Introduction
The X-Analytics Account and Access Management Policy Assessment scores your policy against CIS Critical Security Controls v8.1 in minutes. Upload your policy, and the Agent validates it, scores its criteria and quality, updates the related CIS scores in your profile, and shows how much risk each policy improvement would remove from your business.
Bob Vescio, Chief Innovation Officer, walks through the Account and Access Management Policy Assessment, from policy upload to prioritized, risk-reducing recommendations.
Key takeaways
- The Agent scores an account and access management policy in a few minutes, a task partners and customers say takes thirty minutes to an hour by hand.
- Every policy is validated before scoring, with a confidence rating that confirms it’s the right document.
- Each criteria and quality element receives a score and the reason behind it.
- Policy results update the related CIS Safeguard scores in your profile, so your financial exposure reflects your actual policy.
- The report shows the risk-reducing benefit of each policy improvement, and a full assessment extends that view to the entire safeguard.
What is the Account and Access Management Policy Assessment?
It’s an assessment Agent inside X-Analytics that reads, validates, and scores your account and access management policy, then applies the results to your cyber risk profile. It’s one of several new assessment Agents in the X-Analytics toolbox, built in response to customer requests for assessments run directly in the platform. Others include a vulnerability management assessment, a domain account review, and process and procedure validation.
How do you start a policy assessment?
You can start in three steps:
- Open the toolbox in X-Analytics and select the Account and Access Management Policy Assessment.
- Click Start Analysis.
- Upload your account and access management policy when prompted.
How does the Agent validate your policy?
Before scoring, the Agent runs a validation check to confirm the document is an account and access management policy and a final version rather than a draft. Each completed check is displayed along with a confidence rating. In the walkthrough, every check passed with a 95% confidence rating. You then confirm, and the Agent begins scoring.
How is the policy scored?
The Agent scores your policy in two parts, and every element shows its score along with the reason behind it.
Criteria score
Criteria scoring measures how well the policy covers the requirements of the framework. The walkthrough policy is aligned to CIS Critical Security Controls v8.1 Safeguards, and the assessment can align to another framework, such as NIST CSF.
Quality score
Quality scoring measures how well the policy is written and maintained, covering elements such as ownership and accountability, review and maintenance, and traceability.
How does the policy assessment update your CIS scores?
A policy is a component of many CIS Safeguards, and for process-related safeguards it often represents a large share of the score. The Agent adjusts each related CIS score based on your validated and scored policy, so some scores rise and others fall. This gives you an objective way to tune and calibrate your profile. Select “Yes, inform my profile,” and the new scores are applied.
What’s in the policy assessment report?
The Account and Access Management Policy Assessment Report shows where your policy stands and what each improvement is worth. It includes:
- An overall rating and policy score, with total criteria and quality scores
- A rating of adequate, needs improvement, or inadequate for every criteria element, with the reason for each score
- Scores and reasons for every quality element
- The changes made to your profile
- The risk-reducing benefit of each policy element you could add or strengthen
In the walkthrough, the policy scored 60.3% and was rated as needing improvement. Adding the element tied to CIS Safeguard 6.2 offered the largest single benefit, reducing about $306,000 of risk. Making every recommended change would reduce about $761,000.
You can save the report as a shareable artifact in the Vault, edit it, and share it. Consulting firms can deliver it directly to clients, and in-house teams can share it with the colleagues who need it.
How do you go deeper with a full assessment?
A full assessment evaluates the entire account and access management safeguard set, beyond the policy alone. Each safeguard is broken into multiple components and answered with a simple yes, partial, or no. Across twelve sections, the Agent further refines your related CIS scores.
Select “Yes, inform my profile” again, and a new report generates automatically. It keeps the policy results and adds the full assessment findings, with a new set of recommendations that look at each safeguard as a whole. In the walkthrough, strengthening account and access management across the board would reduce $3.41 million of risk. Focusing on CIS Safeguard 5.5 alone would reduce $364,000.
Policy assessment vs. full assessment
| Policy assessment | Full assessment | |
|---|---|---|
| What it evaluates | Your written account and access management policy | The full set of account and access management safeguards |
| Input | An uploaded policy document | Yes, partial, or no answers across twelve sections |
| How it’s scored | Criteria and quality elements, each with a reason | Each safeguard broken into multiple components |
| Effect on your profile | Updates the policy share of related CIS scores | Further refines related CIS scores |
| Recommendations | Policy improvements and their risk-reducing benefit | Safeguard-wide improvements and their risk-reducing benefit |
Frequently asked questions
What does the Account and Access Management Policy Assessment do?
It validates and scores your account and access management policy against CIS Critical Security Controls v8.1, updates the related CIS scores in your profile, and shows the risk-reducing benefit of each policy improvement.
How long does it take to score a policy?
A few minutes. Partners and customers tell us the same review takes thirty minutes to an hour by hand.
What happens if I upload the wrong document?
The Agent validates every upload before scoring to confirm it’s a final account and access management policy, and it displays a confidence rating so you can proceed with certainty.
Which frameworks does it align to?
The assessment aligns to CIS Critical Security Controls v8.1 Safeguards and can align to another framework, such as NIST CSF.
Can I share the results?
Yes. Save the report as a shareable artifact in the Vault, edit it, and share it with your team or, for consulting firms, with your clients.
What’s the difference between the policy assessment and the full assessment?
The policy assessment scores your written policy. The full assessment evaluates every account and access management safeguard, refines your CIS scores further, and returns recommendations for the safeguard as a whole.
Questions about the assessment? Reach out to your X-Analytics customer success team at customersuccess@x-analytics.com.
Related
Meet the CIS CSC 8.1 Upload agent
Upload your CIS Critical Security Controls v8.1 results and turn them into your X-Analytics profile.
Vault: save, annotate, and share your artifacts
Store the artifacts you create, add your own notes, and share them with access you control.
Profile Integrity Check: keep your profile accurate
Keep the profile behind your CIS scores and recommendations current and accurate.
From scan to mitigation plan: the Vulnerability Exposure Analysis Agent, now with Tenable
Connect Tenable or upload scan data and receive prioritized, risk-reducing vulnerability recommendations in minutes.
© 2026 X-Analytics. All rights reserved.