Security control verification and monitoring subsystem for use in a computer information database system

A method for monitoring security control verification in a managed computer system, the method including:

• A. assigning security risk categories to groups of computers;
• B. for the respective groups mapping benchmark security levels to the risk categories;
• C. associating a given computer with the benchmark security level associated with the group to which the computer belongs;
• D. selecting benchmark definition files that correspond to the associated benchmark security level and selected attributes of the given computer;
• D. comparing the security control settings of the given computer with the settings of the selected benchmark;
• and
• E. reporting the results of the comparisons.

A security control manager for controlling security verification operations in a managed computer system, the security control manager including:

• A. means for
• i. assigning security risk categories to respective groups of computers,
• ii. for the respective groups associating the risk categories with benchmark security levels, and
• iii. selecting the benchmark security level for use by a given computer based on the security risk category assigned to the group of which the computer is a member and the benchmark security level associated with the assigned risk category for the group;
• and
• B. means for allowing an overall system or a group administrator to select a mapping of security risk categories to benchmark security levels.