Create a custom scorecard

When your organization's scorecard includes a large set of related domains and IPs, it can be challenging to analyze in its entirety. A custom scorecard solves this by allowing you to define a specific, focused subset of those digital assets. 

You can base a custom scorecard on your own organization's scorecard or on another organization's, such as a vendor's. Using a set of filters, you can include or exclude source scorecard assets based on criteria such as business units, service lines, geographies, or cloud assets.

A custom scorecard functions exactly like any standard scorecard, but it is limited to the specific set of digital assets you define.

Custom scorecard use cases

The flexibility of filtering assets enables you to tailor scorecards to different needs. Below are example use cases for custom scorecards.

Use Case #1: Enterprise cyber-risk management (focused self-monitoring)

Scenario: Your organization needs to focus monitoring on a particular business unit, region,  facility, or any other organizational grouping.

Benefit:

• Security for each focus area is managed by a different person internally. 
• Creating custom scorecards helps your company fix issues faster by allowing you to assign tasks quickly to the correct point of contact. 
• Different organizational units can focus on a smaller set of issues that they control.

How to implement:

• Include or exclude domains or IPs to define the focus of the scorecard you want to monitor.

• Add the custom scorecard to Portfolios for continuous monitoring.

  Note: The scoring on the custom scorecard is not related to the company-based scorecard

User Case #2: Third-party monitoring

Scenario: Your organization wants to monitor a portion of a vendor’s very large scorecard, for example, their customer cloud business.

Benefit: You can focus on a specific, higher-risk area of the vendor scorecard, such as riskier websites and assets, or on specific domains or IP ranges, rather than the vendor's entire digital footprint.

How to implement it: Identify and filter for the correct asset subsets to evaluate.

Understand custom scorecard scoring

The scoring of a custom scorecard is independent of its source scorecards and may differ significantly due to variances in Digital Footprint size and other factors. 

For example, a small, focused custom scorecard may be scored as if it were a small business rather than part of a large international company. As a result, issues in the custom scorecard may be weighted differently than in the base scorecard. 

For a more detailed explanation of scoring factors, visit our SecurityScorecard Trust Portal.

See the FAQ for more information about how issues and Digital Footprints work on custom and source scorecards, respectively.

IP and IP range filter behavior

If an IP or IP range is part of your filter set, the Digital Footprint of the custom scorecard includes or excludes:

• IP Addresses that match the filter and are part of the base scorecard.
• IPv4 Range notation, such as 0.0.0.0/0 or 123.123.123.123/24.
• Domains linked to IP addresses matching the filters.

This means you will see issues on the custom scorecard directly attributed to the IPs you include in filters, as well as issues attributed to domains or subdomains related to those IPs.

Geolocation filter behavior

The geography IP filter includes or excludes IPs that resolve to the country that you selected. Any domains linked to those IP addresses are also included.

Geo-filtering is approximately 80 percent accurate, so using a geolocation-based filter may give inconsistent results. SecurityScorecard recommends using more specific IP or domain filters when possible.

Step 1: Get started

To get started, go to My Organization > Custom Scorecards and select New Custom Scorecard.

You can also open a scorecard you want to use as a source and then select Custom Scorecard.

Enter a name and, optionally, an industry and description.

Step 2: Set access and permissions

Select whether you want to modify the scorecard settings and filters exclusively or if you want to share those permissions with specific individuals or the broader team.

Individual collaborators (internal and external)

You can grant specific access to individual users, regardless of whether they are part of your organization or external.

• Enter the names of any collaborators you wish to add to the scorecard and set their access level.
• Collaborators can be members of your organization or external users. 
• Both internal and external collaborators can be granted Can edit access.

Broader group access 

In addition to individual collaborators, you can set access levels for entire groups using the permissions fields.

• Anyone in the same org (organization members)
  Set the access level for all members of your organization. The available options are Can edit, Can view, and Private.

• Anyone else (external users)
  Set view access for members outside of your organization. The available options are Can view and No access. 

  Note: If you give view access, everyone with a SecurityScorecard account will have access to view the scorecard.

Step 3: Select a source scorecard

First, select the source scorecard(s) for your custom scorecard. A source can be any SecurityScorecard-generated scorecard. 

Once selected, you can use filters to create specific segments that allow you to focus your analysis.

Notes: 

• You only can publish a custom scorecard sourced from your own organization's scorecard.
• You cannot publish a custom scorecard based on multiple sources.

Step 4: Configure filters and logic

Use filters to create the exact segments that you want to focus on within your source scorecard data.  

Understand filter logic

Filters rely on two levels of logic. Knowing the difference helps you get accurate results.

• Logic within a single filter (AND)
  A single filter is made up of one or more criteria (for example, domain, geo location, ip address).
  
  All criteria within a single filter must be true at the same time (an AND relationship) for results to be included.
  
  Example: A filter specifying example.com AND the geo location us will only include IP addresses that match both criteria.

Note: Do not add multiple criteria of the same data type, like two different IP addresses, within a single filter. Since the logic is AND, you’d be asking the system to match two IPs at once, which is impossible, so no results appear.

• Logic between multiple filters (OR)
  If you create more than one filter in a custom scorecard, each filter has an OR relationship to the others. This means that results matching any one of the filters will be included in the scorecard.
  
  You can use this for matching multiple values of the same type, such as two different IP addresses. Instead of putting two IPs in the same filter, create a filter for each IP. The first filter matches 2.192.0.6 OR the second filter matches 185.53.177.20. Using OR logic will produce results.

Choosing filter criteria

Build each filter from a set of criteria, all of which must match for that filter to return results. For example, if a filter specifies the domain example.com and the geo location us (United States), the results will only include IPs that match both criteria.

You can build filters using the following criteria types:

• IP, IP range, CIDR(s)
• Domain/subdomain
• Geo location
• Custom tags

Once you configure your filters, the platform searches the Digital Footprints of the source scorecards and includes any matching assets in the custom scorecard.

Tips when building filters

• Inputting items: Type each value and then press RETURN or ENTER before typing the next one.
• Geo location codes: For locations, use International Organization for Standardization (ISO) two-letter country codes. For example, us for United States.
• Wildcards: Use wildcards (*) to specify domains. A wildcard such as *.company.com  automatically includes company.com. 

Including associated IPs or domains

You can select whether to include associated IPs or domains for the filter. This option expands your result set, but its behavior depends on the type of criteria used in the filter.

For example, if your criteria specify a set of IP addresses, the custom scorecard will include the associated domain and all other IPs attributed to it.

The table below details how the Include associated domain option works for each criterion type.

Excluding items

You can globally exclude assets regardless of other filters. These exclusions override all filter logic.

Filter by issue types 

This layer controls which issues from the source scorecards are included. By default, all issues from source scorecards are included in the custom scorecard.

Preview and create

Select Refresh Preview at the bottom of the page to display filtered assets.

Tip: Each time you change any filters, refresh your preview again. 

If the Digital Footprints of the source scorecards are large, the preview may take longer to refresh. If the source Digital Footprints includes more than 1 million IPs, the preview may not display.

When you have finished setting the filters, click Create.

A score is calibrated for your new custom scorecard within 1 hour of creation. The exceptions are when the source scorecard has more than 100,000 assets or when the custom scorecard has tags. You can assign it to a Portfolio at any time, and if you selected the option to publish it, the scorecard will become publicly visible immediately.

Note: SecurityScorecard sends you an email when your custom scorecard has a score.

Custom scorecard processing time 

Custom scorecards typically process within 1 hour, with a few important exceptions.

Processed within 1 hour

The score for a custom scorecard will be generated or updated within one hour in the following cases:

• Newly created custom scorecards
• Updates to an existing custom scorecard when:
  • The number of measurements changes
  • The filters or recipe are updated

Not processed within 1 hour

The following updates do not qualify for 1-hour processing and may take up to 48 hours (2 days):

• Score changes due to remediations
• Custom scorecards with tags
• Large custom scorecards (such as those with Microsoft- or Google-sized Digital Footprints)
• Digital Footprint changes, including:
  • Age-outs
  • Auto-Resolution
  • Addition of new issue types

FAQ

Q. I have Fast Score enabled, but my custom scorecard is not being created in real time. Why?

Currently, Fast Score is not available for custom scorecards.

Q. Should I contact my vendor for domains and IP ranges or CIDR blocks that I need for a custom scorecard?

Yes, if you want the vendor’s help to determine which domains or IP addresses are most relevant to you. In some cases, a vendor creates and publishes their own custom scorecard for a particular business unit. Researching which domains and subdomains you use to interact with the vendor can provide a good starting point for a custom scorecard based on that vendor. Related IP ranges are included through dynamic attribution.

Q. Does a Custom scorecard take up a usage slot as it does with following a scorecard?

Yes.

Q. If I resolve an issue finding on a custom scorecard, is that same finding also resolved on the source scorecard? 

Yes. The finding has the same ID on the source and custom scorecards.

Q. Can I use a custom scorecard to change the Digital Footprint of the source scorecard?

No. You can only claim, add assets, or request their removal on the Digital Footprint for the source scorecard.

Q. If my Digital Footprint is missing the asset I need for my custom scorecard, do I need to add it to my base scorecard first?

Yes, only domains, subdomains, or IP ranges that are part of a base scorecard are available to match one or more filters. If the asset is removed from a base scorecard that previously matched a filter, it no longer matches the custom scorecard and will be removed from it as well.

Q. Does a custom scorecard include the historic scores of its sources?

Source scorecard history prior to the creation of the Custom scorecard is not included in that custom scorecard. It includes only findings present on the source scorecards at the time of creation.

Q. Where can I see who changed filters for a specific custom scorecard?

You can view this information from the Audit Log. Go to My Organization > Custom Scorecards to view all of the custom scorecards you are monitoring. Select the menu icon (...) for the scorecard and choose Show History to see all changes.

Q. How can I manage multiple custom scorecards associated with my company account?

You can view all of the custom scorecards you are monitoring by going to My Organization > Custom Scorecards. Here, you can monitor all your existing custom scorecards. By selecting multiple scorecards, you can perform the following bulk actions:

• Delete the selected scorecards.
• Add the selected scorecards to a Portfolio.
• Share the selected scorecards with others.