Policy
Qualys provides best practices policies based on vendor suggestions, industry practices, and some research. Currently, policies in the library are used for assessment purposes. As we increase the content (number of controls) for each SaaS, we also offer to combine some of the controls from CIS, best practices policies, or vendor policies.
Some policies that are provided out of the box are filtered under the 'System-defined' category. User-defined policies (aka custom policies) are filtered under the 'User-defined' category. System-defined policies are shown as locked, indicating that they cannot be changed.