Content library
CyberFundamentals (Belgium)
RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks.

How to fill the requirement

CyberFundamentals (Belgium)

RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks.

Task name
Priority
Status
Theme
Policy
Other requirements
Process for managing technical vulnerabilities
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Technical vulnerability management
requirements

Task is fulfilling also these other security requirements

12.6.1: Management of technical vulnerabilities
ISO27 Full
14.2.1: Secure development policy
ISO27 Full
ID.RA-1: Asset vulnerabilities
NIST
PR.IP-12: Vulnerability management plan
NIST
RS.AN-5: Vulnerability management process
NIST
1. Task description

The organization has defined a process for addressing identified technical vulnerabilities.

Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:

  • risks related to the vulnerability and the necessary actions are identified (e.g. patching the system or other management tasks)
  • necessary actions are scheduled
  • all actions taken are documented
Initial treatment of identified technical vulnerabilities
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Technical vulnerability management
requirements

Task is fulfilling also these other security requirements

12.6.1: Management of technical vulnerabilities
ISO27 Full
ID.RA-1: Asset vulnerabilities
NIST
PR.IP-12: Vulnerability management plan
NIST
RS.AN-5: Vulnerability management process
NIST
RS.MI-3: New vulnerability mitigation
NIST
1. Task description

We have defined the rules for responding to identified vulnerabilities. The rules may include e.g. the following things:

  • who are part of a quick-response team that is ready to respond to vulnerabilities
  • the person locating the vulnerability immediately informs the entire team down the agreed channel
  • the team determines the severity of the vulnerability (low, medium, high) based on predefined criteria
  • the team decides whether to continue processing as a security breach (more urgently) or under general change management
  • the necessary individuals are selected to continue addressing the vulnerability

Vulnerabilities related to high-risk data systems are always of high severity and are addressed first.

No items found.