Scanning and remediating configuration settings of a device using a policy-driven approach

A computer-implemented method comprising:

• maintaining a plurality of security policies, the plurality of security policies including:
• a plurality of configuration states associated with configuration settings of a client device, the configuration settings referring to one or more settings of an application or operating system on the client device that grant or restrict access to one or more intended functionalities of the application or operating system;
• and
• mapping information associating the plurality of security policies to a plurality of security standards;
• receiving a request to enforce a first security standard from the plurality of security standards;
• identifying a first subset of security policies from the plurality of security policies having mapping information associated with the first security standard for enforcement on the client device, wherein enforcing the first security standard includes causing the client device to perform an operation to enforce a configuration state for a corresponding configuration setting defined by a security policy from the identified subset of security policies regardless of a current state of the configuration setting prior to receiving the request to implement the plurality of security policies on the client device;
• determining whether an exemption applies to at least one of the first subset of security policies;
• in response to determining that the exemption applies to the at least one of the first subset of security policies, bypassing enforcement of the at least one of the first subset of security policies;
• and
• identifying a second subset of security policies from the plurality of security policies having mapping information associated with a second security standard for enforcement on the client device.

A non-transitory computer-readable medium storing instructions thereon that, when executed by at least one processor, cause a computing device to:

• maintain a plurality of security policies, the plurality of security policies including:
• a plurality of configuration states associated with configuration settings of a client device, the configuration settings referring to one or more settings of an application or operating system on the client device that grant or restrict access to one or more intended functionalities of the application or operating system;
• and
• mapping information associating the plurality of security policies to a plurality of security standards;
• receive a request to enforce a first security standard from the plurality of security standards;
• identify a first subset of security policies from the plurality of security policies having mapping information associated with the first security standard for enforcement on the client device, wherein enforcing the first security standard includes causing the client device to perform an operation to enforce a configuration state for a corresponding configuration setting defined by a security policy from the identified subset of security policies regardless of a current state of the configuration setting prior to receiving the request to implement the plurality of security policies on the client device;
• determine whether an exemption applies to at least one of the first subset of security policies;
• in response to determining that the exemption applies to the at least one of the first subset of security policies, bypass enforcement of the at least one of the first subset of security policies;
• and
• identify a second subset of security policies from the plurality of security policies having mapping information associated with a second security standard for enforcement on the client device.