SCM; configuration management; it risk; configuration monitoring; configuration assessment; scan-based