About Qualys Custom Controls

Library policies provided by Qualys may include a control type called Qualys Custom Control (QCC). This control type quickly provides new controls that are similar to user-defined controls. Once added to your account, if needed, you can copy any QCC to make your own UDC that you can customize to meet your needs.

You can import policies from the library with QCCs into your account and export them to your local system just like UDCs. We ensure that the duplicate QCCs are not added to your controls list by assigning an internal UDC ID. You’ll see the UDC ID when you export a QCC or a library policy that includes a QCC from your account.


Go to Policies > New > Policy > Import from Library. Choose a policy and click Next. If the selected policy includes QCCs you’ll see the option “Include Qualys Custom Controls”. This option is selected by default and is recommended. Click Create to import the policy and the add the QCCs. Don’t want the QCCs? No problem. Simply uncheck the option. Show meShow me

Import Policy with Include Qualys Custom Controls checkbox selected

Add asset groups to the policy and save it. Then the policy will appear on your policies list. The QCCs added from the policy appear on your controls list. A new Type column shows QCC for each Qualys Custom Control. Show meShow me

Controls list with type column showing QCC and SDC

A QCC cannot be edited (except to change criticality) or deleted. Like service-defined controls, Qualys may update QCCs in subsequent releases to provide new technology support, updates to values, etc. This will not have any impact to the QCCs added to policies.

You can make a copy of any QCC to create a UDC that you can customize to meet your exact needs. It’s easy to do – just choose Copy from the Quick Actions menu and then confirm the action. Show meShow me

Copy option on Quick Actions menu on Controls list

The new UDC will appear on the controls list where you can edit it.

When you export a policy you will see the option Include UDCs and QCCs. By default all service-defined controls in the policy are included. Select this option to also include user-defined controls and Qualys custom controls in the policy.

Show meShow me

Export Policy with Include UDCs and QCCs checkbox selected