Manage assets or request their removal

To ensure that your assets and their issue findings have a fair and accurate impact on their scores, help SecurityScorecard understand how they are connected to your organization, and let us know when you think they are not connected.

Qualifying how an asset is connected to you can improve your score. For example, if we know that a domain on your Digital Footprint is a parked domain, any issue finding for that domain does not impact your score.

Access your Digital Footprint

You can access your Digital Footprint by going to your scorecard and selecting Digital Footprint.

Manage domains

Starting asset management with domains is a best practice. A given domain may have hundreds or thousands of associated IPs. By qualifying or refuting that single domain, you efficiently address all of its associated IPs.

Step 1: Select a domain and review how we attributed it to you

Tip: As a best practice, select one domain at a time. This is because each time you submit a qualification or a refute for a domain, our Support team tracks your request as a separate ticket. 

1. Go to the Domains tab to open a list of associated domains.

2. Select the domain you want to qualify or refute, and then select Manage.
   
    

   Note: If your selected domain includes subdomains, you will see a message indicating that subdomains are mapped to the registered parent domains. You cannot manage subdomains individually; you can only manage registered domains.

Step 2: Review our attribution evidence

Review the evidence we used for attributing the domain to your organization.

Step 3: Tell us how the domain belongs to you or if it does not

1. Select a category that qualifies how the domain is connected to you, or select the option indicating that the domain does not belong to you. 
   
   
   
   The following categories are available:

   Category	Explanation	Score impact
   Tenant domain	My organization does not host or manage this domain or subdomain. It belongs to a customer of ours and is hosted on their infrastructure.	All related issue findings for this subdomain do not impact the score.
   Parked domain	This domain resolves to a third-party parking service, such as GoDaddy.	All related issue findings in the Application Security factor for this domain do not impact the score.
   Other	This domain is connected to to my organization in a different way.	Score impact varies depending on how the domain is connected.
   Domain should not be linked to this Scorecard	I can demonstrate that this domain is not correctly attributed to my organization.	This domain, and all of issues found on it, are removed from your Scorecard.

2. After selecting the category, read the description and the Scorecard impact of qualifying the asset this way. If the description does not apply, select a different category. Otherwise, click Continue.
   
   
    
3. On the next page, review the summary of your qualification or refute, and then select Submit.

Our Support team will review your submitted request. Once approved, your score updates within 48 hours.

Manage IPs

As with domains, managing IPs involves helping SecurityScorecard understand how they are connected to your organization, and telling us when you think they are not connected.

We recommend managing one IP at a time to simplify working with Support tickets. And, for maximum efficiency, manage domains first.

Step 1: Select an IP or IP range and review how we attributed it to you

1. Go to the IPs tab to open a list of associated IPs.
2. Select the IP you want to qualify or refute, and then select Manage.

Step 2: Review our attribution evidence

1. To review the evidence we used to attribute the selected IP to your domain, select the IP or any associated IPs.
2. Read through the attribution sources and methods to understand how we connected the IP to the domain. Then, select Manage.
   
   
   1. On the page listing the selected and associated IPs, select the Manage IPs option. Then, click Continue with IP addresses.
      
      
      
      
       

Tip: If you have not yet managed domains in your Digital Footprint, select the Manage domains option to make the asset management process more efficient.

Step 3: Tell us how the domain belongs to you, or if it does not

1. Select a category that qualifies how the IP is connected to your domain, or select the option indicating that the IP does not belong to you. 
   
   
   
   

2. After selecting the category, read the description and the Scorecard impact of qualifying the asset this way. If the description does not apply, select a different category. Otherwise, click Continue.
   
   
    
3. On the next page:

•  
  • Review the list of IPs associated with your selected IP for additional context.
  • Provide a helpful explanation with more context about how this domain is connected to you, or why you think it is not connected.
    
    Also, upload any artifacts that will help illustrate your argument.
    
    Then, click Continue.
    
    
     

4. Review the summary of your qualification or refute, and then click Submit.

Our Support team reviews your submitted request. If we approve it, your Scorecard score updates within 48 hours.

Attribution Log (beta)

You can get visibility into new assets arriving and existing assets departing, along with reasons and timestamps. For more information, see Attribution Log.

Ingest Attribution evidence via a CSV export

Now you can ingest attribution sources and evidence for your domains and IPs via CSV export in your Digital Footprint.

Two new columns are being added to the existing CSV - Source and Evidence

This is currently available based on request, as we want to avoid breaking the existing CSV ingestion process for customers. 

If you would like access, please contact your Customer Success Manager or fill out this support form.