Best practices call for security leaders to create a framework for understanding factors that impact the attack surface and the ways that tools, third-party suppliers, and internal staff combine to discover, prioritize, remediate, and validate ASM. Staff in the SOC, especially, need to react to automated inputs, make use of dedicated tooling, and make decisions and take actions based on their experience, training, and policy guidelines. And where external suppliers are part of the overall delivery of ASM/CV, it is important for management to ensure successful two-way interaction between internal teams, outsourcers, and consultants by integrating processes and aligning reporting templates.