Koordinēta ievainojamību atklāšana

The organization should have documented processes and templates for reporting detected vulnerabilities.

The vulnerability detection reports should be submitted immediately to the competent cyber incident prevention institution, and no longer than five days after detecting the vulnerability.

The detection report should include the following information:

• Date and time of detection of vulnerability (if possible);
• Information about the information system or electronic communication network in which a vulnerability has been detected;
• A description of the vulnerability;
• A description of the methodology used to detect the vulnerability or the sequence of actions performed;
• Contact information of the vulnerability disclosure report submitter;
• Other information that the submitter of the vulnerability detection report considers necessary for the identification and prevention of the identified vulnerability.

The organization needs to define Monitored Metrics for identifying and correcting vulnerabilities. Meters must be monitored at specified intervals.

Detection processes and procedures are maintained and tested to ensure awareness of anomalous events. Detection activities must comply with all relevant requirements.