The virtualisation layer runs hundreds of workloads per host, so one drifted setting, an exposed management interface, an unpatched host or an over-privileged backup account, puts the whole estate at risk at once. This health check is a recurring review of a live hypervisor and virtualisation management platform, run quarterly by the virtualisation owner with security risk and internal audit. It measures whether the controls set out in Securing the hypervisor and virtualisation platform itself are still in place, using formulas you can trend. It does not repeat the hardening steps; it shows where they have slipped and which guide fixes each gap.
What this health check covers
Scope covers type 1 hypervisor hosts, the central management server or cluster manager, the management network, host and console administrators, and the non-human identities that the platform depends on: backup, monitoring, automation and orchestration accounts. For the threat background and architecture, see the Hypervisor and Virtualisation Security Guide. Metrics are vendor-neutral and use generic data sources every mainstream platform provides.
NIST SP 800-125A Rev. 1 gives security recommendations for server-based hypervisor platforms, and SP 800-125B covers virtual network segmentation, traffic control and VM traffic monitoring. The scorecard also supports NIST CSF 2.0 GV.OV-03 and PR.PS-02, and NIST SP 800-53 Rev. 5 CM-6 Configuration Settings, SI-2 Flaw Remediation, AC-6(7) Review of User Privileges, AU-9 Protection of Audit Information and CP-9 System Backup.
Key takeaways
- The management plane is the target. Measure exposure of host and console management interfaces before anything else; a reachable interface makes every other control matter less.
- Integration accounts hold the keys. Backup, monitoring and automation accounts often carry full administrator rights across every host; scope and credential age need their own metrics.
- Patch latency is measured per host, not per cluster. One host left on an old build during maintenance is enough; report the slowest host, not the average.
- Logs must survive the host. Host logs kept only on local storage are lost when an attacker encrypts or rebuilds the host, so measure remote delivery by host and by day.
- Thresholds are a starting point. All bands below are NHI Mgmt Group recommended thresholds; adjust them to your risk appetite and keep them stable year to year.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this Hypervisor and virtualisation platform health check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Operational dashboard (HV-04, HV-09, HV-10) | Monthly, automated | Virtualisation operations | Virtualisation platform owner | Dashboard snapshot, host exception list |
| Quarterly health check (all metrics) | Quarterly, fixed measurement date | Virtualisation platform owner | Security risk or GRC | Configuration exports, scorecard, findings log |
| Annual deep review | Yearly | Infrastructure security lead | CISO or delegate; internal audit re-performs a sample | Sample sheets, restore test record, threshold review minutes |
| Event-driven check | After a new cluster or site, a major version upgrade, an emergency patch for an exploited hypervisor flaw, or an incident | Virtualisation platform owner | Security risk | Scoped scorecard and findings |
Take every figure on the same measurement date. The platform's own administrators should not be the only people who sign off figures about their admin roles (NIST SP 800-53 AC-5 Separation of Duties).
Metrics
Count hosts individually, record the numerator and denominator, and keep the host list with the scorecard. NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| HV-01 | Management interfaces reachable only from the management network | Hosts and management servers whose management interfaces are reachable only from the dedicated management network or jump hosts / all hosts and management servers | Firewall rule export; network scan from user and server segments | 100% | Not used: any exposure is red | Below 100% |
| HV-02 | Console admins signing in through SSO with MFA | Management console admin sign-ins through the identity provider with MFA / all admin sign-ins in the quarter | Management server authentication events; IdP sign-in logs | 100% | 99% to below 100%, remaining local logins only from break-glass | Below 99% |
| HV-03 | Full administrator role holders against approved list | Holders (users, groups and service accounts) of the full administrator role at management server or host level not on the approved register (count); total and change on last quarter | Role and permission assignments export; directory group membership | 0 unapproved | Total rose with approved tickets | Any unapproved holder, or a broad directory group mapped to full admin |
| HV-04 | Hosts on a supported build within patch service level | Hosts on a vendor-supported version with all security updates applied within your service level / all hosts | Host build inventory; lifecycle update compliance view | 98% or more, critical within 14 days | 90% to below 98%, or 98% or more with critical patches over 14 days | Below 90%, or any host on an unsupported version |
| HV-05 | Host-local root or admin credentials vaulted and rotated | Hosts whose local root or admin password is held in a PAM vault and rotated within period / all hosts | PAM vault account inventory; host list | 100% | 95% to below 100% | Below 95%, or a shared password across hosts |
| HV-06 | Host remote shell disabled or under exception | Hosts with remote shell services stopped and set not to start, or with a dated exception / all hosts | Host service configuration export | 100% | Exceptions open more than 7 days | Any running without exception |
| HV-07 | Hosts in restricted management mode | Hosts configured so direct host management is limited to the management server and an exception list / all hosts | Host security configuration export | 95% or more | 80% to below 95% | Below 80% |
| HV-08 | Hosts passing secure boot and integrity attestation | Hosts reporting secure boot enabled and a passing attestation result / all hosts with capable hardware | Host hardware security status; attestation service results | 98% or more | 90% to below 98% | Below 90%, or any failed attestation not investigated |
| HV-09 | Host log delivery to remote store | Host-days with logs received in the SIEM or remote syslog / hosts multiplied by days in the quarter | SIEM ingestion by source host; host syslog configuration | 99% or more | 95% to below 99% | Below 95%, or any host with no remote logging set |
| HV-10 | Snapshots older than 7 days | VMs with at least one snapshot older than 7 days / all VMs | VM inventory with snapshot age | Below 2% | 2% to 5% | Above 5%, or any on a domain controller or credential store VM |
| HV-11 | VMs with a named owner and no orphaned disks | VMs with a current owner tag / all VMs; plus count of unregistered or orphaned virtual disks on datastores | VM inventory and tags; datastore file listing | 98% or more owned, 0 orphaned disks | 90% to below 98% owned, or orphaned disks 30 days or under | Below 90% owned, or orphaned disks over 30 days |
| HV-12 | Integration accounts with scoped roles | Backup, monitoring and automation accounts holding a custom least-privilege role / all such accounts | Role assignments; integration account register | 100% | One with full admin under a dated exception | Any with full admin without exception |
| HV-13 | Integration credentials within rotation period | Integration account passwords, tokens and certificates younger than your rotation period / all such credentials | PAM or secrets manager metadata; certificate inventory | 95% or more | 80% to below 95% | Below 80%, or any older than twice the period |
A single red finding on HV-01, HV-03 or HV-12 rates the whole check red, because each one gives direct control over every workload on the platform.
Annual additions
- Management server restore test: a restore of the management server configuration and database to an isolated network that completes within the recovery time objective. See the Backup and Recovery Testing Checklist.
- Template and image age: VM templates rebuilt or patched within 90 days / all templates in use.
- Sample re-performance: internal audit picks ten hosts and confirms build, remote shell state, restricted mode, remote logging and vaulted root credential directly on each host.
How to collect the data
- Fix the date and the estate. Reconcile the host list from the management server with the hardware asset inventory and the CMDB. Standalone hosts not joined to any management server are a frequent gap.
- Test exposure. Run an authorised network scan of management ports from a user segment and a server segment, and export firewall rules for the management network, for HV-01.
- Export identities and roles. Pull role and permission assignments at every level of the management hierarchy, the directory groups mapped to admin roles with their members, and authentication events from the management server and IdP, for HV-02, HV-03 and HV-12.
- Export host configuration. Pull build and patch level, service states, management mode, secure boot and attestation status, and syslog targets for every host, for HV-04 and HV-06 to HV-09.
- Reconcile credentials. Compare the host list with root and admin accounts held in the PAM vault and their last rotation date for HV-05, and the integration account register with the vault or secrets manager for HV-13. The Service Account Security Guide covers ownership fields.
- Export VM inventory. List VMs with owner tags and snapshot ages, and list datastore files not attached to any registered VM, for HV-10 and HV-11.
- Check log delivery. Count events per host per day in the SIEM or remote syslog for HV-09 and flag hosts with gaps.
- Calculate, compare, sample. Calculate each metric, compare with last quarter, and verify five to ten records for each red metric directly on the host or management server.
Red flags that need action now
- A host or management server interface reachable from a user network or the internet.
- A large directory group, or a group whose membership nobody reviews, mapped to full host or console administrator.
- A host on an unsupported version, or missing an update for a hypervisor flaw listed in the CISA Known Exploited Vulnerabilities catalogue.
- The same root password on several hosts, or root credentials held outside the vault.
- A backup or automation account with full administrator rights and a password older than a year.
- Remote shell running on hosts with no exception, or enabled outside a change window.
- Hosts with no remote log target, or a sudden stop in host logs.
- Unregistered virtual disks or VMs with no owner appearing on datastores.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-HV-01 | Management interface of [n] hosts reachable from [segment] | HV-01 | Red | [Network owner] | [Date] | Open |
| HC-HV-02 | Backup account holds full administrator role | HV-12 | Red | [Backup owner] | [Date] | Open |
| HC-HV-03 | [n] hosts outside patch service level | HV-04 | Amber | [Virtualisation operations] | [Date] | Open |
| HC-HV-04 | [n] hosts not sending logs to remote store | HV-09 | Red | [SOC lead] | [Date] | Open |
Keep one log across quarters and flag repeats. Escalate any finding red for two consecutive quarters to the CISO, and any that repeats three times to the risk register.
Remediation map
| Finding type | Where to fix it |
|---|---|
| Exposed management interfaces, remote shell, restricted mode | Securing the hypervisor and virtualisation platform itself: management plane and host hardening sections |
| Admin role sprawl and directory group mapping | Securing the hypervisor and virtualisation platform itself: administration and identity |
| Over-privileged or stale integration accounts | Backup Identity Isolation Guide and Service Account Security Guide |
| Patch latency and unsupported builds | Patch Management Guide and Emergency Out-of-Band Patching Playbook |
| Missing or broken host log forwarding | Log Management and Retention Guide |
| Old snapshots, orphaned disks, stale templates | Hypervisor and Virtualisation Security Guide: VM lifecycle |
| Failed management server restore | Backup Security and Immutable Backup Guide |
Related guides
- Securing the hypervisor and virtualisation platform itself: the hardening baseline this check measures.
- Cloud Security Maturity Model: where the results place your wider infrastructure programme.
- IT Operations Security Metrics: related operational measures.
- If your hypervisor and virtualisation platform is compromised: the response playbook when a red flag is an incident.
References
- NIST: SP 800-125A Rev. 1, Security Recommendations for Server-based Hypervisor Platforms
- NIST: SP 800-125B, Secure Virtual Network Configuration for Virtual Machine (VM) Protection
- NIST: SP 800-55 Vol. 1, Measurement Guide for Information Security: Identifying and Selecting Measures
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- NIST: Cybersecurity Framework (CSF) 2.0
- CISA: Known Exploited Vulnerabilities Catalog
- CIS: Critical Security Controls v8.1
Related NHI Mgmt Group resources: Securing the hypervisor and virtualisation platform itself, Cloud Security Maturity Model, IT Operations Security Metrics, If your hypervisor and virtualisation platform is compromised.