Establish the coverage picture
Compare the relevant asset inventory with the systems shown in management and protection tools. Investigate missing, stale, or duplicate entries. Ask who is responsible for endpoints, servers, applications, network equipment, and other relevant components, including those managed by a provider.
The purpose is to understand coverage, not to assume every tool applies to every kind of asset. Identify what safeguards are appropriate to each system and how their operation is confirmed. If a device has stopped reporting, decide who investigates and how the organization determines whether the issue is resolved.
Explain how flaws become completed work
Describe how flaws are identified, evaluated, assigned, corrected, and checked. Account for changes that need testing, approval, a maintenance window, or coordination with a provider. Keep ownership visible so a finding does not become an indefinitely ignored report.
Do not invent a universal patch deadline from this article. The clause requires timely correction; interpret and implement that requirement using the applicable criteria and the actual environment. A useful internal record explains the finding, relevant risk, planned action, completion, and any authorized exception, without treating an exception as an automatic assessment pass.
Review updates, scans, and exceptions
Ask how malicious-code protection is kept current and how the required periodic and real-time scanning operates. Look at relevant configuration and operational records with the technical owner. Investigate protection that is disabled, out of date, misconfigured, or not covering the intended systems.
For a fictional team, a dashboard showing most devices healthy could conceal a laptop that has not checked in for weeks. That is a question to investigate, not a percentage that can be ignored. Work through the exception and verify the result in the actual system before marking the related task complete.
Make the ongoing review sustainable
Identify who reviews coverage and exceptions, how urgent problems are escalated, and how provider-managed work is confirmed. Keep enough context to distinguish a current observation from an old report. Remove sensitive technical details from broadly shared summaries while retaining controlled access to the supporting record.
The evidence index guide can help organize these references. During assessment, choose evidence and methods that address the relevant objectives rather than collecting a large volume of unrelated dashboard screenshots.
Sources & further reading
- FAR 52.204-21: the basic safeguarding clause ↗
- 32 CFR 170.15: Level 1 self-assessment ↗
- NIST SP 800-171A, June 2018: assessment procedures ↗
Published October 24, 2026. Government and company references were checked while preparing this page. General information and practical workflow suggestions; confirm the requirements and services that apply to your organization.
