the default grade is assigned.

Default:

The rating is positively impacted if there are no findings for this risk vector within its lifetime.

Default:

The rating is positively impacted if there are no findings for this risk vector.

Default:

The use of server software is not required to improve an organization’s cyber security posture. Therefore, there’s no penalty or negative impact to the rating in the absence of Server Software findings.

Default:

This default grade does not have a negative impact on the rating. It is equivalent to a perfect grade.

Either:

• There are no findings.
• The estimated number of users falls below a minimum threshold. To avoid sudden fluctuations, the risk vector is reassigned an A to F grade when the estimated number of users has stayed above the threshold for 65 days.

Default:

This default grade does not have a negative impact on the rating. It is equivalent to a perfect grade.

Either:

• There are no findings.
• The estimated number of users falls below a minimum threshold. To avoid sudden fluctuations, the risk vector is reassigned an A to F grade when the estimated number of users has stayed above the threshold for 65 days.

Default:

No ratings impact. This risk vector does not currently affect security ratings. It is being evaluated for a period before being factored into Bitsight Security Ratings.

Default:

Not all organizations have mobile application offerings. This default grade is assigned if the organization has not published any mobile applications (no assets).

Default:

Some findings cannot be traced back to specific companies due to the use of third party systems; such as web filters and Content Delivery Networks (CDN), that are capable of redirecting and encapsulating network traffic. Some firewalls might also be detecting and blocking external scanning tools from getting any data. This is set in the center of the grading scale for computing into security ratings.

❖ If there are no findings and we are temporarily unable to collect data, the most recent grade is assigned for up to 400 days before being assigned the default grade.

Default:

DMARC is a temporarily non-graded risk vector.

Default:

This is an informational risk vector. It does not currently affect security ratings.

Default:

The rating is positively impacted if there are no File Sharing findings.

Default:

The absence of ratings-impacting Security Incidents do not positively affect security ratings, but its presence has a negative impact. This default grade is designed to neutralize any positive or negative impact to the risk vector.