Newly identified vulnerabilities are mitigated or documented as accepted risks.

The organization has defined a process for addressing identified technical vulnerabilities.

Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:

• risks related to the vulnerability and the necessary actions are identified (e.g. patching the system or other management tasks)
• necessary actions are scheduled
• all actions taken are documented

We have defined the rules for responding to identified vulnerabilities. The rules may include e.g. the following things:

• who are part of a quick-response team that is ready to respond to vulnerabilities
• the person locating the vulnerability immediately informs the entire team down the agreed channel
• the team determines the severity of the vulnerability (low, medium, high) based on predefined criteria
• the team decides whether to continue processing as a security breach (more urgently) or under general change management
• the necessary individuals are selected to continue addressing the vulnerability

Vulnerabilities related to high-risk data systems are always of high severity and are addressed first.