The organization shall establish and maintain a documented process that allows continuous
review of vulnerabilities and strategies to mitigate them.
Guidance
- Consider inventorying sources likely to report vulnerabilities in the identified components and
distribute updates (software publisher websites, CERT website, ENISA website).
- The organization should identify where its critical system's vulnerabilities may be exposed to
adversaries.
The organization has defined a process for addressing identified technical vulnerabilities.
Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:
We have defined the rules for responding to identified vulnerabilities. The rules may include e.g. the following things:
Vulnerabilities related to high-risk data systems are always of high severity and are addressed first.
The organization regularly conducts a vulnerability scan, which searches for vulnerabilities found on computers, workstations, mobile devices, networks or applications. It is important to scan even after significant changes.
It should be noted that vulnerable source code can be from operating system software, server applications, user applications, as well as from the firmware application as well as from drivers, BIOS and separate management interfaces (e.g. iLo , iDrac). In addition to software errors, vulnerabilities occur from configuration errors and old practices, such as the use of outdated encryption algorithms.
The technical vulnerability management process is regularly monitored and evaluated to ensure its effectiveness and efficiency.
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
