Its pretty decent. It has requirements on logging including kernel level logging. The ASV tests are pretty through in terms of testing for known vulnerabili

Its pretty decent. It has requirements on logging including kernel level logging. The ASV tests are pretty through in terms of testing for known vulnerabilities. I failed my first ASV test because my allowed ciphers where vulnerable to the BEAST attack.