ADR-2 - Vulnerability Management, Identification and Remediation
Control for continuous vulnerability lifecycle management
Control Definition
Threat and vulnerability intelligence must be collected and analyzed from external sources to anticipate risks, and a continuous program for identifying, prioritizing and remediating vulnerabilities across all technology assets must be implemented through periodic scans. Remediation must be prioritized according to asset criticality and vulnerability severity, tracked through to closure, and exceptions that can't be remediated within the established time frame must be formally managed.
Requirements
Requirement 1
We implement a continuous program for identifying, classifying, prioritizing and remediating vulnerabilities across all technology assets.
Requirement 2
We run vulnerability scans on a scheduled sequential basis for critical systems and for the rest of the technology estate.
Requirement 3
Vulnerability scans cover a defined percentage of the assets registered in the inventory.
Requirement 4
We prioritize vulnerabilities based on the CVSS score and the criticality of the affected asset.
Requirement 5
We import the results into the ticketing system and assign them to the asset owner for remediation.
Requirement 6
We apply remediation SLAs defined by vulnerability criticality.
Requirement 7
For exceptions we require a leader's approval, documentation of compensating controls and a maximum resolution date.
Requirement 8
We collect information on information security threats from external sources (CVEs, vendor advisories, intelligence feeds) to produce useful intelligence about them.
Requirement 9
We analyze the collected information security threat information to produce useful, actionable intelligence that guides remediation decisions.
Requirement 10
We obtain up-to-date information on technical vulnerabilities in the information systems the organization uses through authorized external sources, complementing the results of internal scans.
Requirement 11
We automatically monitor SLA compliance and escalate to the area's manager when SLAs are missed.
Requirement 12
We verify vulnerability remediation through rescanning.
Requirement 13
We review current exceptions on a scheduled basis.