Policy Compliance pretty much has just one use case, and that is to compare or assess the security hardening of a typical operating system or platform or, in some cases, an application against predefined or customized security best practices. For example, if we are running Windows PCs and servers, an organization could say we are going to follow Microsoft's best practices for security configuration, including how to harden Windows computers. We would basically load the Qualys policy compliance module with those best practices and agree on the list with the customer. Then Qualys simply does the rest. It basically verifies for each individual check if it is actually in place or not.
It's a simple product. It's basically binary decisions based on the policy. You first define the policy, and then the tool compares the policy against the actual state of, for example, a Windows computer.
The policy compliance really is the most valuable aspect of the solution. You can actually create your own configuration controls. Even if it's not part of the preexisting library of controls we can handle it. For example, we had a client that had their own specific hardening requirements what kind of, let's say, registry entries or permissions on the file system or specific files being or not being on the file system. We were able to create these policies.
It's really customizable. It can be customized pretty much to meet any need and any policy that customers can throw at us.
